Privacy notice

KYP Rewards receives information people provide when creating an account, joining a business program, operating a business workspace, contacting support, or using the public website.

We use information to operate the loyalty service, keep accounts secure, deliver requested communications, provide support, understand product performance, and comply with legal obligations.

KYP Rewards does not sell personal information. We may use contracted service providers for hosting, storage, authentication, communications, security, analytics, and payment processing. They may process information only to provide their contracted service.

We retain information for as long as needed to provide the service, meet contractual and legal obligations, resolve disputes, and prevent abuse. Retention periods differ by data type and account status.

The service runs with access controls, encryption in transit and at rest, audit logging, and operational safeguards appropriate to the information it holds. The platform is in open beta and onboarding merchants by application, so the number of people whose data we hold is small and deliberately so. No system is completely secure, and these controls will keep being improved rather than declared finished.

Customers can update profile information, change notification and marketing preferences, leave joined business programs, and request account deletion. Business administrators can manage authorized staff and business information.

KYP Rewards operates in the Philippines, and personal information here is protected by the Data Privacy Act of 2012 (Republic Act No. 10173). The Act gives every data subject a specific set of rights, and naming them is more use than a general promise to respect your privacy.

The Act requires a Personal Information Controller to appoint a Data Protection Officer accountable for compliance. Ours is being appointed alongside our incorporation and registration with the National Privacy Commission, and this section will carry their name and a direct address before anything is charged. We would rather name a real person here than a role nobody answers.

In the meantime privacy questions, access requests, corrections, objections and deletion requests reach the team at support@kyprewards.com, and are handled on the timescales set out on this page — the process is running now, whatever the title on the door.

Where a security incident affects personal data and is likely to put the people involved at real risk, the Act requires notification within seventy-two hours of us knowing about it. That notice goes to the National Privacy Commission and to those affected. We commit to that timescale.

A notification will say what happened, what data was involved, what we are doing about it, and what you can do — not merely that an incident occurred.

Personal data is kept while it is needed for the purpose it was collected for, and then deleted or anonymized. Account data is held while the account is open; loyalty history is held while the customer is a member of that program; and a closed business workspace is retained briefly so it can be restored or exported before removal.

One-time codes, sessions and password-reset tokens are short-lived by design and are swept automatically rather than accumulating.

Specific retention periods for each category are being fixed before the paid tiers open, and will be published here rather than left to be inferred.

Joining a business's program shares a defined set of your details with that business, and both they and KYP Rewards then make decisions about that data. What moves, when it moves, and who answers for what is set out on the data sharing page.

Leaving a program stops that sharing and removes you from that business's member list. Your account, and your membership of any other business, is unaffected.

We will update this notice when our practices or legal obligations change. Material changes will be communicated through the service or by another appropriate method.

Questions about this notice can be sent to support@kyprewards.com.