מדיניות פרטיות — ניקובים (Nikuvim)

Who we are

Nikuvim ("ניקובים") is a digital punch-card loyalty app and website (nikuvim.co.il) for cafés and local businesses in Israel, operated by Itay Talev ("we"). Privacy questions: support@nikuvim.co.il.

This policy is written in accordance with the Israeli Protection of Privacy Law, 5741-1981, as amended.

What we collect

Customers (card holders)

• Name — the name you enter at registration.
• Contact details — an email address and/or a phone number. At least one contact is required to register; you can add the other later.
• Verification codes — to verify your identity and sign you in, we send a one-time code to your email (and, in future, by SMS). Registration and login use a code only — no password. Phone numbers are currently collected without verification.
• Punch-card activity — punches (stamps), card completions, and reward redemptions, with timestamps and the café involved.

Business owners

• Account details — email address and password (stored hashed/encrypted).
• Business details — café name, address, contact details, and punch-card settings.

Technical & analytics data

• Basic usage events (e.g., punch performed, card completed, reward redeemed) used to operate and improve the service.
• Data is also stored locally on your device so the app works offline.

Camera

The app uses your camera solely to scan the café's QR code to punch your card. No photos are captured, stored, or transmitted. You may decline camera permission and enter the code manually.

How we use data

• Verifying your identity and signing you in via one-time codes, and helping you recover access to your account.
• Operating the loyalty service — tracking punches, card completions, and reward redemptions.
• Showing card activity to the café that issued the card (name and punch status only).
• Improving the service through aggregate usage data.

We do not sell your data and do not share it with third parties for marketing.

Registering does not by itself constitute consent to marketing. We will not send promotional messages without separate, explicit consent, as required by law.

Where data is stored and who sees it

• Supabase — our database and authentication infrastructure (secure cloud hosting, TLS-encrypted transport).
• Vercel — hosting for nikuvim.co.il.
• Partner cafés — each café sees activity for its own punch cards only.

These providers process data only on our behalf under security commitments. Data may be stored on servers outside Israel.

Retention and deletion

We keep data while the account or card is active, or as required by law. You may request access to, correction of, or deletion of your data at any time by emailing support@nikuvim.co.il. We will handle requests within a reasonable time and as required by law.

Security

We apply standard safeguards — encrypted transport, access controls, and limited permissions. No system is completely secure, and absolute security cannot be guaranteed.

Children

The service is not directed at children under 13 and we do not knowingly collect their personal data. If you believe a child has provided us personal data, contact us and we will delete it.

Changes

We may update this policy from time to time. Material changes will be posted on this page with an updated "Last updated" date.