Privacy Policy for Membber

Welcome to Membber. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our services. Our goal is to provide a simple, effective digital loyalty platform for local businesses while respecting your privacy.

This service is operated by Membber Ltd, a company registered in England and Wales under company number 17465037.

Company Name: Membber Ltd Registered office: 12 Trindles Road, South Nutfield, Redhill, England, RH1 4JN

This policy applies to all users of our services, including the businesses who subscribe to our platform ("Merchants") and their customers who participate in the loyalty programs ("End-Customers").

Platform: The Membber digital loyalty system, including the customer iOS App and App Clip, Membber Business app, website, payment pages, and related technologies.

Merchant: A business that subscribes to the Membber Platform to offer a loyalty program to its customers.

End-Customer: An individual who participates in a Merchant's loyalty program by scanning a QR code, tapping an NFC tag, or using the Membber App or App Clip.

App Clip: Our iOS App Clip that allows End-Customers to collect loyalty stamps instantly without downloading a full app.

We collect different types of information depending on whether you are a Merchant or an End-Customer.

3.1. Information We Collect from Merchants

When you sign up as a Merchant, we collect information necessary to provide you with our service:

• Account Information: Your name, email address, phone number, and business name.

• Business Profile Information: Information you provide to customize your loyalty program, such as your business logo, brand colours, and background images for your digital stamp cards.

• Payment Information: We use the third-party payment processor Stripe to handle all subscription payments. We do not store your full credit card details on our servers. Stripe processes your payment details on our behalf and provides us with information such as your billing details and a token representing your account.

• Usage Data: Information about how you interact with Membber Business and related merchant tools, such as login times and features used.

When you set up card payments with Membber, Stripe collects your name, date of birth, address, phone, bank details and sometimes a photo of your ID, to meet anti-money-laundering rules. When you provide personal data in connection with setting up payments with Membber, Stripe receives that personal data and processes it in accordance with Stripe’s Privacy Policy (https://stripe.com/privacy). Membber can see the details you give and whether Stripe has verified them, and uses them only to run your payouts and meet our legal duties.

So that you do not have to type them again, when you tap Start we give Stripe, where we can, the name, email address and phone number you have already given Membber for your own account. You can change any of them in Stripe’s form. We never give Stripe your date of birth, your address, your ID or your bank details: only you give Stripe those.

3.2. Information We Collect from End-Customers

When you participate in a loyalty program as an End-Customer, we collect information solely to operate that program:

• Phone Number: Your mobile phone number, used to identify your loyalty account. This is collected when you use our App or App Clip.

• Profile Information (Optional): If you complete your profile or use customer messaging features, we may store your name and email address.

• Sign-In Identifiers: If you choose Apple Sign In or Google Sign In, we may store the provider user identifier for that sign-in method. If you use passkey (WebAuthn) authentication, we store the public key credential associated with your device for secure passwordless login. If you set a password, it is stored only as a one-way hash.

• Date of Birth (Optional): Saved from your profile screen where you choose to give it, and used for birthday rewards and for age conditions on a membership.

• Member Profile (Optional, Gym Members Only): Where a gym asks members to complete a profile, we store what you enter: home address, city, postcode, gender, date of birth and a free-text medical notes box. The medical notes box is treated as health data, and Section 5 sets out the lawful basis for it.

• Loyalty Program Data: A record of your stamps earned, rewards collected, and vouchers issued for each Merchant's program you participate in. This includes the date and time of each stamp.

• Device Information: When using our App Clip, we collect basic device identifiers to provide security and prevent fraud. This does not include your name or other identifying information beyond your phone number.

• Digital Wallet Information: If you choose to add your loyalty card to Apple Wallet, we generate a unique digital pass. To update this pass, we may collect and store a push token and serial number associated with the pass. We do not access any other information in your digital wallet.

• Push Notification Token (Optional): If you enable notifications in our app, we may collect and store a device push token so we can deliver message, reward, or account-related alerts to your device.

• Message Attachments (Optional): If you choose to upload a photo or video in one of our messaging surfaces, we store that selected file and share it within the conversation with the relevant Merchant. We only receive media you explicitly choose to upload.

• Location (Optional): Two separate features use location and they behave differently. Nearby Store Alerts uses Apple's built-in geofencing to detect when you are near a store you have joined; that processing happens entirely on your device and no coordinates are sent to us or to anyone else. Finding shops near you is a search: when you look for nearby shops with location access allowed, your device's coordinates are sent to our servers with that search so results can be sorted by distance. They answer that one search and are not stored against your account. Both features are off until you turn them on, and either can be turned off in the app's Settings.

• Meal and Nutrition Data (Optional, Gym Members Only): If your gym has the meal diary switched on and you choose to log a meal, we store the photograph you take, what the food was identified as, and its calories and protein. This is health information about you and is only collected because you photographed and saved a meal. See Section 5 for the lawful basis and Section 8 for how to remove it.

3.3. Information We Do NOT Collect

We want to be clear about what we do NOT collect from End-Customers:

• A Record of Where You Go: We do not build a location history and we do not track your movements. Location is used for exactly two things, both described in Section 3.2: on-device geofencing for Nearby Store Alerts, which sends us nothing at all, and a one-off distance sort when you search for shops near you. Coordinates sent with a search are used to answer that search and are not stored against your account. If you use neither feature we only know which store you visited, from the Merchant's NFC tag or QR code you scanned.

• Browsing History: We do not track websites you visit outside our service.

• Contacts: We do not access your phone contacts.

• Full Photo Library Access: We do not scan, copy, or access your full photo library or camera roll. We only receive media that you explicitly choose to upload.

3.4. Information We Collect Automatically

When you visit our website (membber.com), customer checkout pages, or merchant app handoff pages, we may collect technical information automatically:

• Log Data: IP address, browser type, operating system, and pages visited. This helps us monitor, secure, and improve our services.

This applies only to Membber Drops sellers who choose "Set up from your Instagram". Nobody else's Instagram is ever read.

How it works. You log in on Instagram's own screen and approve access. We never see your Instagram password. It works only with Instagram Business and Creator accounts, and it asks Instagram for one permission, basic access to your own professional account (Meta calls it "instagram_business_basic"). We never post, comment, send messages or read insights.

What Instagram gives us, once, with your approval: your username, name, account type, profile picture and bio, and your most recent posts (up to 24): the photos, the videos and their cover pictures, and each post's caption, date and number of likes. We show them only to you, so you can choose what to keep. If you are making a private preview we sent you your own ("Finish setup", section 6b), we also check that the username Instagram gives us is the account that preview was made for, and keep only that it matched and when, so we know the shop is really yours. The number of likes is used only to choose which photos to tick for you first. Captions are used only to describe each picture to screen readers in that picker; they are never copied into your shop.

What goes into your shop: only what you keep. Your profile picture becomes your logo if you choose it, your shop name and bio change only if you change them, and the photos and videos you tick are copied into your shop's own storage. Videos are copied without sound. A video we cannot make silent safely, or one over the length limit, comes in as its cover picture only.

What we do not keep. The access Instagram gives us is used for that one import and then thrown away; we do not store it and cannot use it again. The list of posts we read can be used for 24 hours and is deleted when you finish. If you do not finish, it expires after those 24 hours and our daily clean-up deletes it, so it is gone within two days at the latest.

What we do keep: for each photo, film, logo or bio you brought in, a note that it came from Instagram, with the two ID numbers Instagram gives our app for your account (it uses one for your login and one for your professional account), so that we can remove it if you or Instagram ask us to. The note goes when you delete that photo from your shop.

Why we may do this (legal basis): you asked us to, to set up the shop you have signed up for (contract).

