Privacy Policy

• Account data: your email address, your name and your password. The password is stored only as a hash by our authentication provider. If you sign in with Apple or Google, we receive the name, email address and profile picture that the provider shares.
• If you use Ficus as a customer: the scans you make at a business (which business, when and whether the scan was accepted), your loyalty progress, visit count, first and last visit for each business, and the offers you unlock and redeem.
• If you use Ficus as a business: business name, logo, brand colour and shop addresses; team members (name, invited email address and role); the leaves, offers and campaigns you create.
• Push notification token, only if you allow notifications.

The camera is used only to read QR codes. The image is processed on your device and is never stored or sent to us.

If you turn on “Near you”, the app uses your location only on your device to sort nearby places by distance. Your location is never sent to us or stored. Businesses can choose to publish their address, which is shown to Ficus users with their active Leaves.

When you scan at a business, the members of that business can see your name, your visits, your loyalty progress and the offers related to that business. They cannot see your activity at other businesses. Businesses use this information under their own responsibility.

To send you a demo login we ask for an email address. We store only a one-way hash of it, used to limit each address to 3 demos, and send the login by email. We also record your IP address to prevent abuse. Demo accounts and their data are deleted automatically when the demo ends (after 2 hours), and IP addresses are removed from our records within 7 days.

The website only uses the cookies needed to keep you signed in. Ficus uses no analytics, no advertising and no tracking of any kind, in the app or on the website.

• to provide the service you asked for: your account, scans, rewards and the business dashboard (performance of a contract)
• to protect the service and the demo from abuse (legitimate interest)
• to send push notifications, only if you allow them (consent, which you can withdraw in iOS Settings)

• Supabase: database, authentication and file storage, hosted in the European Union
• Vercel: hosting of the website
• Google: Google sign-in and the email service used to send demo logins
• Apple: Sign in with Apple and push notifications

Some of these providers may process data outside the European Union. In that case the transfer is covered by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Account data and activity are kept until your account is deleted. Demo data is kept as described in Website demo.

You can ask to access, correct, delete or export your data, to restrict or object to its use, and withdraw your consent at any time.

To delete your account and all its data, write to support@astrall.app from the email address of the account: we delete it within 30 days.

You can also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, garanteprivacy.it).

Ficus is not meant for children under 14 and we do not knowingly collect their data.

If we change this policy we will update the date at the top of this page and, for important changes, tell you in the app or on the website.