Privacy Policy

1. Who we are

BakeryMS (“we”) operates the BakeryMS bakery-management platform at bakeryms.com and the BakeryMS Rewards mobile app for iOS and Android. This policy explains what personal data we collect through both, why, and what rights you have. We are based in the European Union and comply with the General Data Protection Regulation (GDPR). The controller is SIA Webelevate (reg. no. 40203464762), Platones iela 15, Rīga, LV-1029, Latvia — contact us at hello@webelevate.com.

2. BakeryMS Rewards app — what we collect

• Account data: your email address or phone number (used to sign in with a one-time code). Optionally a display name, and your birthday (day and month only, never the year) if you choose to add it — participating bakeries use it to send you a birthday offer. If you connect Google or Sign in with Apple to sign in faster, we receive only the email address and name you choose to share with us, plus the provider’s account identifier that links it to your existing account.
• Loyalty activity: the stamps you collect and rewards you redeem, including which participating shop, at what time, and which counter stamp or QR code was used. This is the core function of the app — it is how your card balance and rewards are calculated.
• Ratings and messages: if you rate a visit or write to a bakery, your rating, comment and messages are shared with that bakery only so it can reply to you.
• Push notification token: if you allow notifications, a device push token so we can tell you about your stamps and rewards. Bakeries can send you offers and birthday treats only if you say yes to offers — a choice you can change at any time under Settings → Notifications (consent, GDPR Art. 6(1)(a)).
• Invite code activity: if you use a friend’s invite code, we link the two accounts to award the referral bonus.

We do not collect your precise location, contacts, photos, or advertising identifiers. The app contains no third-party advertising or cross-app tracking, and we never sell personal data.

3. How loyalty data is shared

Each loyalty card belongs to one participating merchant (the bakery or café whose program you joined). That merchant can see your name/email, your stamp and reward history in their own program, and aggregate statistics. Merchants cannot see your activity at other businesses. We share nothing with anyone else, except the infrastructure providers below.

4. Infrastructure providers

Data is processed by Supabase (database and authentication), Vercel (hosting), and — for push notifications — Expo, Apple Push Notification service and Google Firebase Cloud Messaging. On the business platform, supplier invoices are read by an AI model provider (Google Gemini; Anthropic or OpenAI as a fallback) so a person can review the extracted lines before anything is saved. Each acts as a processor under GDPR-compliant terms.

5. Website analytics

On our public website (not inside the BakeryMS app) we count visits with Vercel Web Analytics. It uses no cookies and does not identify you; we see aggregated numbers such as page views, country and device type.

Only if you click “Allow analytics” do we also load Google Analytics 4 (Google Ireland Ltd), which sets cookies (_ga, _ga_*) to tell repeat visits apart. We use it to see which pages are useful and whether the contact form and demo are used. You can change your choice at any time; withdrawing removes these cookies.

Change cookie settings

6. Retention & deleting your account

We keep your data for as long as your account exists. You can permanently delete your account inside the app: open Settings → Delete account. This immediately and irreversibly erases your profile, cards, stamp history, vouchers, and push tokens. You can also request deletion by emailing hello@bakeryms.com.

7. Your GDPR rights

You have the right to access, correct, export, restrict, or erase your personal data, and to object to processing. Contact us at the email above; we respond within 30 days. You may also lodge a complaint with your local data protection authority (in Latvia: Datu valsts inspekcija).

8. BakeryMS platform (for bakery businesses)

For staff accounts on the BakeryMS management platform we process the account data your employer registers (name, work email or username, role) and the operational records you create (orders, production, inventory, attendance). Your employer is the data controller for this data; we process it on their behalf to provide the service.

9. Changes

We will post any changes to this policy on this page and update the effective date above. Material changes affecting the Rewards app will also be announced in the app.