Removing it. If you remove Membber in Instagram (Settings, then Apps and websites), or ask Instagram to delete your data from Membber, Instagram tells us; you can also email privacy@membber.com. Either way we remove the photos, videos, logo and bio you brought in from Instagram (a logo or bio you have since changed is left alone, and so is anything you uploaded yourself), delete every note linking them to your Instagram, and delete anything left over from an unfinished import. For a deletion request we also give you a confirmation code and a page showing that it is done. Your shop name stays, because a shop needs one; you can change it at any time. You can also delete any photo you brought in yourself, at any time.

Our use of your data is strictly tied to providing and improving the Membber Platform.

4.1. For Merchants • To create and manage your account

• To process your subscription payments via Stripe

• To allow you to create and customise your visual loyalty cards

• To provide you with Membber Business tools to configure your account, track activity, approve stamps, and manage checkout

• To communicate with you about service updates, support, and billing

• While your Drops shop is not yet live, to remind you what is left to set it up: by email the day after you sign up, then on days 3, 7 and 14, then once a month, never more than once a day, and once by text message when one step is left, to the mobile number on your account; every reminder has a link that stops them for good, and they end when your shop goes live

4.2. For End-Customers • To create and manage your digital stamp card for a specific Merchant

• To send you real-time confirmations and updates on your stamp progress, including visual stamp card images

• To automatically issue a digital voucher when you have collected the required number of stamps

• To update your loyalty pass in your Apple Wallet when a new stamp is approved

• To deliver optional notifications you have chosen to receive, such as message or reward alerts

• To send and display optional message attachments that you explicitly choose to upload

• To enable Merchants to validate your stamps and redeem your vouchers

• To show you your own meal diary and member profile, and to show them to the gym whose app you entered them in, where you have chosen to use those features

• To prevent fraud and abuse of the loyalty system

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and, where applicable, Regulation (EU) 2016/679 (the EU GDPR). We process personal data based on the following legal grounds:

Performance of a Contract: Most of our data processing is necessary to fulfill our contractual obligations to our Merchants (to provide the loyalty platform) and to provide the loyalty service requested by End-Customers.

Legitimate Interests: We process some data for our legitimate interests, such as for security monitoring, fraud prevention, and analysing service usage to make improvements. We only do this when our interests are not overridden by your data protection rights. We also rely on legitimate interests when we hold the details of a maker we contact about Membber Drops and make her a private preview; Section 6b explains exactly what, and how to say no.

Consent: When you, as an End-Customer, choose to scan a QR code, tap an NFC tag, or use our App Clip, you consent to us processing your information to provide the loyalty service. You also provide consent when you optionally choose to add the pass to your digital wallet, when you turn on notifications, and when you allow location access.

Explicit Consent (Article 9): Two things a gym app can hold are health data under Article 9 of the UK GDPR: meals logged in a meal diary together with the calories and protein recorded against them, and the free-text medical notes box on a member profile. We rely on your explicit consent, given when you first log a meal or write in that box. Nothing is collected until you do, both are visible only to you and to that gym, you can delete any meal or clear the box, and doing so withdraws the consent without affecting the rest of your membership.

We do not sell your personal data. To provide our Platform, we rely on a number of trusted third-party companies who act as our service providers and sub-processors. These companies are essential for running our service, for example by providing the physical servers, database infrastructure, and payment processing. We only share the minimum information necessary for them to perform their function.

Our key third-party providers include:

