Privacy Policy

01 Introduction

Allora (Pty) Ltd ("Allora", "we", "us", or "our") is committed to protecting the privacy and personal information of all users of the Allora mobile application ("App"). This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our App.

This policy applies to all users, including individual consumers ("Consumers"), registered businesses ("Businesses"), and business agents ("Agents").

By downloading, installing, or using the App, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and processing of your personal information as described herein. If you do not agree with any part of this Privacy Policy, you must immediately cease using the App.

This Privacy Policy should be read in conjunction with our Terms and Conditions.

01.1 What Allora Is and Is Not

Allora is a loyalty card management and rewards aggregation platform.

We help you:

• Organize and track your existing loyalty program memberships
• Monitor rewards, points, and cashback across multiple programs
• Redeem rewards from participating businesses
• Manage your digital loyalty cards in one convenient app

When this policy refers to 'payments,' it means only the processing of optional shipping fees for physical reward deliveries via third-party payment gateways. We do not hold, transfer, or manage your money. We only track loyalty points, rewards, and cashback from existing programs.

02 Information We Collect

We collect various categories of information:

2.1 Account Registration Information

Full name, email, phone number, date of birth, country, password (encrypted). Google Sign-In: profile name, email, identifier. Apple Sign-In: Apple identifier and email (real or relay). Business: legal/trading name, industry, address, contact details, KYC documents.

2.2 Profile and Identity Information

Updated name, email, phone, preferences, offline PIN (encrypted on device), business profile details.

2.3 Transaction and Activity Data

Loyalty enrolments, scan records, reward accumulation/redemption/transfers, cashback balances, shipping details, loyalty point transaction records, reward shipping fee payment records (processed via third-party gateways), support queries.

2.4 Device and Technical Information

Device model, OS version, unique identifiers, app version, push notification tokens, screen resolution, network type.

2.5 Usage Data

Features accessed, navigation patterns, session duration, search queries, engagement metrics, error/crash reports.

2.6 Communication Data

Support query content, chat bot logs, business reports, contact form submissions, feedback.

03 How We Use Your Information

3.1 Service Delivery and Operations

Account management, authentication, loyalty program operation, reward shipping coordination, third-party payment gateway integration for reward delivery fees only, push notifications, QR/barcode features.

3.2 Personalisation and Improvement

Personalised experience, relevant program suggestions, performance improvements, new feature development, content optimisation.

3.3 Security and Fraud Prevention

Account protection, fraud detection, KYC verification, suspicious activity monitoring, Terms enforcement, reward system integrity.

3.4 Communication

Verification emails, service notifications, support responses, policy updates.

3.5 Legal Compliance

Legal obligations, government requests, rights enforcement, record-keeping.

04 Legal Basis for Processing

• (a) Consent — when creating account, accepting policy, opting into notifications. May withdraw at any time.
• (b) Contractual Necessity — to provide App services.
• (c) Legitimate Interests — improving services, fraud prevention (provided they don't override your rights).
• (d) Legal Obligation — complying with applicable laws.

05 How We Share Your Information

5.1 With Participating Businesses

Loyalty scan records, Allo Wallet Card identifier. NOT your full account details or other programs' data.

5.2 With Third-Party Service Providers

Google (auth), Apple (auth), payment gateways, shipping carriers, push notification services, cloud hosting. Contractually obligated to protect data.

5.3 With Business Agents

Access limited to Business-related data needed for their roles.

5.4 For Legal and Safety Reasons

When required to comply with law, protect rights/safety, investigate fraud.

5.5 Business Transfers

In mergers/acquisitions, data may transfer. You will be notified.

06 Data Storage and Security

We implement comprehensive security measures to protect your data:

• TLS/SSL encryption in transit
• Secure hashing for passwords
• Expo SecureStore for sensitive credentials
• Token-based auth with refresh
• Role-based access controls
• Regular security assessments
• Network checks
• Secure logout

Offline PIN is stored on device only. No absolute security guarantee can be provided.

07 Data Retention

• Account info: Duration of active account plus reasonable period.
• Transaction data: Per financial regulations.
• Shipping records: Per commercial regulations.
• Support records: Reasonable period.
• KYC: Per anti-money laundering regulations.

On deletion: personal data removed within reasonable timeframe except where legally required.

08 Your Rights

8.1 Right of Access

Request copies of your data.

8.2 Right to Rectification

Correct inaccurate data.

8.3 Right to Erasure

Request deletion (rewards may be lost).

8.4 Right to Restrict Processing

Restrict in certain circumstances.

8.5 Right to Data Portability

Receive data in structured format.

8.6 Right to Object

Object to direct marketing processing.

8.7 Right to Withdraw Consent

Withdraw at any time.

8.8 Exercising Your Rights

Via app settings, Help & Support, or Contact Us.

09 Cookies and Local Storage

The App uses the following local storage mechanisms:

• AsyncStorage: App state and preferences
• SecureStore: Auth tokens (encrypted)
• In-memory caching: Temporary session data
• Redux state persistence: App state management

Clear via "Clear App Data" in profile settings.

10 Push Notifications

Push tokens are collected when notifications are enabled. Notifications include:

• Reward alerts
• Promotions
• Security alerts
• Maintenance updates
• Shipping status

Manage via device settings. Critical alerts cannot be disabled.

13 Camera and Media Access

Camera and media permissions are used for:

• QR/barcode scanning
• Profile images
• KYC uploads

Camera is not accessed in the background. Revoke permissions via device settings.

14 Children's Privacy

The App is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we discover that we have inadvertently collected data from a child, we will delete it immediately.

15 International Data Transfers

Data may be transferred internationally. Safeguards include:

• Standard contractual clauses
• Appropriate security measures
• Compliance with cross-border regulations

16 Third-Party Links and Services

The App may contain links to third-party websites and services. We are not responsible for their privacy practices. We encourage you to review their privacy policies independently.

17 Changes to This Privacy Policy

We may update this policy from time to time. You will be notified of material changes via in-app notification or email. Continued use of the App after changes constitutes acceptance of the revised policy.

We encourage you to periodically review this Privacy Policy.

18 POPIA Compliance

We comply with the Protection of Personal Information Act (POPIA) of South Africa. Your rights under POPIA include accessing, correcting, and deleting your data.

The Information Regulator can be contacted for complaints. We process data lawfully, transparently, and only what is necessary.

19 Contact Us

For privacy inquiries, use the in-app Help & Support section or Contact Us feature.

For formal data protection requests: