Privacy Policy

Town Privacy Policy

Last updated: 7 March 2026

This Privacy Policy explains how Town Platforms Limited (company number 16585137) of 71-75 Shelton Street, London, England, WC2H 9JQ (Town, we, us or our) collects, uses, stores, shares and otherwise processes personal data in connection with the Town website, mobile app, consumer platform, business platform, rewards and loyalty tools, merchant features, communications, analytics, AI and machine learning systems, and related products and services (together, the Services).

If you use Town as a consumer user, this Privacy Policy should be read alongside the Town Consumer Terms of Service.

If you use Town as a business user, merchant, partner or other commercial account holder, this Privacy Policy should be read alongside the Town Business Platform Terms and, where applicable, any Data Processing Addendum.

For privacy questions or rights requests, please contact: info@jointown.co.uk

1. Who we are

For the purposes of applicable data protection law, including the UK GDPR and Data Protection Act 2018, Town is generally the controller of the personal data described in this Privacy Policy.

In some limited cases, where we process personal data strictly on behalf of a business customer under written instructions, we may act as a processor instead. Where that applies, the relevant contractual data processing terms will govern that processing.

2. Who this Privacy Policy covers

This Privacy Policy applies to:

consumer users of the Town app and related services;
business users, merchant contacts and authorised users of Town business accounts;
people who contact us, sign up to hear from us, join a waiting list, request a demo, or otherwise interact with us;
recipients of communications sent through the Town platform where relevant; and
individuals whose data we receive from third parties in connection with the Services.

3. The categories of personal data we collect

Depending on how you use the Services, we may collect and process the following categories of personal data.

3.1 Account and identity data

This may include:

name;
email address;
telephone number;
username or account identifier;
password or authentication credentials;
date of birth, age confirmation or age band;
profile information;
business contact details; and
records relating to account creation, verification or eligibility.

3.2 Contact and communications data

This may include:

support messages;
email correspondence;
SMS communications;
push notification settings and delivery records;
in-app messages;
sales enquiries;
demo requests; and
other communications with us or sent through the Services.

3.3 Rewards, transaction and engagement data

This may include:

rewards balances;
Town Cash activity;
redemption history;
digital loyalty card activity;
referral activity;
purchase-related data;
spend data;
merchant interaction history;
offer activations;
scans, check-ins and visits;
timestamps;
business, venue or merchant identifiers;
campaign participation; and
records of fulfilment, reimbursement or reward validation.

3.4 Device, technical and usage data

This may include:

IP address;
device identifiers;
operating system and app version;
browser type;
language and time zone settings;
crash data;
event logs;
session data;
usage analytics;
performance metrics;
authentication logs;
network information; and
records of how you interact with the Services.

3.5 Location data

Where enabled or permitted, this may include:

approximate location;
precise location;
geofenced event data;
visit signals;
foreground location events;
background location events; and
related timing and device-based context.

Location data may be collected where necessary to operate or improve platform features, including discovery, relevance, offer presentation, local recommendations, campaign logic, fraud prevention, visit verification and other location-dependent functionality.

3.6 Business and merchant data

This may include:

business name;
business address;
VAT-related information;
payment and billing records;
plan and subscription records;
listing content;
menus;
pricing;
logos, images and marketing assets;
event information;
campaign performance;
reimbursement records;
reward fulfilment records;
analytics relating to business account usage; and
authorised user information.

3.7 Publicly available and third-party data

We may collect or receive:

publicly available information associated with a user or business;
data from platform integrations;
data from payment or communications providers;
mapping or location-related data;
analytics data;
verification-related data;
app ecosystem data from Apple or Google;
records from partner services; and
other third-party data lawfully made available to us in connection with the Services.

3.8 Special category data

We do not intentionally request special category personal data unless this becomes necessary for a specific lawful purpose and we have an appropriate legal basis to process it.

4. How we collect personal data

We collect personal data:

directly from you when you sign up, use the Services, communicate with us, upload content, or interact with businesses through Town;
automatically through your use of the app, website and platform features;
from participating businesses;
from integrations, processors and service providers;
from app stores, operating systems and device-level permissions;
from publicly available sources; and
from other users, partners or third parties where relevant to the operation of the Services.