• The Merchant: As an End-Customer, your phone number and stamp history are visible to the Merchant whose loyalty program you have joined, so they can manage stamp approvals and voucher redemptions. • Stripe: We use Stripe for two things: Merchants' own subscription payments to us, AND payments you make when you buy from a Merchant through Membber — for example when you order a batch drop for collection. In that second case Stripe processes the payment on the MERCHANT's behalf, and the Merchant is the seller. Your full card details are handled by Stripe and are never seen or stored by Membber or by the Merchant. • Supabase: Our core infrastructure, including our databases, user authentication systems, and file storage (for logos and card backgrounds), is hosted with Supabase. • Vercel: Our website, customer checkout pages, and related web handoff surfaces are hosted on Vercel's servers. Vercel Speed Insights measures how quickly our pages load, and Vercel Web Analytics counts page visits and the site or campaign they came from; neither stores anything on your device, and both receive page addresses with any private part removed. • PostHog: Only if you say yes to our cookie question, PostHog, an analytics service we use in its EU cloud, records heatmaps and screen recordings of our public web pages so we can see which parts of a page work. Everything you type is hidden from recordings, it never runs on order, payment, sign-in or seller pages, and it is set to discard your IP address. See Section 12. • Sentry: When something on our website or apps breaks, an error report (what failed, the page, and the browser or app version) is sent to Sentry so we can fix it. • Apple: If you use the digital wallet feature, data is exchanged with Apple to create and update your loyalty pass.

Some of these third-party processors are based in the United States. Where data is transferred outside the UK or European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office (ICO). You may request a copy of the SCCs by contacting us at privacy@membber.com.

This section covers what happens when you buy from a Merchant through Membber, or ask to hear about their drops. It was added on 25 August 2026 because our previous policy described the Platform mainly from a loyalty-card point of view and did not clearly cover buying.

Who is responsible. When you buy from a shop, the sale is between you and that shop. The shop decides what to do with your order details and is the controller of them. Membber runs the software and the checkout, and is the controller of the account and technical information described elsewhere in this policy.

What we collect when you order:

• Your name, so the shop knows whose order it is when you collect. • A mobile number or an email address, so we can send your confirmation and your collection reminder, and so the shop can reach you if something changes. • What you ordered, the collection window you chose, and what you paid. • A payment reference from Stripe. We never receive your full card number.

Verification codes. If we text or email you a short code to confirm it is really you, we keep that code only for the few minutes it is valid, plus a record that a verification took place. Codes are not used for marketing.

Drop alerts. If you ask a shop to tell you when they open a drop, we store the number or address you gave, which shop you asked about, and the exact words you agreed to at the time, together with when you agreed. We keep the wording so that if you ever ask why you are hearing from a shop, we can show you precisely what you signed up to. Every alert carries a way to stop, in one step. Stopping alerts does not stop confirmations for an order you have placed, because those are part of the purchase. We also keep a record of every time your alerts were turned on or off and how: from a link in a text or an email, on the shop's page, or by the shop. A shop can turn your alerts off at any time. It can turn them back on only if you ask it to, and we then send you one message saying so, with a way to stop. If a shop corrects your email address or mobile number in its own records, the corrected one gets no alerts until you sign up with it, and the old one stops getting them.

Telling you when a size or colour is back. If a size and colour you want is gone and you ask a shop to email you when it is back, we store the email address you gave, which shop and which item, size and colour you asked about, and the exact words you agreed to, with when you agreed. When it can be bought again in one of that shop's drops, we email you once (nothing, if the shop has blocked you) and the ask ends. It also ends if you stop the shop's messages, or if we cannot deliver the email after three tries. Asking does not put you on the shop's drop alert list, and that email has nothing else in it and a way to stop. An ask that is not back within 60 days ends, and we delete it at our next check, within minutes. Every other ask is deleted 30 days after it ends. We delete your email address within about an hour once nothing of yours is left at that shop, unless you are on its drop alert list or asked it to remind you about a drop. If you have stopped a shop's messages, asking does not turn them back on: we keep your address with your stop, the words you agreed to that shop with and when, and the record of each time your alerts there were turned on or off, until you ask us to delete them. Asking does not give you a Membber account: if you only ever asked to be told when something is back, email privacy@membber.com from that address and we will send you a copy of what we hold for it, or delete it, at every shop. Your address is used for nothing else.

