PrivacyDraft
What we hold about your customers, why, for how long, who else sees it and where it is kept. Includes the retention periods, which are enforced by the software rather than promised.
Data protection agreementDraft
The processing terms between you and us. UK GDPR requires a written agreement like this with any supplier handling your customers' data, so it is part of your compliance as well as ours. Includes the list of sub-processors and how the data is protected.
SecurityDraft
How we protect the people who join a shop's programme, what we commit to if something goes wrong, and how to report a problem to us if you find one.
Security incident responseOn request
What happens if something goes wrong, who is told, and how quickly. It is an internal operational document rather than a published one, because it names where things are kept and who does what. A merchant can ask for a copy, and the data protection agreement provides for that as part of an audit.
Terms of service
The commercial agreement: what we provide, what it costs, and how either side ends it. Not written yet.
If you are a customer of a shop, not a shop
The privacy page is the one you want. It says what is held about you and what you can do about it, and most of it you can do yourself from the app without asking anybody.