Privacy Policy
Last updated: 25 October 2026
This policy explains what personal data OnMe collects, why, who we share it with, and your rights. We collect only what we need to run your loyalty account, and we never sell your data.
1. Who we are
1.1 OnMe is run by OnMe Rewards Limited (company number 17540825), 112 Albany Road, Cardiff, United Kingdom, CF24 3RU. We are the data controller for the personal data described in this policy. That means we decide how and why it is used.
1.2 We are registered with the Information Commissioner's Office (ICO) under number TODO.
1.3 For any privacy question or request, email support@onmerewards.com.
2. What we collect
| Type | What it includes | Where it comes from |
|---|---|---|
| Account details | Name, email address, password (stored encrypted), and your Apple ID token if you sign in with Apple | You, or Apple |
| Optional profile details | Birthday, favourite venues, profile photo | You |
| Loyalty activity | Venues visited, date and time, purchase amount, points earned and redeemed, rewards used | Venues and the app |
| Device and usage data | Device type, operating system, app version, IP address, crash reports, which screens you use | Your device |
| Location | Approximate or precise location, only if you allow it, to show nearby venues | Your device |
| Notifications | Push notification token and your notification settings | Your device |
| Messages | Emails and support requests you send us | You |
We don't collect payment card details. Venues take payment through their own tills. We don't ask for special category data, such as health information. Please don't put allergy or health details in messages to us; tell the venue directly instead.
3. Why we use it and our legal basis
UK data protection law says we need a legal basis for each use of your data.
| What we do | Legal basis |
|---|---|
| Create and run your account, record points and let you redeem rewards | Contract: we need it to provide OnMe to you |
| Send service messages, such as points updates, security alerts and changes to our terms | Contract, and legitimate interests |
| Prevent fraud and misuse of points, and keep the Service secure | Legitimate interests: protecting OnMe, Venues and members |
| Show offers from Venues you have visited or that are nearby | Legitimate interests; location only with your consent |
| Send marketing emails and promotional push notifications | Consent, which you can withdraw at any time |
| Understand how the app is used and fix bugs, using aggregated data where possible | Legitimate interests: improving OnMe |
| Give Venues reports about their own customers' visits and points | Legitimate interests: running the programme for Venues |
| Meet legal obligations, handle complaints, and bring or defend legal claims | Legal obligation, and legitimate interests |
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that balance or object to it (section 8).
We don't make decisions about you that have legal or similarly significant effects based solely on automated processing. We may use automated checks to flag possible fraud, but a person reviews any action taken against your account.
4. Who we share it with
| Who | What they get | Why |
|---|---|---|
| Venues you visit | Your name, and your visits, points and rewards at that venue only | To award points, honour rewards and understand their customers |
| Service providers working for us | Whatever they need to provide their service | Hosting, databases, sign-in, email, push notifications and crash reporting: Supabase (hosting, database and sign-in) and Resend (email) |
| Apple | Sign-in data, if you sign in with Apple | To log you in |
| A new owner of OnMe | Your account and activity data | If OnMe moves to another company (see section 5) |
| Police, regulators and courts | Only what the law requires | To meet legal obligations or protect rights and safety |
4.1 Venues use the data they receive as separate data controllers. That means each Venue is responsible for how it uses that data under its own privacy notice. Venues are not allowed to use OnMe data to send you marketing unless you have separately agreed to it.
4.2 Our service providers act on our instructions under written contracts. They may not use your data for their own purposes.
4.3 We never sell your personal data.
5. If OnMe changes owner
OnMe may move to a new company set up to run it, or be sold. If that happens, your data will move to the new operator so your account and points keep working. We will tell you before it happens. The new operator must use your data in line with this policy unless it gives you notice of a new one.
6. Data stored outside the UK
Some of our service providers may store or access data outside the UK, for example in the EU or the US. When that happens, we make sure the transfer is protected by UK adequacy regulations or by the ICO's approved contract terms, such as the International Data Transfer Agreement or Addendum.
7. How long we keep it
| Data | How long |
|---|---|
| Account details and loyalty activity | While your account is open, then 2 years after it closes for fraud checks and disputes. After that we delete it or make it anonymous |
| Inactive accounts | Closed after 24 months with no activity. We'll warn you first where we can |
| Support emails and complaints | 2 years after the issue is resolved |
| Device, usage and crash data | Up to 12 months, unless we anonymise it sooner |
| Marketing opt-outs | Kept as long as needed so we don't contact you again |
We may keep data for longer if the law requires it or we need it for a legal claim.
8. Your rights
You have the right to:
- access your personal data and get a copy of it;
- correct data that is wrong or incomplete;
- delete your data. You can delete your account in the app at Account > Delete account;
- restrict how we use your data in some situations;
- object to uses based on legitimate interests, and to direct marketing at any time;
- move data you gave us to another service (data portability);
- withdraw consent at any time, where we rely on consent. This doesn't affect what we did before you withdrew it.
To use any of these rights, email support@onmerewards.com. We will reply within one month. Usually there is no charge. We may need to confirm your identity first.
9. Marketing and notifications
9.1 We only send marketing emails and promotional push notifications if you have agreed. You can switch them off in the app settings or with the unsubscribe link in any email.
9.2 Service messages, such as security alerts or changes to these terms, are not marketing. We send them even if you have opted out of marketing.
9.3 You can turn off push notifications and location access at any time in your phone's settings.
10. Keeping your data safe
We use appropriate technical and organisational measures to protect your data. These include encryption in transit, encrypted password storage, access controls and limiting who can see data. No system is completely secure. If a breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.
11. Children
OnMe is not for anyone under 16. We don't knowingly collect data from children under that age. If you think a child has given us their data, contact us and we will delete it.
12. Cookies on our website
Our website onmerewards.com uses only cookies that are strictly necessary for it to work, such as keeping you signed in. If we add analytics or advertising cookies, we will ask for your consent first and update this policy.
13. Changes to this policy
We may update this policy. If we make important changes, we will tell you in the app or by email before they take effect. The date at the top shows when it was last updated.
14. Complaints
If you're unhappy with how we've used your data, please contact us first at support@onmerewards.com so we can try to put it right. You also have the right to complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113.