Privacy Policy

This Privacy Policy explains how Dagga Inc. ("we", "us") collects, uses, and protects personal information when you use Comeback.

What we collect

From merchants (your account):

• Account info: your name, email, business name, and dashboard password (hashed).
• Store info: your Shopify domain, branding assets, and program rules.
• Billing info: handled by our payment processor. We don't store card numbers.
• Usage logs: which pages you load, which actions you take. Used to operate and improve the product.

From your customers (when they join your program):

• Name and contact info you collect at sign-up (email or phone).
• Wallet pass identifiers needed to send updates to their pass.
• Purchase activity passed to us by your point-of-sale (totals, dates, line items).
• Reward and points balances tied to their loyalty profile.

How we use it

• To run the loyalty program you've configured: issue passes, calculate rewards, send the offers you create.
• To show you analytics about your customer base inside your dashboard.
• To send essential transactional notices (billing, security, service status).
• To improve product quality and detect abuse.

What we don't do

• We don't sell customer data to anyone, ever.
• We don't use your customer data to train AI models.
• We don't share your customer data with other merchants on the platform.
• We don't run ads against your customers.

Where data lives

Your data is stored in a managed Postgres database operated by Supabase, hosted in a Canadian region. Wallet pass artifacts are signed and delivered via Apple and Google's official wallet services. Backups and access logs are retained for 30 days for operational continuity.

Sub-processors

We use a short list of vendors to operate the Service:

• Supabase (database + storage)
• Vercel (hosting)
• Apple Push Notification Service (wallet pass updates)
• Stripe (payment processing)
• Shopify (the merchant's commerce platform, when applicable)

Your rights

You and your customers can request access to, correction of, or deletion of personal data. Email privacy@tap2comeback.com and we'll respond within 30 days.

Retention

We keep merchant account data while your subscription is active and for 30 days after cancellation, after which we delete it from production. Anonymized aggregates may be retained for product analytics.

Children

Comeback is a B2B tool for merchants. It is not directed at children under 13, and we don't knowingly collect their data.

Contact

Email privacy@tap2comeback.com with any privacy question.