Voice For Locals Shoppers App

Privacy Policy

See also: Terms & Conditions · Terms of Use · Website privacy overview

App: Voice For Locals Shoppers (com.vfl.consumer)

Effective Date: 28 September 2026

1. Introduction

Voice For Locals ("Voice For Locals", "VFL", "we", "our", or "us") is committed to protecting your privacy and handling your personal information fairly, transparently, and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable privacy laws.

This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the Voice For Locals Shoppers mobile application (the "App") and related services. It applies specifically to shoppers using the App and supplements our general website privacy policy at voiceforlocals.co.uk/privacy.

Please read this policy carefully. By creating an account or using the App, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

Voice For Locals is the Data Controller responsible for your personal information.

Voice For Locals

Office 7, 35–37 Ludgate Hill
London EC4M 7JN
United Kingdom

Email: support@voiceforlocals.co.uk

If you have any questions about this Privacy Policy or how we process your personal information, please contact us using the details above.

3. Who This Policy Applies To

This Privacy Policy applies to individuals aged 18 or over who use the Voice For Locals Shoppers App to discover local businesses, earn loyalty rewards, make payments, leave reviews, and participate in community campaigns.

The App is not intended for anyone under 18. We do not knowingly collect personal information from children. If we become aware that we have collected information from someone under 18, we will take reasonable steps to delete it.

4. Personal Information We Collect

Depending on how you use the App, we may collect the following categories of personal information.

4.1 Identity and Profile Information

• First name and display name
• Profile photograph (optional)
• Gender
• Ethnicity
• Audience profile (e.g. how you describe your relationship with the local area)
• Stay duration (how long you have lived in or been connected to the area)
• UK postcode
• Council area (derived from your postcode where applicable)

4.2 Contact and Account Information

• Email address
• Mobile telephone number (where provided)
• One-time password (OTP) verification records
• Google Sign-In account identifier (when you sign in with Google)
• Apple ID Sign-In account identifier (when you sign in with Apple)
• Internal user ID and loyalty ID
• Account status and login history
• Legal consent records (including timestamp and country)

We do not receive your Google or Apple account passwords.

4.3 Special Category Data

Under UK GDPR, certain information we collect is classified as special category personal data:

Data	Purpose
Ethnicity	To help local businesses and campaigns understand community diversity and deliver relevant, inclusive offers.
Homelessness situation and verification status	To enable targeted support programmes and verified access to relevant rewards for people experiencing homelessness.

We process special category data only where you have given explicit consent at the point of collection in the App. You may withdraw this consent at any time by updating your profile or contacting us, though this may affect your eligibility for certain programmes.

Homelessness verification involves OTP confirmation through a registered support centre associated with your postcode. We store verification status and the name of the verifying support centre, not the OTP itself.

4.4 Location Information

With your permission, we collect location information to power shop search and live presence features:

• Precise GPS coordinates when Live Mode is enabled (real-time location while using the App)
• Approximate location derived from your profile postcode when Live Mode is disabled
• Postcode-to-coordinates lookups via the third-party service postcodes.io (we send your postcode; postcodes.io returns latitude and longitude)
• Location associated with payment transactions (to confirm local spend eligibility)

Location services are optional. You can enable or disable Live Mode within the App and withdraw device-level location permissions at any time through your device settings. Disabling location may limit nearby shop search and live reward features.

When Live Mode is active, we send periodic presence signals to our servers so that participating businesses can see aggregated, anonymised shopper activity in their area (see Section 6.5). These signals do not identify you by name in the business heatmap view.

4.5 Loyalty, Rewards, and Engagement Information

• Loyalty points balance and tier
• Reward preferences (category and subcategory selections)
• Rewards earned, collected, and redeemed
• QR code scan and redemption records
• Referral code and referral activity
• Campaign and survey responses
• Favourite businesses
• Shop search history (businesses viewed and searched)
• Local spend summaries (monthly totals)

4.6 User-Generated Content

• Public reviews and ratings (including your name and profile photo unless you choose to post anonymously where that option is available)
• Feedback submitted after transactions
• Survey answers
• Photos uploaded to your profile

Reviews you submit may be displayed publicly on business profiles within the Voice For Locals platform.

4.7 Payment Information

When you make payments through the App:

• Transaction amounts, dates, and merchant details
• Payment status and receipt information
• Stripe customer identifier
• Location at time of payment (for local spend verification)

Full payment card numbers are not stored by Voice For Locals. Card details are entered directly into Stripe's secure payment interface and processed by Stripe as our payment service provider.

4.8 Device and Technical Information

• Device type and operating system
• App version
• Firebase Cloud Messaging (FCM) device token (for push notifications on Android)
• Apple Push Notification service (APNs) device token (for push notifications on iOS)
• IP address
• Language and time zone settings

We use device tokens solely to deliver push notifications you have opted into. We do not use device identifiers for cross-app tracking or advertising.

4.9 Notification and Communication Data

• In-app notification history
• Push notification delivery records
• Customer support correspondence

5. How We Collect Information

We collect personal information when you:

• Create an account or sign in (email OTP, Google Sign-In, or Apple Sign-In)
• Complete or update your profile
• Verify your homelessness situation through a support centre
• Set reward preferences
• Enable Live Mode or grant location permissions
• Search for shops or add favourites
• Make a payment through Stripe
• Scan or redeem a QR code
• Leave a review, rating, or survey response
• Refer a friend or business
• Interact with loyalty campaigns
• Register for push notifications
• Contact customer support
• Delete your account

We also collect limited technical information automatically when you use the App (e.g. IP address, device type).

6. How We Use Your Information

We use your personal information to:

6.1 Account and Authentication

• Create and manage your account
• Verify your identity via email OTP, Google Sign-In, or Apple Sign-In
• Verify homelessness status via support centre OTP
• Maintain your profile and preferences

6.2 Core App Features

• Display nearby participating businesses based on your location or postcode
• Power shop search within a configurable radius of your location
• Save and sync your favourite businesses
• Match you with relevant rewards based on your preferences and audience profile
• Process loyalty point accrual and redemption
• Enable QR code scanning and reward redemption at participating businesses

6.3 Payments and Local Spend

• Process payments securely through Stripe
• Record transaction history
• Calculate local spend totals for loyalty tiering and reporting

6.4 Community and Engagement

• Display your public reviews on business profiles
• Process referrals and award referral loyalty points
• Deliver campaign content and surveys matched to your profile
• Send loyalty updates, reward notifications, and service announcements

6.5 Live Presence and Business Heatmaps

When Live Mode is enabled, we use your precise location to:

• Refresh nearby shop results in real time
• Contribute anonymised, aggregated location signals to a near-real-time shopper heatmap visible to participating businesses within approximately 0.6 miles (1 km) of their premises

Businesses see coordinates and counts, not your name or identity, in the heatmap view. Your identity may be visible to a business in separate redemption and transaction reports where you have redeemed a reward or made a payment at that business.

6.6 Push Notifications

• Send push notifications about rewards, referrals, feedback requests, and service updates (where you have granted notification permission)

6.7 Safety, Security, and Legal Compliance

• Detect and prevent fraud and abuse
• Enforce our Terms of Use
• Comply with legal obligations
• Respond to data subject requests

7. What We Do Not Do

We want to be clear about practices we do not engage in:

• We do not sell your personal information to third parties
• We do not display third-party advertising in the App
• We do not use your data for cross-app or cross-site tracking
• We do not use Firebase Analytics (analytics collection is disabled in our Firebase configuration)
• We do not request Apple App Tracking Transparency (ATT) permission — we do not track you across other companies' apps or websites
• We do not share your special category data (ethnicity, homelessness information) with businesses except as necessary to verify eligibility for specific support programmes you have opted into

8. Lawful Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

Processing activity	Lawful basis
Account creation, authentication, and core App functionality	Performance of a contract (our Terms of Use with you)
Payment processing and transaction records	Performance of a contract; Legal obligation (financial record-keeping)
Push notifications (marketing-style loyalty updates)	Consent (notification permission on your device)
Live Mode / precise location	Consent (location permission on your device and Live Mode toggle in App)
Ethnicity	Explicit consent (special category data)
Homelessness situation and verification	Explicit consent (special category data)
Public reviews and referrals	Performance of a contract; Legitimate interests (operating a community review platform, balanced against your rights)
Fraud prevention and security	Legitimate interests (protecting our platform and users)
Legal compliance and regulatory requests	Legal obligation
Anonymised analytics and aggregated heatmap data	Legitimate interests (improving local business insights, using anonymised/aggregated data only)

Where we rely on consent, you may withdraw it at any time through the App, your device settings, or by contacting us. Withdrawal does not affect the lawfulness of processing before withdrawal.

