Privacy Policy

JPINZ is the service described in this policy and the name you deal with. The legal operating entity behind it has not been incorporated yet, so this policy does not name a registered company, company number, registered office or VAT number.

Privacy and data-rights contact: privacy@jpinz.com. General support: support@jpinz.com. JPINZ has not appointed a Data Protection Officer, and neither address is one.

Pending legal review: The identity of the controller, the legal bases listed below and the international-transfer position all need confirmation with a solicitor and with each provider before JPINZ opens to the public.

There are two kinds of JPINZ account, and they hold different information.

Consumer accounts

• Your email address and password, held by our authentication provider. We never see or store your password.
• Your first and last name, and a profile picture if your sign-in provider supplies one.
• Your town, if you enter it.
• The categories you say you are interested in.
• A record that you confirmed you are 18 or over, and which Terms and Privacy Policy version you accepted, with the date.

Business accounts

• The same account basics as a Consumer account, plus your business name, category, business type and description.
• Your business address and its map coordinates, so customers can find you. This is published on your business page.
• Business contact details you enter: phone, contact email, website and social links.
• Your logo, cover image, Brand Kit files and any images you upload for Rewards, Promotions or Flash Offers.
• Your verification status and any note attached to it by JPINZ.

We do not ask for your date of birth. The 18+ requirement is recorded as a confirmation only.

You can sign in with an email address and password, or with Google. Apple sign-in is not offered at the moment, and nothing is sent to Apple.

When you use Google sign-in, we ask Google only for the basics: Google tells us your email address, your name and your profile picture so that we can create or find your account, and gives us an identifier for your Google account so we can recognise you next time. We do not receive your Google password, we do not ask for access to anything else in your Google account, and we do not send Google anything about how you use JPINZ.

The “JPINZ news & updates” switch in your settings controls optional marketing email only. You can turn it on or off whenever you like.

Authentication and security emails — confirming your address, signing in, resetting your password and security messages about your account — are necessary to run your account and are not marketing. They are sent over a separate essential email path, so they are unaffected by your marketing preference and by any pause on other JPINZ email. You cannot opt out of them while you have an account.

Our other emails — news and service announcements about JPINZ or your account — are sent through our managed email delivery service. If you use the unsubscribe link in a JPINZ email, that service can pause future JPINZ emails to your address, including service announcements. Emails to an address can also be paused after a delivery failure or if an email is reported as spam.

Because email is never guaranteed, important service information is also shown to you inside the app and, where you have enabled it, by push notification.

1. Your device's current location

If you allow it, your browser tells JPINZ roughly where you are so we can show what is nearby and sort results by distance. This is used at the moment you are looking, to draw the map and order the list. JPINZ does not build a location history from it, does not store a trail of where you have been, and never collects location in the background when the app is closed. You can refuse the request, or withdraw it in your browser settings, and JPINZ still works — it falls back to a general view of Ireland and you can search an area by name.

2. Your saved notification area

"Something new near me" notifications need a fixed point to compare against, so if you turn that on you choose a notification area. That single set of coordinates and its label are stored on your account, together with the radius you pick (from 500 m up to 20 km). It is used only to decide whether a new business, Flash Offer or Promotion is close enough to notify you about.

Searching another town on the map does not move your saved notification area. You can view it, change it or remove it at any time in your notification settings, and removing it stops nearby notifications.

• Businesses you like or save, so your saved list works across your devices.
• Rewards, Promotions and Flash Offers you save, including a copy of the title and image so your saved list still reads correctly if the original changes.
• Reward redemptions: a reference, the reward, the business, the time and the status. Both you and the business need this record — it is how a redemption can be checked and how frequency rules (for example once per calendar week) are enforced.
• Content you report to us, including your reason and any details you write.

In-app notifications are stored on your account so your notification bell works on any device. If you turn on push notifications, your browser creates a push subscription and we store it against your account so we can deliver the same notification to that device: the subscription address supplied by your browser's push service, the keys required to encrypt the message, and a short device label such as the browser name.

You can remove a device at any time in your settings. If a push service tells us a subscription is permanently gone, we delete it immediately rather than keeping it.

Notification content is generated by JPINZ, but delivery uses the push service that belongs to your browser or device — for example Google's for Chrome and Android, Apple's for Safari and iOS, Mozilla's for Firefox. Which one is used is decided by your browser, not by us. That service can see the subscription address, when a message was sent and how big it was, and the network information that comes with the delivery request.

