Privacy Policy

Places 360 · Last updated 11 August 2026

Places 360 is operated by Digit Places Limited, registered in England and Wales (company no. 13863363) ("we", "us"). We are the data controller for your Places 360 account. This policy explains what we collect when you use the Places 360 app and websites, and how we handle it.

What we collect

• Account details — your email address (or your Apple or Google sign-in identity), an optional display name, and — if you choose to verify one — your phone number.
• Loyalty activity — which businesses you join, stamps you collect, offers you claim, and rewards you earn and redeem, with timestamps.
• Orders — what you ordered, when and where, the contact name and phone number you give for an order, and any delivery address you save.
• Payments — handled by Stripe. We never see or store your card number. We keep the order amount, its payment status, and non-identifying card metadata (brand, funding type, country) for reconciliation.
• Location (optional) — used at the moment you search for nearby places or when a business verifies venue presence for a stamp. Used in the moment, with your permission; we never track you in the background.
• Push token — a device identifier so we can send notifications, if you allow them.
• Guest browsing — you can browse without an account. Places you save before signing up stay on your device. Web guest checkout creates a temporary anonymous account that you can later claim or leave behind.
• Business content — if you run a business on Places 360: your business and payout details, content you publish, and your customers' activity at your venue.

Your phone number

Two numbers exist and are never merged. A verified account phone number (used to secure your account, for phone sign-in on partner apps, or to unlock phone-verified offers) stays on the platform — it is never given to a business. Separately, the contact number you type on an order goes to that venue, for that order, so they can reach you about it.

What businesses see

• Every business you interact with sees your activity at their venue: your display name, stamps, rewards, offers claimed, orders (with the contact details you gave on them), and a per-business reference code.
• Businesses on our branded-app tier — venues offering their own app — additionally see the account email of their own customers, so they can serve them across their channels.
• No business sees your activity at any other business, and reference codes are different at every venue so businesses cannot match you between them.
• Businesses may only contact you with marketing where you have consented.

If you work at a venue that uses Places 360

Venues can use Places 360 to let their team clock in and out. If yours does: your shift times, how you clocked (tag, location check-in, kiosk or a manual entry) and — where the check-in method uses your location — your distance from the venue are recorded and visible to the venue's managers. A venue can choose to require a photo when clocking in or out on the shared kiosk or in the app; the app tells you before the photo is taken, the photo is only ever reviewed by the venue's managers, nothing is scanned or biometrically recognised, and photos are deleted automatically after 31 days. Your kiosk PIN is stored only as a cryptographic hash.

What we don't do

• We don't sell your data. Ever.
• We don't track your location in the background.
• We don't use third-party advertising or cross-app tracking SDKs in our app.

Marketing and consent

Platform marketing email is opt-in — asked once, unticked by default, changeable any time in Profile. We record when you accept the terms and when you give or withdraw marketing consent.

Who processes data for us

Processor	What for
Supabase	Database and authentication — hosted in London, United Kingdom (AWS eu-west-2)
Stripe	Card payments and business payouts
Apple	Sign in with Apple, push notifications, Apple Pay
Google	Sign in with Google, where you choose it
Twilio	Phone verification SMS
Resend	Transactional email (confirmations, receipts)
Cloudflare	Website hosting and delivery

Businesses may connect their own tools (for example a till system or receipt printer); order details flow to those under the business's instruction.

Data in transit and at rest

Encrypted in transit (TLS) and at rest. Access to production data is restricted and logged.

Your rights (UK GDPR)

You can access, correct, export, or delete your data at any time. Deleting your account (Profile → Delete account) removes your profile, loyalty progress, rewards and personal identity immediately; order and payment records that we must keep for tax and accounting law are retained without your identity attached. Contact privacy@places360.io and we'll respond within 30 days. You may also complain to the ICO (ico.org.uk).

Retention

We keep your data while your account is active. Financial records are retained for the periods UK tax law requires, then deleted. Businesses keep the aggregated history of their own venue's activity; deleting your account removes your identity from it.

Children

Places 360 is not directed at children and requires users to be at least 16.

Changes

We'll post any changes here and note the date above. Material changes will be flagged in the app.