Questions you send a shop. If you message a shop about a drop — for example to ask about allergens — the shop can see your message, the first name, email address and mobile number you give when you ask, and the name and contact details attached to any order you place with it. We send a short code to the email address first, to check it is yours; if you are already on that shop's drop alert list and are writing to it for the first time, we skip the code, because you gave the shop that address when you signed up. The shop keeps your name and email with the conversation so it can reply, and it can also change the name, email address and mobile number it shows for you in its own records; that changes nothing that any other shop sees, and nothing about how you sign in. We can see your messages too, because they pass through our systems, and we may read them if one of you asks us to help with a dispute.

How long we keep order information. Order and payment records are kept for six years after the end of the tax year they fall in, because HMRC requires a business to keep its records that long. Drop alert subscriptions are kept until you stop them, and then a suppression record is kept so we do not accidentally add you again. If you ask us to delete your information, we anonymise your personal details immediately and keep only the financial line the law requires, with no name attached.

What we do not do. We do not sell your details, we do not pass them to other shops, and we do not use them to advertise other Merchants to you.

This section covers small food businesses and makers we contact about Membber Drops, and the private previews we make for them. It was added on 28 September 2026.

What a preview is. We find some makers ourselves, on their public Instagram profiles. We may make a maker a private preview: a page showing what her own free Membber Drops shop could look like, with her menu, prices and photos. It is not a shop and nothing on it can be bought: its basket, collection times and previous drop are there only to show how ordering would work, and its reviews are samples we wrote, which the top of the page says. They are never stored or shown anywhere else. We send her its link in a message we write ourselves.

What we hold, and where it comes from. From her public Instagram profile and, where she has one, her own public website: her Instagram handle, her shop name, the kind of thing she sells, her brand colour, the words she published about her shop, the area she says she is in, the names and descriptions of up to twenty things she sells, a price only where she published one herself (with the page it came from), and up to twenty-four product photos and her logo, chosen by us. We copy these by hand, with a small tool in our own web browser, or with an AI assistant working for us in our own web browser, which reads her public profile and her website as any visitor can and fills in a draft for us; it never logs in as her, messages her or reads anything that is not public. A person at Membber checks every draft before it becomes a preview, and every message to her is written and sent by a person. That tool reads, by machine, the profile page we have open: her handle, her name, her bio, her profile picture and the photos from her grid that our browser has already loaded. It works one profile at a time, only when we click it, and it never scrolls, clicks or asks Instagram for anything more. It may briefly hold up to twelve of her photos and her profile picture, and it reads her bio to suggest what she sells; the bio is not kept, and any photo we do not choose is deleted within 24 hours. We do not run server-side scrapers, use Instagram's or Meta's own tools to copy her content, or collect anything from Instagram on our own servers. We also note when the preview was made, when we sent the link and when we followed up, when it was first and last opened, and how many times it was opened. Until she taps "Finish setup", we do not hold her personal name (beyond her shop name), her email, phone number or address, unless she taps "Create Free Account" and gives us her email or phone number herself (below), and we never guess a price, allergens, a collection day, an address or how buyers pay.

If she taps "Create Free Account". Until we open her setup, the button on her preview says "Create Free Account" rather than "Finish setup". Tapping it does not make her account: that happens only if she taps "Finish setup" (below). If she taps it, we note when, and we tell the person at Membber who will reply to her. It then asks for her email or phone number, which she can give or leave. If she gives it, we use it only to reply to her about her preview and setting up her shop, never for marketing or anything else, and we rely on her consent for it (UK GDPR Article 6(1)(a)), which she can withdraw at any time by telling us. It is kept with her preview, where only Membber can see it, and it is deleted when the preview is (after 30 days, or straight away if she taps "Delete this preview" or asks us not to contact her), or when she finishes setup, when her own account takes its place. When we open her setup, the same link says "Finish setup".

Why, and on what basis. To offer her a free Membber Drops page. We rely on our legitimate interests (UK GDPR Article 6(1)(f)) in offering a small food business a free tool that fits how she already sells. We have assessed that, with the safeguards in this section, this does not override her interests. The email or phone number she chooses to give us after tapping "Create Free Account" is the one exception: for that we rely on her consent, as above.