JPINZ encrypts the notification title and body before sending them, so the push service cannot read them — only the browser or device the subscription belongs to can. Once it arrives, your own device decides how to display it: depending on your device and notification settings, the title and body may appear on your lock screen where other people could see them. Those settings belong to you and your device, not to JPINZ, so if that matters to you, change them on the device. JPINZ notification text names things like a business, a Reward, a Flash Offer or a Promotion, and never includes account credentials or payment information.

• Necessary service messages about your account, security and this policy are always sent.
• Optional JPINZ news by email is off unless you turn it on. It is never bundled with accepting the Terms, and it is never pre-ticked.
• Optional JPINZ announcements inside the app are separate from email, and can be turned off in your notification settings.
• When a campaign is sent, we record which account it was sent to, on which channel, and whether it succeeded, so nobody is sent the same thing twice.
• If your email provider or our sending provider suppresses your address (for example after a bounce or a complaint), that suppression takes precedence and we will not email you until it is cleared.

JPINZ is not open to the public yet. If you join the waitlist we hold your name, email address, location, category and interests, any website you give us, and your status. If you were invited to preview JPINZ, we hold the invite record and an activation record with the contact name, activation email and business name, so that a preview account can become a normal account without losing your work.

JPINZ measures how its own content performs so businesses can see whether their Rewards, Promotions and Flash Offers are working. This is first-party only: there are no advertising pixels, no behavioural advertising trackers and no third-party analytics services in JPINZ.

An analytics event records what was viewed, the business it belongs to, a rough distance band, a general area, and a random session reference that is regenerated for each browsing session. It is not tied to your account and is not used to build a profile of you. Businesses see totals and trends, never a list of who looked at their page.

Business accounts can generate reports from their own analytics. A report holds the period, the totals and a file name, and is available only to that business and to JPINZ administrators.

Business accounts can ask JPINZ to draft Reward, Promotion and Flash Offer copy, write a business description, suggest Reward ideas, and generate poster artwork. These features run on Google's Gemini models. Consumer accounts never use them.

What is sent for a text request: your business name, your category and profile tags, your business description, the Brand Kit guidance you have written (colours, styles, notes) and the offer or idea you typed. What is sent for artwork: the same kind of business context plus up to a handful of reference images you supplied — typically your logo, a Brand Kit photo of your business or your most recent promotion artwork. The model returns background artwork only; your logo and the factual wording are placed on top by JPINZ, not drawn by the model.

What we deliberately keep out

• Consumer personal data is not intentionally included in any JPINZ AI request. Consumer accounts, saved lists, redemptions and notifications are never used as AI input.
• Before a request is sent, JPINZ removes obvious contact details — email addresses and phone numbers — from the business text being sent, because they add nothing to the wording being generated. This only affects the copy sent to the model; your own saved profile and content are not changed.
• Before a reference image is sent, JPINZ strips metadata such as camera details, timestamps and any GPS coordinates from the copy used for the request. Your original uploaded file in JPINZ stays exactly as you uploaded it, and image quality is not reduced.

AI output is a suggestion. The business decides what to publish and is responsible for checking it. We record that a generation happened, which feature and model were used, whether it succeeded, and its size and cost, so that quotas and abuse limits can be enforced. That usage record is visible only to JPINZ administrators.

Pending legal review: The exact retention of AI prompts and outputs by the model provider, and where that processing takes place, must be confirmed against the provider's current documentation before launch. This policy does not claim either.

JPINZ uses three separate Google mapping services, and they behave differently.

1. The map itself (Google Maps)

Maps are drawn by the Google Maps JavaScript API. The map is only loaded on screens that actually show a map, and it is not loaded on the current pre-launch homepage. When a map loads, your browser requests the map code and map images directly from Google. That direct request carries normal network and browser information — your IP address, your browser and device type, the page that asked for the map — plus the map area and zoom being viewed. Those requests go from your browser to Google, not through JPINZ.

2. Searching for a place (Google Places)

When you type a town, address or place into a JPINZ search or location picker, what you type is sent directly from your browser to Google's Places service to produce the suggestions and the selected place's coordinates. The same applies when a Business types its address during setup, and when you choose your saved notification area. If you have allowed location access, your approximate coordinates may also be sent so suggestions near you come first. Do not type anything into a place search that you would not want Google to receive.

