Privacy policy
Last updated: June 11, 2026
This policy describes how RewardMeNow collects, uses and protects the personal data of merchants and loyalty card holders, in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
1.Data controller
The data controller is RewardMeNow, publisher of the rewardme.now platform, based in Ontario, Canada. For any question about your data, contact us at privacy@rewardme.now.
2.Data we collect
For card holders: a technical device identifier (the rewardme_device_id cookie), the points or stamp balance, the loyalty transaction history and, only if a portal account is voluntarily created, an email address. For merchants: the owner's identity, business contact details (email, WhatsApp), billing information and platform usage data. Enrolling a customer at the counter requires no name, no phone number and no declarative data whatsoever.
3.Purposes of processing
Data is processed to: issue and update Apple Wallet and Google Wallet loyalty cards; account for points and rewards; let merchants send notifications related to their program; bill subscriptions; secure the platform and comply with our legal obligations.
4.Legal basis
Processing is based on contract performance (providing the loyalty service), consent (marketing communications, portal account creation) and legitimate interest (security, fraud prevention), consistent with the fair information principles set out in Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
5.Data recipients
A card holder's loyalty data is visible only to the business concerned. RewardMeNow relies on technical processors (hosting, email delivery, Apple and Google infrastructures for pass issuance) bound by confidentiality commitments. No data is ever sold to third parties.
6.Retention periods
Loyalty data is retained for as long as the merchant's program is active. The device cookie expires after 2 years. Billing data is retained for the statutory accounting and tax periods applicable in Canada. Inactive portal accounts and their associated data are deleted at the holder's request.
7.Your rights
Under PIPEDA, you have the right to access your personal information, challenge its accuracy, and withdraw consent to its processing at any time. Card holders with a portal account can exercise these rights directly from the Privacy Center, including granular withdrawal of each marketing consent and erasure requests. For any request: privacy@rewardme.now. If we cannot resolve your concern, you may also lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC).
8.Security
Data is hosted on secure infrastructure, encrypted in transit, partitioned per business (multi-tenant isolation at the database level) and accessible only to authorized personnel. Card access tokens are cryptographically signed and expire automatically.
9.Cross-border transfers
Issuing Apple Wallet and Google Wallet passes involves a limited technical transfer to Apple and Google infrastructures, which may be located outside Canada. RewardMeNow remains accountable for personal data handled by these processors, consistent with PIPEDA's accountability principle, and limits any transfer to what is strictly necessary to provide the service.
10.Contact
For any question about this policy or to exercise your rights: privacy@rewardme.now. We respond to any personal data request within a maximum of 30 days.