Who can see it. Membber, and whoever holds the private link. The link is her shop name followed by a random code, search engines cannot see the page, and it is never listed anywhere. Preview photos are kept in private storage and shown only through links that expire within an hour. Supabase stores the record and the photos for us (Section 6).

What we note when it is opened. Once the preview has loaded on screen, the page tells us it was opened, so we know the link reached her. We keep the time of the first and the latest open and a count of opens, against the preview only. We also note which parts of the preview she opens (the menu, an item, the drop, More info and Be the first to know), once per visit, to learn what is useful to makers, never with a cookie or tracker, and this is deleted with the preview. Nothing about her device is kept with it, and the page runs no third-party analytics, screen recording or advertising.

How long we keep it. What our browser tool sends us is deleted within 24 hours unless we make it into a preview. An unclaimed preview and its photos are deleted automatically 30 days after it was made, with the email or phone number she gave us if she tapped "Create Free Account". If she taps "Finish setup", she gives us her name and email so we can email her a sign-in code and make her account; the code, and the email she typed with it, are deleted within two hours, even if she does not finish. If she makes it hers, her shop is created by the normal Drops sign-up under her own account, the photos she chooses to keep are copied into her own shop, her brand colour and the words she published about her shop are added to it where she has not set her own, the things on her preview's menu are offered to her there as suggestions that become part of her menu only when she adds each one, and she agrees to a short licence for them, which we record with the date and the version of its wording. So that we know the shop is really hers, we ask her to send us a short code from the Instagram account the preview was made for, or to log in to that account through "Set up from your Instagram" (section 3a); we record only that it was confirmed, how and when. From then on the rest of this policy applies to her as a Merchant.

Saying no. Tapping "Delete this preview", under "Privacy and removal" on the preview, deletes it and its photos straight away, with no login, and we will not contact her again. Replying "stop" to our message, or emailing privacy@membber.com, does the same. To keep that promise we keep her Instagram handle on a do-not-contact list, with how she said no and the date, and nothing else, for as long as we need it to avoid contacting her again. She can object at any time, and an objection is always honoured.

Never used in our marketing. We never use a maker's name, logo or photos in Membber's own marketing (our website, adverts or social posts) without her separate written permission.

Records that outlive a preview. Our audit log and our count of how previews are doing keep only the preview's random identifier, the kind of event, a few fixed labels (for example how we first made contact, whether the preview had photos, and the reason she chose if she tapped one) and the time. They never hold her handle, her shop name, the link or a photo, so once a preview is deleted nothing in them identifies her.

When you, or an AI assistant such as ChatGPT acting for you, search Membber for something local, we keep an anonymous record of that search: the kind of thing wanted (as one of our own labels), the area (a postcode district and town), when it was made and roughly when the thing was wanted, any filters used (such as a diet, an allergen to avoid or a budget band), which assistant or app it came through, how many results it found and which shops came up. It never holds your words, your name, your exact location or your IP address, so we cannot tell who made it. We use these records to see what people look for that is not on Membber yet. We keep each record for 90 days, then only daily totals. If an assistant shares your rough location with us, we use it for that one search and do not keep it. The words of a search can also pass through the request logs of our hosting provider, Vercel, which keeps them for a limited time, and a place you name is looked up with postcodes.io, a free UK postcode service.

When a shop's owner or a member of its staff connects an AI app, such as ChatGPT or Claude, to the shop through Membber Business, they sign in with their own Membber login. Nothing goes to the AI app unless someone at the shop connects it and asks it something. Then it receives what the answer needs from that one shop, and only what that person's role allows: the shop's drops, menu and orders, and its customers' names, email addresses and mobile numbers. The AI company handles what it receives under its own privacy policy. The shop can disconnect it at any time on the Your shop tab, and access stops on the next request. We keep a record of each connection (the app, the shop, who connected it and when) and, for 30 days, a record of each change the app made after the person said yes.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected.

