Privacy Policy

CharterPass is operated by SWEET VENTURE. CharterPass 由 SWEET VENTURE 營運。

CharterPass ("CharterPass", "we", "us") provides a digital membership platform for Hong Kong organizations and merchants. This policy explains what personal data we collect, how we use it, and the rights you have under the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486). This policy is a notice about our data practices; optional consent choices are collected separately.

Shared accounts and merchant membership

CharterPass, merchant membership pages and CharterPass POS use one shared CharterPass account. You may sign in with email verification, an optional CharterPass password, or Google where available. Changing your CharterPass password affects that shared account across connected shops; it does not change your Google password. Signing in does not automatically enrol you in every merchant or organization.

When you choose to join a merchant or organization, we collect your membership answers and consent choices. Required fields are identified on the form; without them we may be unable to process your membership. Optional information and marketing consent are not required to use the basic membership service. Each merchant manages its own membership, purchase records, points and rewards. A merchant is not given access to your memberships or purchase history at other merchants merely because you share a CharterPass account.

Google sign-in data

If you choose Google sign-in, Google provides basic account information such as your Google account identifier, email address, verification status, name and profile image where available. We use this information to authenticate you, create or link your CharterPass account, and display your profile. We store account and identity information in our authentication and database services. Relevant profile and contact details may be shared with a merchant or organization you choose to join, as needed to operate that membership. Google sign-in does not grant us access to your Gmail messages, Google Drive files or Google password.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data or use it for targeted advertising. You may revoke CharterPass access through your Google account settings; revocation alone does not delete existing CharterPass membership records. Contact us to request account deletion.

Transactions and service providers

Where you use CharterPass POS or claim a receipt, we process order details, merchant and branch identifiers, receipt references, loyalty adjustments and refund records needed to attribute your purchases and administer rewards. Relevant service providers include Supabase for authentication and database storage, Vercel for hosting, Resend for transactional email, and Twilio where SMS verification is enabled. Wallet services process information when you choose to add a pass. These providers process the information needed for their functions, which may occur outside Hong Kong.

Service messages and optional marketing

We send verification codes, account security messages and necessary membership or transaction updates to operate the service. Promotional messages are separate: where consent is required, we seek it before using your contact details for offers, rewards campaigns or event promotions from the merchant or organization identified when you opt in. You may withdraw marketing consent without charge through the message's unsubscribe option or by contacting support. Withdrawing marketing consent does not prevent necessary security and service messages.

Who is responsible for your data

CharterPass is the data operator for the platform itself. When you join an organization or interact with a merchant, that organization or merchant is a separate data user responsible for how they use your data within their own membership or loyalty programme. We act on their instructions for that data and apply the safeguards described here.

What we collect

• Account details — your name, email address and, if you provide it, a phone number and preferred language.
• Membership information — the organizations you belong to, your membership tier, role and status, and (where a paid tier applies) payment proof you submit for a committee to review.
• Activity data — event registrations and check-ins, stamp cards, points, rewards and perks you collect or redeem, and the timestamps of those actions.
• Passes — the digital pass and personal QR code we issue you, and, if you add it, the Apple Wallet or Google Wallet pass derived from it.
• Device data — if you enable notifications, a push token for your device; plus basic technical data (browser type, IP address) needed to run and secure the service.

We do not collect financial card numbers. Membership fees are handled by your organization; where online payment is offered, it is processed by a third-party payment provider and we do not store your card details.

How we use your data

• To create and operate your account and digital pass.
• To let organizations you join verify your membership, check you into events, and keep their roster accurate.
• To let merchants you interact with award and redeem stamps, points, rewards and member offers.
• To send you service messages, and — where you have consented when required — announcements and reminders from organizations you belong to.
• To keep the platform secure and to meet legal obligations.

Who your data is shared with

We share your data only as needed to provide the service: with the organizations you are a member of, and with a merchant at the moment you present your pass to them (so they can identify you and apply the right stamp, point or offer). We use trusted infrastructure providers — including Supabase for database and authentication hosting, and Apple and Google for wallet passes — who process data on our behalf under confidentiality obligations. We do not sell your personal data to anyone.

Where your data is stored

Your data is stored on managed cloud infrastructure and may be processed on servers located outside Hong Kong. Wherever it is processed, we require appropriate safeguards to protect it.

How long we keep it

We keep your data for as long as your account is active and as needed to provide the service, then for a reasonable period afterwards to meet legal, accounting and dispute-resolution needs. You can ask us to delete your account, after which we remove or anonymise your personal data except where we are required to retain it.

Your rights

Under the Personal Data (Privacy) Ordinance you may request access to, and correction of, the personal data we hold about you, and you may object to direct marketing at any time. To exercise any of these rights, email us at support@charterpass.app. We will respond within the timeframe required by law.

Cookies

We use only the cookies needed to sign you in, remember your language, and keep the service secure. We do not use third-party advertising cookies.

Children

CharterPass may be used by students through their school or student union. Where a member is under 18, we expect the organization to have appropriate consent in place. If you believe we hold a child's data without proper consent, contact us and we will address it.

Changes to this policy

We may update this policy as the service evolves. We will change the "last updated" date above and, for significant changes, notify you in the app.

Contact

Questions about your privacy? Email support@charterpass.app or visit our support page.