9. Sharing Your Information

We share personal information only where necessary and with appropriate safeguards:

Recipient	Purpose	Data shared
Google	Google Sign-In authentication; Firebase Cloud Messaging (Android push)	Account identifier, device token
Apple	Apple Sign-In authentication; Apple Push Notification service (iOS push)	Account identifier, device token
Stripe	Payment processing	Payment details, transaction data, Stripe customer ID
postcodes.io	UK postcode to coordinates lookup	Postcode only
Google Cloud	Cloud hosting and infrastructure	All data stored on our platform (encrypted in transit and at rest)
Participating businesses	Reward redemption, payment fulfilment, public reviews	Name, review content, transaction/redemption details as applicable
Support centres	Homelessness verification	Verification request (not your full profile)
Professional advisers	Legal, accounting, or technical advice	As required
Regulators or law enforcement	Legal compliance	As required by law

We share the minimum information necessary for each purpose. We require processors to protect your data under written agreements compliant with UK GDPR.

We do not share your ethnicity or homelessness information with businesses for general marketing purposes.

10. International Transfers

Our platform is hosted on Google Cloud infrastructure. Where personal information is transferred outside the United Kingdom, we ensure appropriate safeguards are in place, including UK International Data Transfer Agreements or equivalent mechanisms recognised under UK GDPR.

Stripe, Google, and Apple may process data in the United States and other countries under their respective data protection frameworks and contractual terms.

11. Data Retention

We retain personal information only for as long as necessary to:

• Provide the App and related services
• Maintain transaction and loyalty records (as required for financial and tax purposes)
• Resolve disputes and enforce our agreements
• Comply with legal obligations

Account deletion: You may delete your account in the App (Profile → Delete Account). Deletion requires OTP verification via your registered email or phone number. Upon confirmed deletion:

• Your account is deactivated and personal identifiers are anonymised on our systems
• Public reviews may be retained in anonymised form (displayed as "Anonymous Shopper" or similar)
• Transaction records required for legal or financial compliance may be retained in anonymised or pseudonymised form
• FCM/APNs device tokens should be removed from our notification registry (see Section 16 regarding a known improvement area)

When information is no longer required, it is securely deleted or anonymised.

12. Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• HTTPS/TLS encryption for all data in transit
• Secure authentication (OTP, OAuth via Google/Apple)
• Access controls and role-based permissions on our systems
• Secure cloud infrastructure (Google Cloud)
• Payment card data handled exclusively by PCI-compliant Stripe

No online system can be guaranteed completely secure. We continually review and improve our security practices.

13. Your Rights

Under UK GDPR, you have the right to:

• Access your personal information
• Rectify inaccurate information (via Edit Profile or by contacting us)
• Erase your information (via in-app account deletion or by contacting us)
• Restrict processing in certain circumstances
• Object to processing based on legitimate interests
• Withdraw consent at any time (for consent-based processing, including special category data)
• Data portability (receive your data in a structured, machine-readable format)
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise your rights, contact us at support@voiceforlocals.co.uk. We will respond within the timeframe required by law (typically one month).

14. Push Notifications

The App uses Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS) to deliver notifications about rewards, referrals, feedback requests, and service updates.

You can manage notification permissions through your device settings at any time. Disabling notifications will not affect core App functionality but you may miss reward alerts and feedback prompts.

15. Third-Party Links and Services

The App may display business websites, social links, or external content. This Privacy Policy does not apply to third-party websites or services. We encourage you to review the privacy policies of any third-party services you interact with.

postcodes.io is an open UK postcode lookup service. We send only your postcode to this service; no account identifiers are transmitted.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, legal requirements, or business practices. The latest version will be available in the App and on our website. We will notify you of material changes via the App or email where appropriate.

The effective date at the top of this document indicates when the current version took effect.

17. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, please contact:

Voice For Locals

Office 7, 35–37 Ludgate Hill
London EC4M 7JN
United Kingdom

Email: support@voiceforlocals.co.uk