LoyaltyPrivacy policy for Vesopa Loyalty apps
Applies to The Vesopa Kitchen and every venue loyalty app built on Vesopa Loyalty, on iPhone, iPad, Android, Windows and the web. Last updated 25 October 2026.
- We collect what the app needs to run your loyalty card: who you are, your membership and points, and how you sign in.
- The app does not use your location.
- Only your name, email address and membership are required. A mobile number, photo, notifications and passkeys are optional, and you can remove them at any time.
- We do not sell your data, show advertising, or use analytics or tracking tools in the app.
- You can delete your account and data in the app (Account › Delete my account and data) or at auth.vesopa.com/delete-account/thevesopakitchen.
1. Who we are
The apps are made and run by Vesopa Software Limited, a company registered in Wales, company number 17362206, of Baglan, Port Talbot, SA12 7AX, United Kingdom.
Each loyalty app belongs to a venue. The venue is the controller of its members' data and Vesopa Software Limited processes it on the venue's behalf. The Vesopa Kitchen is Vesopa's own demonstration venue, so for that app Vesopa Software Limited is the controller. Its members, visits and news are sample data.
Contact us about privacy at info@vesopasoftware.com.
2. What we collect and why
| Data | Why | Required? |
|---|---|---|
| Name and email address | To create your membership, sign you in with a code and show your name on your card. | Yes |
| Mobile number | To sign in with a text-message code, if you add one. The number is proved with a code sent by Google Firebase. | Optional |
| Photo | Shown on your card so venue staff can recognise you, if you add one. | Optional |
| Membership: card and member number, points, tier, visits, what you spent and earned, membership dates | To run the loyalty scheme. Points are added and spent by the venue's till. | Yes |
| Membership payments: the amount, date and result of a payment you make in the app | To renew your membership. The card itself is handled by Dojo; we never see the card number. | Only if you pay in the app |
| Sign-in details: a password (stored only as a secure hash), passkeys, your Vesopa account link, and the devices you are signed in on | To keep your account secure and let you sign other devices out. | Only the ones you set up |
| Notification token for your phone, computer or browser | To deliver the venue's news and offers as notifications. | Optional |
| News you have received and read | To show the venue's messages in the app and mark new ones. | Yes |
We do not collect your location, contacts, files, advertising identifiers or browsing activity, and the app contains no analytics or advertising software.
3. Your privacy choices
Everything optional can be switched off or removed in the app, at any time, without affecting your membership:
- Notifications: Settings › Notifications, or your device's own settings.
- Mobile number and photo: Account › remove them.
- Passkeys and signed-in devices: Account › Signing in.
- Your whole account: Account › Delete my account and data.
All of these are listed on our privacy choices page.
4. Our legal bases
- Contract: running your membership, card, points and sign-in.
- Consent: notifications, your mobile number and your photo. You can withdraw it at any time in the app or in your device settings.
- Legitimate interests: keeping accounts secure and preventing misuse.
- Legal obligation: sales records the venue must keep for tax.
5. Who else receives data
We never sell personal data. It is shared only with the services that make the app work:
- The venue whose app it is, in its Vesopa back office.
- Apple Push Notification service (iPhone and iPad), Google Firebase Cloud Messaging (Android), Microsoft Windows Push Notification Services (Windows) and your browser's push service (web), which receive a notification token and the message to deliver it.
- Google Firebase Authentication, which receives your mobile number to send and check a text-message code, in the iPhone, iPad and Android apps and on the web.
- Vesopa Auth (auth.vesopa.com), if you choose Continue with Vesopa or ask for your data to be deleted.
- Apple and Google, only if you choose Sign in with Apple or Continue with Google: they tell us your name and email address.
- Dojo (Paymentsense Limited), if you pay for or renew a membership in the app: Dojo takes the card payment, and we never see your card number. We keep the amount, the date and the result.
- Apple Wallet and Google Wallet, only if you add your card to them: they receive your card's name, number and points to show it.
The apps and data are hosted on Vesopa's servers. Where a provider above processes data outside the UK, it does so under the safeguards UK data protection law requires.
6. How long we keep it
- Your membership, for as long as it is active, or until you ask for it to be deleted.
- Sign-in codes expire after 10 minutes and are deleted within a day.
- Sales and points records for six years, as the venue must keep them for tax. They stay without your name or contact details once you delete your account.
- A record that a deletion request was carried out, with your email address shortened so it no longer identifies you.
7. Deleting your account and data
You can ask for your account and data to be deleted at any time, without contacting the venue:
- In the app: Account › Delete my account and data.
- On the web, without the app: https://auth.vesopa.com/delete-account/thevesopakitchen. For any venue app, auth.vesopa.com/delete-account.
You can choose automatic deletion after 7, 15 or 30 days, which you can cancel until then, or deletion as soon as possible, which our team carries out, normally within two working days. We email you when it is done. What is deleted and what is kept is listed on that page and in section 6.
8. Your rights
Under UK data protection law you can ask for a copy of your data, correct it, delete it, restrict or object to how it is used, and receive it in a portable form. Email info@vesopasoftware.com. We answer within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
9. Security
Data travels over HTTPS. Passwords are stored only as secure hashes, sign-in codes are single-use and short-lived, and you can see and sign out every device on your account.
10. Children
The apps are not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
11. Changes
If this policy changes we update this page and the date at the top.