Privacy notice

1. Who we are and our role

This notice explains how Heaven’s Edge handles personal information. It is effective October 6, 2026. Heaven’s Edge acts as the controller for account, billing and platform records, and processes customer reward records on behalf of each participating business, which decides how its own program uses them. Questions can be sent to the support email on our Contact page; never send private pass codes, passwords or payment secrets.

2. Accounts and business records

We process account identifiers and email, names and contact details you provide, business and location details, staff assignments, program settings and merchant terms. Public business pages show business content only, never customer balances. Do not put unrelated personal information into descriptions or uploads.

3. Customer and reward records

Customer enrollment and private identity are associated with the business joined. Records may include qualifying paid amounts, purchase/receipt references, stamp and points events, per-program balances, catalog choices, reward terms/location snapshots, referrals, redemptions, correction reasons and refund reversals. Test/live environments remain distinct. Private pass tokens/codes are not public marketing content.

If you send a missed receipt, we store the photo privately along with the receipt number, purchase date, location, amounts and any note you add. Only you and the business’s owners and managers can view it; staff at the counter cannot. If you use auto-fill, the photo is processed by Lovable AI only to suggest those fields, which you check before sending. The business decides whether to approve it.

4. Partner and financial records

Optional cash partner programs keep membership/application details, attributed claims, eligible amounts, commission approval, payment dates/references and return/recovery history. Platform subscription records are separate from merchant customer purchases and external partner payments. The platform does not need full payment-card details in reward descriptions or email support requests.

5. Why we use information

We use records to provide account access, program participation, purchase confirmation, reward fulfillment, authorized reporting and exports, dispute handling, security and fraud prevention. We rely on performance of our contract with you, our legitimate interest in running a safe service, legal obligations and, for marketing, your consent. Enrolling in a reward program is not permission for unrelated uses.

6. Marketing choice and service emails

Marketing consent is a separate, optional, unchecked choice and never a condition of joining a program. We send service emails about your account, rewards, redemptions, purchases and payouts to the verified recipient of that event; they never include private pass codes. You can manage email preferences in your account. No SMS program is offered.

7. Who can access records

Customers view their own private progress. Assigned checkout staff uses location-checked operations; authorized owners and finance/team members have role-appropriate access. Partners are scoped to their own membership/earnings. Receipt images are stored privately and accessed through authorized functions. These controls are safeguards, not a promise that incidents cannot happen.

8. Service providers and requests

Lovable Cloud provides data, sign-in and storage; Stripe processes subscription payments; Lovable Emails delivers service emails; Lovable AI processes the information you submit in an AI request. Google Fonts and our hosting provider receive ordinary request data. These providers act under their own terms and data-protection commitments. Do not submit payment secrets or unnecessary personal data to AI.

9. Cookies and local storage

Browser storage keeps you signed in and remembers your selected workspace, location, program, unsaved setup drafts, referral context and pending actions so they can safely retry. A referral redirect cookie lasts up to one year. See the Cookies page for details.

10. Retention, requests and deletion

Contact the merchant or platform as appropriate for access, correction, export or deletion requests. Identity and scope checks are required. Authorized owners can export customer records; this is not a customer self-service deletion portal. Audit/financial duties, disputes and others’ rights may limit deletion. No final universal retention period or immediate irreversible deletion promise is stated; the operator must approve a schedule.

11. Your rights and changes

Depending on where you live, you may have rights to access, correct, export, restrict, object to or delete your information, and to complain to your local data-protection authority. Contact us or the business that runs your program to exercise them. The service is not directed to children under 13 and we do not knowingly collect their information. We will post any changes to this notice here with a new effective date.