Privacy Policy

1. Who we are

BakeryMS (“we”) operates the BakeryMS bakery-management platform at bakeryms.com and the BakeryMS Rewards mobile app for iOS and Android. This policy explains what personal data we collect through both, why, and what rights you have. We are based in the European Union and comply with the General Data Protection Regulation (GDPR).

2. BakeryMS Rewards app — what we collect

• Account data: your email address (used to sign in with a one-time code). Optionally a display name and birthday if you choose to add them.
• Loyalty activity: the stamps you collect and rewards you redeem, including which participating shop, at what time, and via which counter tag. This is the core function of the app — it is how your card balance and rewards are calculated.
• Push notification token: if you allow notifications, a device push token so participating merchants can send you offers and reward updates.
• Invite code activity: if you use a friend’s invite code, we link the two accounts to award the referral bonus.

We do not collect your precise location, contacts, photos, or advertising identifiers. The app contains no third-party advertising or cross-app tracking, and we never sell personal data.

3. How loyalty data is shared

Each loyalty card belongs to one participating merchant (the bakery or café whose program you joined). That merchant can see your name/email, your stamp and reward history in their own program, and aggregate statistics. Merchants cannot see your activity at other businesses. We share nothing with anyone else, except the infrastructure providers below.

4. Infrastructure providers

Data is processed by Supabase (database and authentication), Vercel (hosting), and — for push notifications — Expo, Apple Push Notification service and Google Firebase Cloud Messaging. Each acts as a processor under GDPR-compliant terms.

5. Retention & deleting your account

We keep your data for as long as your account exists. You can permanently delete your account inside the app: open Settings → Delete account. This immediately and irreversibly erases your profile, cards, stamp history, vouchers, and push tokens. You can also request deletion by emailing hello@bakeryms.com.

6. Your GDPR rights

You have the right to access, correct, export, restrict, or erase your personal data, and to object to processing. Contact us at the email above; we respond within 30 days. You may also lodge a complaint with your local data protection authority (in Latvia: Datu valsts inspekcija).

7. BakeryMS platform (for bakery businesses)

For staff accounts on the BakeryMS management platform we process the account data your employer registers (name, work email or username, role) and the operational records you create (orders, production, inventory, attendance). Your employer is the data controller for this data; we process it on their behalf to provide the service.

8. Changes

We will post any changes to this policy on this page and update the effective date above. Material changes affecting the Rewards app will also be announced in the app.