5. How we use personal data

We use personal data for the following purposes:

5.1 To provide and operate the Services

Including to:

create and administer accounts;
enable rewards, Town Cash, referrals and loyalty features;
operate scans, redemptions, listings, offers and merchant participation;
process subscriptions, billing and reimbursements;
authenticate users and maintain security;
provide support;
deliver app and platform functionality; and
manage the relationship between Town, consumers and businesses.

5.2 To personalise and improve the Services

Including to:

tailor recommendations;
rank, surface and suggest businesses, offers or content;
improve app relevance and product design;
refine merchant tools and user flows;
measure performance;
understand usage trends; and
develop new products, features and services.

5.3 To develop, train, test and improve AI and machine learning systems

We may use personal data, usage data, rewards data, transaction-related data, merchant data, location-related data and other platform data to develop, train, test, validate, monitor and improve artificial intelligence, machine learning, ranking, recommendation, forecasting, fraud detection, analytics and related intelligent systems used by Town.

Where reasonably possible, and depending on the use case, we may apply privacy-enhancing techniques such as hashing, anonymisation, aggregation, pseudonymisation, tokenisation, decoupling of identity data, minimisation and machine-only processing pipelines designed to reduce the ability of human reviewers to identify individuals directly.

However, data protection law may still treat some of that data as personal data even where privacy-enhancing techniques are used. We therefore process such data only where we consider we have an appropriate lawful basis and a legitimate business purpose.

We do not use AI to make solely automated decisions that have legal effects or similarly significant effects on users.

5.4 To prevent fraud, misuse and abuse

Including to:

detect suspicious activity;
verify transactions, visits or redemption events;
prevent duplicate accounts or self-referrals;
investigate misuse of rewards or merchant tools;
enforce our terms and policies; and
protect the integrity, safety and security of the Services.

5.5 To communicate with you

Including to:

send service messages;
send account, security and support communications;
send transactional emails and SMS messages;
send push notifications;
send product updates;
send marketing where permitted; and
facilitate business-to-user communications where the platform supports that and the user’s permissions and applicable law allow it.

5.6 To comply with legal and regulatory obligations

Including to:

meet tax, accounting and corporate obligations;
respond to lawful requests;
comply with law enforcement or regulator requirements;
enforce rights and resolve disputes; and
maintain legal records.

6. Our lawful bases

Depending on the context, we rely on one or more of the following lawful bases.

6.1 Contract

We process personal data where necessary to perform a contract with you or to take steps at your request before entering into a contract. This includes operating accounts, rewards, subscriptions, customer support, redemptions, billing and core platform functionality.

6.2 Legitimate interests

We process personal data where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests. This may include:

operating and improving the Services;
analytics and product development;
fraud prevention;
security monitoring;
service administration;
AI and machine learning development, testing and improvement;
business intelligence;
measuring performance;
enforcing legal rights; and
limited direct marketing to business users where lawful.

6.3 Consent

Where required, we rely on consent, including for:

certain marketing communications to consumers;
certain SMS marketing;
push notifications where applicable;
collection of precise or background location data where operating system rules or applicable law require permission; and
other optional processing activities that we clearly present on an opt-in basis.

You can withdraw consent at any time, but this will not affect processing already carried out lawfully before withdrawal.

6.4 Legal obligation

We may process personal data where necessary to comply with a legal obligation.

7. Marketing and communications

7.1 Consumers

Consumers may receive:

service and account communications necessary for the Services to function;
transactional email and SMS messages;
push notifications relevant to the operation of the Services; and
marketing messages by email or SMS where the user has given permission or where otherwise lawful.

7.2 Businesses

Business users may receive:

service, account and billing messages;
product and platform communications;
sales communications; and
business-facing marketing where lawful.

7.3 Merchant communications through Town

Users may also receive communications associated with participating businesses through the platform where this is part of the Services and the relevant permissions and legal requirements are met. Where appropriate, such communications may be identified as originating from or relating to the relevant business.

You can manage marketing preferences through the mechanisms made available in the Services or through the communication itself where applicable.

8. Location data and device permissions

If you enable location permissions, we may collect precise, approximate, foreground, background or geofenced location data where necessary for relevant features.

If you do not grant location permissions, some features may not work fully or at all.

You can usually control app-level permissions through your device settings. Restricting permissions may affect service functionality, recommendations, local discovery, reward verification or other app features.

9. Cookies, SDKs and similar technologies

We may use cookies, local storage, software development kits, device identifiers and similar technologies to:

keep you signed in;
remember preferences;
support security;
maintain session state;
improve functionality;
measure performance;
understand product usage; and
support analytics within the Services.