3. Turning coordinates into an area name (Google Geocoding)

To show a readable area or address label — “Salthill, Galway” rather than a pair of numbers — JPINZ sends the coordinates from its own servers, through our platform's connector, to Google's Geocoding service, and receives the address text back. Only the coordinates are sent. Your account, your name and your email address are not included in that request.

Across all three, JPINZ does not send your account, your name or your email address to Google for mapping, and we do not use Maps to track you between sessions. See the Cookie & Storage Notice for what Maps stores in your browser.

JPINZ is built on services from other companies. These are the ones confirmed from the way JPINZ is actually built, and what each one is used for:

• Lovable — the platform JPINZ is built, deployed and hosted on. It provides the hosting and server runtime that answers requests to jpinz.com, and the managed email service that sends our email, so it may process the information necessary to run those services, including request and network information, error reports, and the address and content of emails we send you.
• Cloudflare — helps deliver and protect JPINZ. Traffic to jpinz.com passes through it, so it processes network information such as your IP address and standard request details, and it may use security and bot-management technology, including a short-lived cookie described in the Cookie & Storage Notice.
• Supabase — the database, authentication, file storage and data access behind JPINZ. Your account, your business information, your content and your uploaded files are stored there.
• Google Sign-in — only if you choose to sign in with Google. See “Signing in”.
• Google Maps and Google Places — drawing maps and searching for places, requested directly by your browser. See “Maps, place search and address labels”.
• Google Geocoding — converting coordinates into an area or address label, requested by JPINZ's servers.
• Google Gemini — the AI models behind Business-side AI assistance. See “AI-assisted content”.
• Your browser's or device's push service (for example Google, Apple or Mozilla) — delivery of push notifications, chosen by your browser rather than by us.

Apple sign-in is not offered at the moment. Payments are not connected yet; if and when they are, this policy will name the payment provider before any card details can be entered.

Pending legal review: Data processing agreements, sub-processor lists, hosting regions and international-transfer safeguards for each provider above still have to be obtained and recorded. This policy deliberately does not claim any specific transfer mechanism, and does not claim that any provider's processing is limited to Ireland or the EEA.

Running JPINZ produces technical records that are not part of your profile. Our hosting and delivery providers keep their own request and security logs, which normally include IP addresses, timestamps, the page or endpoint requested and browser information; those logs belong to the provider's operation of the service and we do not use them to build a profile of you. Inside JPINZ we keep a record of sensitive administrative and moderation actions so they can be audited, and error reports when something breaks.

We do not use these records for advertising or behavioural profiling, and we do not sell them.

While your account is open, we keep the information described above so the service works. When you delete your account, we remove your account and the personal data attached to it as described in the next section.

A small number of records are deliberately kept after an account is deleted: administrative and security log entries (which no longer contain your email address — the deleted account is referenced by a meaningless internal code), reports you submitted (kept, but no longer linked to you), and pre-launch waitlist and preview records (kept, but unlinked from the account).

Pending legal review: Fixed retention periods for administrative logs, analytics, reports, campaign history and pre-launch records have not been decided yet. This policy states current behaviour rather than inventing a schedule; the schedule will be added here once agreed.

Under the GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to or restrict certain processing, and withdraw consent for anything you opted into.

• Copy of your data: use “Download my data” in your settings for an immediate machine-readable export of your own account data.
• Deletion: use “Delete account” in your settings. It is permanent and needs your password, or a recent sign-in if you use Google.
• Correction: edit your profile, or your business profile, directly in the app.
• Marketing: turn optional news email and in-app announcements off at any time in your settings.
• Anything else, including requests we cannot yet handle automatically: email privacy@jpinz.com.

You can also complain to a data protection authority. In Ireland that is the Data Protection Commission.

Deleting your account permanently removes your profile, your saved businesses and saved content, your notifications and notification settings, your email preferences, your push devices, your consent records, your redemption history and your subscription record. For a Business account it also removes the business profile, its Rewards, Promotions and Flash Offers, its Brand Kit, its uploaded images, its redemption PIN and its analytics.

Reports you made are kept for the moderation record with your identity removed. Waitlist and preview records are kept but unlinked from your account. An administrative log entry recording that a deletion happened is kept, and it references the deleted account only by a meaningless internal code, not by your email address.

JPINZ is for adults aged 18 and over. We do not knowingly hold data about children. If you believe a child has created an account, email privacy@jpinz.com and we will remove it.

Each version of this policy carries a version number and an effective date, shown at the top of this page. Clarifications get a minor version. A material change gets a new major version, and we will tell account holders about it. Your acceptance record stores the exact version you were shown.