Merchant Data: We retain Merchant data for as long as you have an active account with us and for a reasonable period thereafter to comply with legal and accounting obligations.

Photos a Merchant uploaded and never used: A photo you upload for your shop, a drop or an item and then do not use (you chose another, or the save did not finish) may be deleted by our weekly clean-up once it has gone unused for at least 7 days. A photo that is on your shop, a drop or an item is never deleted by it.

End-Customer Data: We retain your stamp and voucher data for as long as you are an active participant in a loyalty program. If a Merchant cancels their subscription, the associated End-Customer data will be scheduled for deletion. You can also request the deletion of your data at any time (see Section 8).

Account Deletion: When you delete your account, your login access and active sessions are revoked immediately. Your sign-in credentials, session tokens, push tokens, and wallet passes are permanently deleted. Your loyalty activity (stamps, vouchers, conversations, bookings) is anonymised and reassigned to a generic "Deleted Customer" record so that Merchant records remain accurate. Your personal information (name, phone number, email, and sign-in identifiers) is removed from your live account record and held in a secure, access-restricted archive for administrative review. An administrator periodically reviews and permanently purges this archived personal data; this process is completed within 90 days of account deletion. We also retain a cryptographic hash of your phone number, email, Apple ID, and Google ID in a deletion audit log for up to 6 years. This is necessary for fraud prevention and to comply with legal obligations under UK GDPR Article 17(3)(e) (establishment, exercise, or defence of legal claims). The hashed identifiers cannot be used to re-identify you.

Drops Previews: An unclaimed preview and its photos are deleted 30 days after it was made, or at once when she taps "Delete this preview". A handle on the do-not-contact list is kept, with how she said no and the date, for as long as it is needed to honour her objection. See Section 6b.

"Tell me when it's back": an ask not back within 60 days is deleted at our next check, within minutes; every other ask 30 days after it ends; an email address given only for these asks within about an hour once nothing of it is left at that shop, except one that asked to stop, which is kept with its stop until you ask us to delete it. See Section 6a.

Meal Diaries and Member Profiles: A meal is retained until you delete it, switch the feature off, or close your account. A member profile is retained while you are a member of that gym and is deleted with your account.

Setting up from Instagram (Drops sellers): The list of your Instagram posts we read for an import is deleted when you finish it; otherwise it expires after 24 hours and our daily clean-up deletes it, within two days at the latest. Instagram's access is never stored. The note of what came from Instagram, with the two ID numbers Instagram gives our app for you, is kept while that photo, logo or bio is on your shop, or until you remove Membber in Instagram or ask us to delete it (Section 3a).

Search records: An anonymous record of a search on Membber, including one made through an AI assistant, is kept for 90 days, then only daily totals. See Section 6c.

Connected AI apps: A record of each AI app connected to a shop is kept with the shop's account. A record of each change it made is kept for 30 days. See Section 6d.

Content Moderation Records: Reports of objectionable content submitted through our messaging system are retained for up to 2 years for safety and compliance purposes.

Inactive Accounts: If you have not participated in any loyalty program for 24 months, we may delete your account and associated data.

Under UK and EU data protection law, you have the following rights regarding your personal data:

• The right to be informed: To know how we use your data (which is the purpose of this policy). • The right of access: To request a copy of the personal data we hold about you.

• The right to rectification: To request that we correct any inaccurate or incomplete data.

• The right to erasure (the "right to be forgotten"): To request that we delete your data.

• The right to restrict processing: To request that we limit the way we use your data.

• The right to data portability: To request your data in a machine-readable format.

• The right to object: To object to our processing of your data for certain purposes.

How to Exercise Your Rights:

To exercise any of these rights, please contact us at privacy@membber.com. You can also use the account deletion flow available from in-app settings or at https://www.membber.com/account-deletion. We will respond to your request within one month.

Deleting Your Data:

If you wish to delete all your loyalty data and stop participating in all programs, you can request this from in-app settings ("Delete Account") or at https://www.membber.com/account-deletion. You may also email privacy@membber.com with the subject "Data Deletion Request" and include your phone number. We will process your request within 30 days.

