Last Updated: September 15, 2026
This Privacy Policy explains how Giggys Inc., a corporation incorporated under the federal laws of Canada (the Canada Business Corporations Act), with its registered office in the Province of Ontario ("Giggys," "we," "us," or "our"), collects, uses, discloses, and retains personal information about Merchants who register for and use the Giggys platform (the "Platform") to run reward campaigns, consistent with the defined terms in our Merchant Terms of Service.
By registering for a Giggys merchant account, you consent to the collection, use, and disclosure of personal information as described in this Policy, to the extent permitted by applicable law.
This Policy covers only Giggys' handling of Merchant personal and business information. It does not describe how Giggys handles personal information belonging to end customers who use the Platform to claim rewards, or visitors to Giggys' website. Those are separate data flows governed elsewhere.
When you register and operate a merchant account, we collect: business name, category, business and billing address, tax identification information (where applicable), your account email address, a logo or brand image, the physical or online locations where your business operates, and, if you enable push notifications on your device, a device push notification token.
We do not currently collect a distinct personal name for a business owner or account contact — only the business name and the account email address, other than the cardholder name entered on a payment card.
Your card details are collected and stored directly by our payment processor, Stripe — Giggys' own systems never receive or store your full card number. We retain only non-sensitive metadata about your payment method: card brand, last four digits, funding type, expiry, cardholder name, and the card's issuing-bank identification number.
We use Merchant personal information to operate and provide the Platform; process payments and calculate applicable tax; verify your eligibility to register and remain active on the Platform; communicate with you about your account, including transactional emails and, if you enable them, push notifications about account-relevant events such as beta-program status, campaign changes, and billing confirmations (for example, confirming that a weekly hold or charge succeeded); respond to support inquiries you submit; comply with legal and tax obligations; and maintain the security and integrity of the Platform.
We do not sell personal information. We share Merchant personal information only with service providers acting on our behalf, and only as needed to provide the Platform:
Stripe — payment card details, charges, refunds, and tax calculation.
Google Cloud / Firebase — hosting, authentication, database, file storage, and, if you enable push notifications, delivery of those notifications via Firebase Cloud Messaging using your device's push token.
Resend — transactional email, using your account email address.
Mapbox and Google Places API — the business or billing address you type, converted into map coordinates or autocomplete suggestions.
Firebase App Check — helps distinguish legitimate use of the Platform from automated abuse.
Google Gemini (generative AI) — when a customer submits a Claim against one of your Campaigns, we send your business name, together with the customer's submitted photo or video, to Google's Gemini AI model to check whether your branding is visible or referenced. Your business name is the only Merchant data point shared with this processor.
Expo / EAS Update — the merchant app periodically contacts Expo's update servers to check for and download app updates. This exchange may expose technical information such as your device's IP address and app version to Expo; no Merchant account data described in Section 1 is sent to Expo.
Google Analytics for Firebase — receives non-identifying usage data (which screens you view, general app interactions, device model, operating system version, and app version) to help us understand how the Platform is used and improve it. This is configured without Apple's advertising identifier (IDFA) and without linking your usage data to any advertising network or other company's data for advertising purposes.
Firebase Crashlytics — if the app crashes or encounters an unexpected error, receives a crash report containing diagnostic information such as the error itself, device state at the time of the crash, and device model, operating system version, and app version, to help us find and fix the underlying bug.
We may also disclose personal information where required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition, or sale of assets.
Giggys is a Canadian company. Our service providers, including Google Cloud/Firebase and Stripe, are based in Canada, the United States, and other countries, and your personal information may be stored and processed in any of these locations. By registering for a merchant account, you acknowledge that your information may be processed in a country other than your own, which may have different data protection laws.
We retain Merchant personal information for as long as necessary to provide the Platform and for legitimate business, legal, or tax purposes.
When you request account deletion, your account is immediately marked deleted and your access is disabled. We then retain your billing hold history and weekly performance statistics for seven (7) years following account closure, to comply with Canadian tax record-keeping obligations and to resolve any disputes, chargebacks, or claims that may arise; after this period, we securely delete this data. Your business name, category, business and billing address, tax identification information, account email address, and payment metadata (card brand, last four digits, funding type, expiry, cardholder name, and issuing-bank identification number) are retained indefinitely as part of a permanent, deactivated account record — this lets us, among other things, recognize the account if the same email address is used to register again, as described in Section 10 of our Merchant Terms of Service.
We rely on the security infrastructure provided by Google Cloud/Firebase and Stripe, including encryption of data in transit and at rest. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
You may request access to, correction of, or deletion of your personal information by contacting us at support@giggys.app. An account deletion request is currently processed as a soft deletion rather than complete erasure; if you require complete erasure of your data, please state this explicitly in your request, and we will evaluate what is technically and legally possible.
The merchant app uses Google Analytics for Firebase to collect non-identifying usage data, such as which screens you view and how you interact with the app, as described in Section 3. It also uses Firebase Crashlytics to receive crash and error reports so we can find and fix bugs, Firebase Authentication session tokens, Firebase App Check tokens, a device push notification token (if you enable push notifications, as described in Sections 1 and 3), and periodic contact with Expo's update servers to deliver app updates (Section 3). Google Analytics for Firebase is configured without Apple's advertising identifier (IDFA) and does not link your usage data to any advertising network or other company's data for advertising purposes; the merchant app does not run advertising technology. If that changes, we will update this Policy accordingly.
We may update this Privacy Policy from time to time. If we make material changes, we will provide notice by email. Continued use of the Platform after an update takes effect constitutes acceptance of the revised Policy.
If you have questions about this Privacy Policy or how we handle your personal information, contact us at support@giggys.app.
This policy covers the mobile app. The website has its own Privacy Policy.
View the Giggys shopper app Privacy Policy →