Privacy Policy

Effective date: August 9, 2026

1. Who we are

This Privacy Policy describes how Aestryd LLC("we," "us," or "our") collects, uses, and shares information when you use Main Street — our local-business loyalty service available on the web and via iOS and Android apps (collectively, the "Services").

Contact: contact@aestryd.com

We operate and may process personal information in connection with Services offered in multiple countries, including the United States and GCC member states (United Arab Emirates, Kingdom of Saudi Arabia, State of Qatar, State of Kuwait, Kingdom of Bahrain, and Sultanate of Oman), and other jurisdictions where Main Street is available. We are committed to handling personal information in accordance with this Policy and with applicable privacy and data-protection laws in those places. This Policy describes our practices; it is not a third-party certification or seal. If a mandatory local privacy law grants you rights that this Policy does not list, we will honor those rights to the extent they apply to us.

2. Information we collect

We collect information you provide and data needed to run the Services:

Account information: For customers — mobile number (via our identity provider), name, and optional email. For merchants — work email, password, contact phone, and business name.
Shop & program data: Merchant category, address or location descriptors, reward settings (including L1 / L2 / L3 referral credit percentages and walk-in desk QR / Welcome QR (LQr) incentives), desk QR / join links, and related configuration. Merchants set these program rates at their discretion as described in our Terms of Use.
Rewards & activity: Visits, checkout sessions, credits, coupons, spins, referral relationships, redemptions, and ledger history associated with your account.
Device & usage: Basic technical data such as device type, app or browser environment, approximate network address (IP) when available, and interaction logs (for example app opens, page time, and shop-card taps) used for security, fraud review, debugging, and product reliability.
Location (when you opt in): If you choose Use my location, we collect precise GPS coordinates to set your area and show nearby shops. If you also enable Nearby shop alerts, we use background (Always) location and shop geofences so we can notify you when you are near a participating shop with offers or credit. We do not track your trips, build movement histories for advertising, or sell your location. You can turn nearby alerts off in Settings.
Camera (when you use scan): Camera access is used only to scan QR codes (for example, desk QR, checkout QR, or a merchant scanning a customer reward barcode). We do not use the camera for continuous recording or biometric identification.
Support: Messages and tickets you send to Main Street ops or support.

Card payments for purchases are taken on the merchant's own terminal or payment methods outside Main Street. We do not process full card primary account numbers for those tenders through the Services.

3. How we use information

Create and secure accounts (customers and merchants).
Operate wallets, rewards, referrals, spins, and checkout handoffs.
Show merchants the customer and redemption information needed to honor offers at their shop.
Prevent fraud, abuse, and security incidents — including by reviewing account, referral-tree, checkout, and reward activity — and suspend or limit accounts under our Terms of Use when we suspect misuse, including without prior notice where permitted by law.
Provide support and improve product reliability.
Comply with law and enforce our Terms of Use.

Where privacy laws require a lawful basis, we rely on bases that fit the activity — for example performing a contract with you, your consent (where we ask for it), legitimate interests in running a secure loyalty platform, or legal obligations — as applicable.

4. Sharing

We do not sell your personal information. We share information only as needed to operate the Services:

Service providers: Identity and authentication (Clerk), application database and backend (Convex), hosting and delivery of the web/app, and messaging providers used to send one-time codes or transactional email/SMS.
Merchants you engage with: When you join a shop, redeem, or check out, the merchant and authorized staff see information required to identify you for that visit and honor or settle rewards.
Legal & safety: If required by law, or to investigate fraud, misuse, or threats to rights and safety.
Business transfers: If Aestryd is involved in a merger, acquisition, or asset sale, information may transfer as part of that transaction subject to appropriate protections.

5. International processing

Our providers and infrastructure may process data in the United States and other countries. If you use Main Street from the United States, a GCC member state (United Arab Emirates, Kingdom of Saudi Arabia, State of Qatar, State of Kuwait, Kingdom of Bahrain, or Sultanate of Oman), or another country where we offer the Services, your information may be transferred to and processed outside your country. We use providers that offer contractual and technical safeguards appropriate to their role, and we are committed to meeting applicable local requirements for cross-border processing to the extent they apply to us.

6. Retention

We keep account and loyalty records for as long as your account is active and as needed to provide history, settle disputes, detect fraud, and meet legal or accounting requirements. When you delete your account in the app, we mark the account deleted and remove or de-identify personal fields according to our deletion process. We aim to complete that deletion or irreversible anonymization within thirty (30) days; residual copies may persist for a limited time in backups or where retention is required by law.

7. Your choices and rights

Depending on where you live — including in GCC countries and other markets where we offer the Services — you may have rights to access, correct, delete, or restrict certain processing, or to withdraw consent where processing is consent-based. You can:

Update profile details in the app where available.
Delete your account from in-app Settings (customer or merchant).
Email contact@aestryd.com for privacy requests.

8. Children

The Services are not directed to children under 13 (or the higher digital-consent age in your jurisdiction). We do not knowingly create accounts for children. If you believe a child has provided personal information, contact us and we will take appropriate steps.

9. Security

We use industry-standard measures appropriate to a cloud loyalty product (encryption in transit, access controls, authenticated sessions). No method of transmission or storage is perfectly secure.

10. Changes

We may update this Policy from time to time. We will post the updated version with a revised effective date. Material changes may also be communicated in the app or by email when appropriate.