We do not currently intend to use cookies or similar technologies to track user activity outside the Services for unrelated cross-site behavioural advertising purposes.

We may publish a separate Cookie Policy later. Until then, this Privacy Policy describes our general approach.

10. When we share personal data

We may share personal data with:

hosting and infrastructure providers;
analytics and database providers;
payment processors;
communications and email providers;
SMS and push providers;
app distribution platforms;
mapping and geolocation providers;
fraud prevention, security and support providers;
legal, professional and compliance advisers;
group reorganisations, investors or transaction counterparties subject to appropriate protections;
participating businesses where needed to operate rewards, offers, support or fulfilment;
platform partners and integrations; and
regulators, courts, law enforcement or other competent authorities where required.

Current or anticipated providers may include services such as Vercel, Apple, Google, Resend, Supabase, Iubenda, Stripe, Mapbox and, where enabled in future or in limited relevant contexts, TrueLayer and other service providers.

We do not sell personal data directly to third parties.

11. International transfers

Some of our service providers, integrations and technical vendors may process personal data outside the UK.

Where we make a restricted transfer of personal data, we aim to do so using a lawful transfer mechanism, such as:

adequacy regulations;
the UK International Data Transfer Agreement;
the UK Addendum to standard contractual clauses; or
another legally recognised safeguard.

We may also carry out transfer risk assessments and supplementary measures where appropriate.

12. Retention

We retain personal data for as long as reasonably necessary for the purposes set out in this Privacy Policy, including to provide the Services, maintain records, comply with legal obligations, resolve disputes, prevent fraud and enforce agreements.

Retention periods will vary depending on the type of data and context. In many cases, we may retain relevant records for up to 6 years, or longer where law, dispute risk, fraud prevention, technical necessity or legitimate business needs justify it.

We may also retain:

system logs and security records;
rewards, redemption and transaction records;
business billing and subscription records;
communications and support records;
model-development records;
anonymised, aggregated or de-identified datasets; and
derived analytics and model outputs,

for longer where lawful and appropriate.

If you close or delete an account, we may still retain certain information where necessary for legal, regulatory, accounting, fraud prevention, security, product integrity, model integrity, dispute resolution or other legitimate purposes.

13. Your rights

Depending on the circumstances, you may have the right to:

request access to your personal data;
request correction of inaccurate data;
request deletion;
request restriction of processing;
object to certain processing;
request portability where applicable;
withdraw consent where processing is based on consent; and
complain to the ICO.

These rights are not absolute and may be limited in some circumstances.

Where we process data for legitimate interests, AI development, analytics, fraud prevention or security, we will consider any objection in line with applicable law and the context of the processing.

To exercise rights, contact info@jointown.co.uk.

You also have the right to complain to the UK Information Commissioner’s Office.

14. Children and age limits

The Services are not intended for children under 16.

If we reasonably believe that someone under 16 has created an account or provided personal data contrary to our rules, we may suspend or delete the account and take reasonable steps to remove or restrict the associated data.

Where we process the personal data of younger users aged 16 to 17, we aim to do so transparently and in a way that reflects the need for appropriate protection of children’s data.

15. Security

We use technical and organisational measures designed to protect personal data. These may include access controls, hashing, minimisation, permissions controls, environment separation, processor due diligence, logging, monitoring and other security measures.

However, no method of transmission or storage is completely secure and we cannot guarantee absolute security.

16. Profiling and recommendations

We may use profiling, analytics, ranking and recommendation systems to personalise content, suggest businesses, identify relevant offers, improve discovery and support fraud detection or platform optimisation.

We do not currently use solely automated decision-making that produces legal effects or similarly significant effects on individuals.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

The latest version will be made available through the Services or otherwise communicated where appropriate. Your continued use of the Services after an update takes effect will be subject to the updated Privacy Policy.

‍

If you use Town as a consumer user, this Privacy Policy should be read alongside the Town Consumer Terms of Service.

For privacy questions or rights requests, please contact: info@jointown.co.uk

‍

1. Who we are

For the purposes of applicable data protection law, including the UK GDPR and Data Protection Act 2018, Town is generally the controller of the personal data described in this Privacy Policy.