Instagram (Drops sellers): To stop us using your Instagram and have the photos and details you brought in from it deleted, remove Membber in Instagram under Settings, then Apps and websites, ask for deletion from that same Instagram screen, or email privacy@membber.com. Removing Membber in Instagram also removes those photos from your shop. See Section 3a.

Note: Deleting your data will remove your stamps, vouchers, and participation history across all Merchants. This action cannot be undone.

Some of our third-party processors (such as Stripe, Supabase, and Vercel) may be based outside the UK. When we transfer your data internationally, we ensure it is protected through legally-recognised mechanisms such as the UK's adequacy decisions or Standard Contractual Clauses (SCCs), which guarantee a similar level of data protection to that in the UK.

We take the security of your data very seriously. We implement robust technical and organisational measures to protect it, including:

• Row-Level Security (RLS) in our database to ensure Merchants can only access their own data • Encrypted communications via HTTPS • Secure Webhook Verification to ensure stamp requests are authentic • JWT-based authentication for secure access to Membber Business and related merchant APIs • Use of proven, secure cloud infrastructure • Regular security reviews and updates

The Membber platform is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child, we will take steps to delete it as soon as possible.

Our website stores a few small items in your browser. Our Cookie Policy (www.membber.com/cookie-policy) names every one of them. In short:

• Strictly necessary, always on: keeping you signed in, your basket and checkout (including Stripe's fraud-prevention cookies on payment pages), your language if you choose one, and your answer to our cookie question. These need no consent.

• Always on, storing nothing that identifies you: our own visit counter records which page was viewed, how far it was scrolled, which buttons and links were tapped (their label, never anything you type), how long the page was open, the kind of device and browser, and where the visit came from, such as the campaign tags on a link or the site that linked to us. Before you answer our cookie question, or after you say no, it keeps nothing on your device, so each page load is counted on its own. Web addresses are stored without any private part, such as an order code or a sign-in token, our order, payment and sign-in link pages are never recorded, and we do not store your IP address with these records. Detailed records are kept for 30 days, then only daily totals. We rely on our legitimate interest in understanding which pages work. Vercel Speed Insights measures page speed, Vercel Web Analytics counts visits without storing anything on your device, and Sentry receives error reports, as described in Section 6.

• Only if you say yes: a visitor ID kept in your browser, so a return visit can be told apart from a new one, and PostHog heatmaps and screen recordings of our public pages, as described in Section 6. We rely on your consent, and you can withdraw it at any time with "Cookie settings" at the foot of our pages or on the Cookie Policy page. Saying no deletes the visitor ID and everything PostHog stored in your browser.

We do not use advertising cookies and we do not use Google Analytics. You can also clear or block site data in your browser settings.

Important Note for End-Customers:

When you participate in a Merchant's loyalty program, the Merchant may have their own privacy policy and data practices. We encourage you to review each Merchant's privacy policy.

Membber acts as a "data processor" on behalf of Merchants for End-Customer loyalty data. Each Merchant is a "data controller" for their own customers' data collected through their loyalty program.

If you have concerns about how a specific Merchant handles your data through their loyalty program, you should contact that Merchant directly.

We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any significant changes by posting the new policy on this page and updating the "Last Updated" date.

If you have any questions, concerns, or requests regarding this Privacy Policy or your data, please do not hesitate to contact us.

Email: hello@membber.com Data Protection Contact: privacy@membber.com Legal Entity: Membber Ltd Address: 12 Trindles Road, South Nutfield, Redhill, England, RH1 4JN

Data Subject Access Requests (DSARs): To submit a DSAR, please email privacy@membber.com with the subject "Data Subject Access Request". We will acknowledge your request within 5 working days and provide a full response within 30 days (or notify you of any extension as permitted by law).

Supervisory Authority: You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your local EU supervisory authority if you are an EEA resident.