Last updated: October 2026
SocialPerks ("we", "us") operates the SocialPerks web app and iOS/Android app (together, the "Service"). This page explains what data we collect, why, on what legal basis, and what rights you have over it. It describes the Service as it actually works today.
SocialPerks is being incorporated as a Sociedad Limitada in Barcelona, Spain. Full registration details (legal name, registration number, registered address) will be published here once incorporation is complete. For any privacy question, or to exercise any right below, contact us at socialperks.team@gmail.com.
Account: your email address, your name, and whether you signed up as a venue or as a guest. Your password is handled by our authentication provider and we never see or store it in plain text. Venue profile: the venue's name, category, neighbourhood, opening hours and services, the rewards it is willing to give and the limits it sets, and the figures it enters about a typical service. Perks and visits: the Perks a venue runs, the claims guests make on them, the display name a guest types when claiming, the six-digit code used at the counter, and the timestamp of a visit recorded there. If a guest says they shared a Story, we record that declaration and its time; this is self-reported, not verification of an Instagram post, and this flow does not ask for a Story screenshot. Legacy campaigns and crews: campaign details and photos uploaded by venues, crew bookings and membership, check-ins, proof photos and notes submitted by organisers, and the venue's review decision. Uploaded files are stored in Supabase Storage. Campaign photos are public; crew proof photos are private and accessible to authorised crew participants and the venue reviewing the visit. Demo requests: if you fill in the form on the homepage, the business and contact name, email or phone, kind of business, neighbourhood and any note you write.
When a guest declares they shared a Perk, we mint a short link. If somebody opens it, we record the link, the venue, the time, and a fingerprint computed from the link together with the visitor's IP address. The tap record does not contain the raw IP address. Where a server secret is configured, the fingerprint uses a keyed hash; otherwise it uses a plain hash. These fingerprints are pseudonymous personal data, not irreversibly anonymous data: a hash can be compared with candidate IP addresses, particularly without the secret. Including the link in the hash reduces linkability between different links, but does not guarantee anonymity. We use the fingerprint to deduplicate openings of each link. People on the same network may count as one, and an opening can come from somewhere other than a Story; the count does not verify a post or identify a distinct person or device. We do not read a guest's Instagram account, posts or followers to verify a Story. A link sent from the guest's page also carries the app it was sent through (Instagram, WhatsApp, Telegram, Messages or the phone's share sheet), so the venue can see which channel a visit came from; we never receive the friend's number or contacts. The guest can see how many people opened their own link, how many took the gift through it and how many came in, as counts only, never who.
Six, and none is for advertising. A session cookie set by our authentication provider, which keeps you signed in. "sp_lang": the language you chose (English, Spanish, Catalan, Italian, French, Portuguese or German), kept for a year when you pick it from the language menu, and for two hours when it came from a link. "sp_app", only while a page you opened from the SocialPerks app is open, so it shows without the website's menu. "sp_demo", while you try the demo (four hours). "sp_start", your set-up answers while you confirm your email (one day). And "sp_lead", which Lead's link you opened first, so that the venue you create is credited to the person who introduced it (90 days). None is linked to an advertising profile or shared with anyone. We run no advertising cookies, no third-party analytics and no cross-site trackers.
To perform our contract with you (GDPR Article 6(1)(b)): creating and running your account, running a venue's Perks, letting a guest claim one, letting a venue record the visit at its counter, and handling legacy crew bookings, uploaded proof and campaign photos, and visit reviews. On our legitimate interests (Article 6(1)(f)): counting link taps as described in section 3, which helps report activity through each link and uses pseudonymisation to reduce linkability, while remaining subject to data-protection rights; and keeping the Service secure and working. On your consent (Article 6(1)(a)): contacting you about a demo you requested, which you can withdraw at any time by replying or writing to us. Where a venue subscribes, processing its billing data is also contract performance.
We run no advertising trackers, no third-party analytics SDKs, and we do not sell or rent personal data to anyone. The current Story-declaration flow does not access your photo library or camera and does not collect a screenshot of the Story. In the legacy campaign and crew flows, you can choose to upload a campaign photo or a proof photo; the mobile app requests the system permission needed to select that image. We receive the image you select, not your entire photo library. We do not access guests' social-network accounts to verify their Stories. If a venue connects its own Instagram or WhatsApp business account, we process the business messages and posts needed to operate that integration.
Only processors who run the Service for us, each on our instructions and not for their own purposes: Supabase (database, authentication and file storage; EU-hosted where available), Vercel (application hosting and server logs), and Stripe for a venue's subscription or deposit payments, where Stripe acts as a controller for the payment data it collects directly. If a venue connects its own Instagram or WhatsApp business account, messages sent on its behalf pass through Meta under that venue's own relationship with Meta. Anthropic, which provides the AI model (Claude) that writes the wording of a venue's offers and messages and, when a venue switches its assistant on, its replies to guests: it receives only what each task needs, such as the venue's details and the messages involved, processes it on our instructions and does not use it to train its models. In the app, nothing is sent to it before the venue allows writing with AI. We do not sell or rent personal data to third parties.
Under the GDPR you can ask for access to your personal data, correction of it, deletion of it, restriction of or objection to our processing, and a portable copy. You can withdraw any consent at any time, and you can object to the legitimate-interest processing in section 3. A guest or a venue can delete their account from the account page, which removes the profile and the data attached to it. Write to socialperks.team@gmail.com and we will answer within one month. You also have the right to complain to a supervisory authority; in Spain that is the Agencia Española de Protección de Datos (aepd.es).
Your account and its data are kept while the account exists. If you delete it, the profile and the data attached to it are removed, except where we are required to keep records for legal or accounting reasons, which in Spain is generally six years for invoicing records. Uploaded campaign and crew proof files are stored with the related campaign and visit records. Tap records as described in section 3 are kept for as long as the venue has an account to provide historical link results; their fingerprints remain pseudonymous personal data. A demo request is kept until you ask us to delete it.
If we make material changes to this policy, we will update the date above and, where required, notify you directly.
SocialPerks