‍

2. Who this Privacy Policy covers

This Privacy Policy applies to:

consumer users of the Town app and related services;
business users, merchant contacts and authorised users of Town business accounts;
people who contact us, sign up to hear from us, join a waiting list, request a demo, or otherwise interact with us;
recipients of communications sent through the Town platform where relevant; and
individuals whose data we receive from third parties in connection with the Services.

3. The categories of personal data we collect

Depending on how you use the Services, we may collect and process the following categories of personal data.

3.1 Account and identity data

This may include:

name;
email address;
telephone number;
username or account identifier;
password or authentication credentials;
date of birth, age confirmation or age band;
profile information;
business contact details; and
records relating to account creation, verification or eligibility.

3.2 Contact and communications data

This may include:

support messages;
email correspondence;
SMS communications;
push notification settings and delivery records;
in-app messages;
sales enquiries;
demo requests; and
other communications with us or sent through the Services.

3.3 Rewards, transaction and engagement data

This may include:

rewards balances;
Town Cash activity;
redemption history;
digital loyalty card activity;
referral activity;
purchase-related data;
spend data;
merchant interaction history;
offer activations;
scans, check-ins and visits;
timestamps;
business, venue or merchant identifiers;
campaign participation; and
records of fulfilment, reimbursement or reward validation.

3.4 Device, technical and usage data

This may include:

IP address;
device identifiers;
operating system and app version;
browser type;
language and time zone settings;
crash data;
event logs;
session data;
usage analytics;
performance metrics;
authentication logs;
network information; and
records of how you interact with the Services.

3.5 Location data

Where enabled or permitted, this may include:

approximate location;
precise location;
geofenced event data;
visit signals;
foreground location events;
background location events; and
related timing and device-based context.

3.6 Business and merchant data

This may include:

business name;
business address;
VAT-related information;
payment and billing records;
plan and subscription records;
listing content;
menus;
pricing;
logos, images and marketing assets;
event information;
campaign performance;
reimbursement records;
reward fulfilment records;
analytics relating to business account usage; and
authorised user information.

3.7 Publicly available and third-party data

We may collect or receive:

publicly available information associated with a user or business;
data from platform integrations;
data from payment or communications providers;
mapping or location-related data;
analytics data;
verification-related data;
app ecosystem data from Apple or Google;
records from partner services; and
other third-party data lawfully made available to us in connection with the Services.

3.8 Special category data

We do not intentionally request special category personal data unless this becomes necessary for a specific lawful purpose and we have an appropriate legal basis to process it.

‍

4. How we collect personal data

We collect personal data:

directly from you when you sign up, use the Services, communicate with us, upload content, or interact with businesses through Town;
automatically through your use of the app, website and platform features;
from participating businesses;
from integrations, processors and service providers;
from app stores, operating systems and device-level permissions;
from publicly available sources; and
from other users, partners or third parties where relevant to the operation of the Services.

‍

5. How we use personal data

We use personal data for the following purposes:

5.1 To provide and operate the Services

Including to:

create and administer accounts;
enable rewards, Town Cash, referrals and loyalty features;
operate scans, redemptions, listings, offers and merchant participation;
process subscriptions, billing and reimbursements;
authenticate users and maintain security;
provide support;
deliver app and platform functionality; and
manage the relationship between Town, consumers and businesses.

5.2 To personalise and improve the Services

Including to:

tailor recommendations;
rank, surface and suggest businesses, offers or content;
improve app relevance and product design;
refine merchant tools and user flows;
measure performance;
understand usage trends; and
develop new products, features and services.

5.3 To develop, train, test and improve AI and machine learning systems

We do not use AI to make solely automated decisions that have legal effects or similarly significant effects on users.

5.4 To prevent fraud, misuse and abuse

Including to:

detect suspicious activity;
verify transactions, visits or redemption events;
prevent duplicate accounts or self-referrals;
investigate misuse of rewards or merchant tools;
enforce our terms and policies; and
protect the integrity, safety and security of the Services.

5.5 To communicate with you

Including to:

send service messages;
send account, security and support communications;
send transactional emails and SMS messages;
send push notifications;
send product updates;
send marketing where permitted; and
facilitate business-to-user communications where the platform supports that and the user’s permissions and applicable law allow it.

5.6 To comply with legal and regulatory obligations

Including to:

meet tax, accounting and corporate obligations;
respond to lawful requests;
comply with law enforcement or regulator requirements;
enforce rights and resolve disputes; and
maintain legal records.

‍

6. Our lawful bases

Depending on the context, we rely on one or more of the following lawful bases.

6.1 Contract

6.2 Legitimate interests

We process personal data where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests. This may include:

operating and improving the Services;
analytics and product development;
fraud prevention;
security monitoring;
service administration;
AI and machine learning development, testing and improvement;
business intelligence;
measuring performance;
enforcing legal rights; and
limited direct marketing to business users where lawful.

6.3 Consent

Where required, we rely on consent, including for:

certain marketing communications to consumers;
certain SMS marketing;
push notifications where applicable;
collection of precise or background location data where operating system rules or applicable law require permission; and
other optional processing activities that we clearly present on an opt-in basis.

You can withdraw consent at any time, but this will not affect processing already carried out lawfully before withdrawal.

6.4 Legal obligation

We may process personal data where necessary to comply with a legal obligation.

‍

7. Marketing and communications

7.1 Consumers

Consumers may receive:

service and account communications necessary for the Services to function;
transactional email and SMS messages;
push notifications relevant to the operation of the Services; and
marketing messages by email or SMS where the user has given permission or where otherwise lawful.

7.2 Businesses

Business users may receive:

service, account and billing messages;
product and platform communications;
sales communications; and
business-facing marketing where lawful.

7.3 Merchant communications through Town

You can manage marketing preferences through the mechanisms made available in the Services or through the communication itself where applicable.

‍

8. Location data and device permissions

If you enable location permissions, we may collect precise, approximate, foreground, background or geofenced location data where necessary for relevant features.

If you do not grant location permissions, some features may not work fully or at all.

‍

9. Cookies, SDKs and similar technologies

We may use cookies, local storage, software development kits, device identifiers and similar technologies to:

keep you signed in;
remember preferences;
support security;
maintain session state;
improve functionality;
measure performance;
understand product usage; and
support analytics within the Services.

We do not currently intend to use cookies or similar technologies to track user activity outside the Services for unrelated cross-site behavioural advertising purposes.

We may publish a separate Cookie Policy later. Until then, this Privacy Policy describes our general approach.

‍

10. When we share personal data

We may share personal data with:

hosting and infrastructure providers;
analytics and database providers;
payment processors;
communications and email providers;
SMS and push providers;
app distribution platforms;
mapping and geolocation providers;
fraud prevention, security and support providers;
legal, professional and compliance advisers;
group reorganisations, investors or transaction counterparties subject to appropriate protections;
participating businesses where needed to operate rewards, offers, support or fulfilment;
platform partners and integrations; and
regulators, courts, law enforcement or other competent authorities where required.

We do not sell personal data directly to third parties.

‍

11. International transfers

Some of our service providers, integrations and technical vendors may process personal data outside the UK.

Where we make a restricted transfer of personal data, we aim to do so using a lawful transfer mechanism, such as:

adequacy regulations;
the UK International Data Transfer Agreement;
the UK Addendum to standard contractual clauses; or
another legally recognised safeguard.

We may also carry out transfer risk assessments and supplementary measures where appropriate.

‍

12. Retention

We may also retain:

system logs and security records;
rewards, redemption and transaction records;
business billing and subscription records;
communications and support records;
model-development records;
anonymised, aggregated or de-identified datasets; and
derived analytics and model outputs,

for longer where lawful and appropriate.

‍

13. Your rights

Depending on the circumstances, you may have the right to:

request access to your personal data;
request correction of inaccurate data;
request deletion;
request restriction of processing;
object to certain processing;
request portability where applicable;
withdraw consent where processing is based on consent; and
complain to the ICO.

These rights are not absolute and may be limited in some circumstances.

Where we process data for legitimate interests, AI development, analytics, fraud prevention or security, we will consider any objection in line with applicable law and the context of the processing.

To exercise rights, contact info@jointown.co.uk.

You also have the right to complain to the UK Information Commissioner’s Office.

‍

14. Children and age limits

The Services are not intended for children under 16.

Where we process the personal data of younger users aged 16 to 17, we aim to do so transparently and in a way that reflects the need for appropriate protection of children’s data.

‍

15. Security

However, no method of transmission or storage is completely secure and we cannot guarantee absolute security.

‍

16. Profiling and recommendations

We do not currently use solely automated decision-making that produces legal effects or similarly significant effects on individuals.

‍

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.