Privacy Policy

Last updated: 4 September 2026

Ottakin is a Canadian-owned company based in Ottawa, Ontario. This policy explains what information we handle when a business or club uses Ottakin, and when their customers or members use a digital pass.

Who this covers

Account holders — the business or club that signs up and runs a program. End users — the customers or members who add a loyalty or membership pass to Apple Wallet or Google Wallet.

What we collect

Account information — the account holder’s email, a password (stored hashed by our authentication provider), and the business or club name. During onboarding we optionally collect category, neighbourhood, postal code and number of locations.
Program configuration — the loyalty cards, memberships, events and campaigns an account holder creates.
Activity records — an append-only log of stamps, redemptions and event check-ins, with the date/time and which staff account recorded them. Each end user has a display name they enter when they join.
Wallet passes — a pass is identified by a random token. Passes are anonymous by default; no end-user email is required. For Apple Wallet updates, we store a device push token provided by Apple.
Website analytics — first-party only. We set a random visitor id in a cookie and record which marketing pages were viewed and any UTM parameters, to understand where sign-ups come from. No third-party trackers or advertising pixels.
Diagnostics — if the application errors, we send a stack trace to our error-monitoring provider. We do not attach customer records to these reports.
Payments — if an account holder subscribes to a paid plan, card details are collected and stored by Stripe, not by Ottakin. We keep a Stripe customer/subscription identifier and the plan status.

How we use it

To operate the service; to produce the account holder’s own insights about their repeat customers or member engagement; to send service and account emails (sign-in, verification, password reset, and — for paid plans — receipts and billing notices); and to keep the service secure and working.

In future we may show account holders aggregated, non-identifying benchmarks (for example “similar Ottawa cafés”). Any such comparison will use minimum group sizes and will never reveal information about another individual business.

What we don’t do

We do not sell or rent personal information. We do not share it with advertising networks or data brokers. We do not give one account holder identifiable information about another’s customers or members.

Service providers

We use a small set of processors to run Ottakin: Supabase (database and authentication), Vercel (application hosting), Apple and Google (Wallet pass delivery and update notifications), Stripe (payments), Sentry (error monitoring), and a transactional email provider. Some of these process data on infrastructure outside Canada. We are working toward Canadian data residency for stored customer and member data.

Your choices and rights

An account holder can export or delete their customers, members and activity records at any time, and can close their account. End users can remove a pass from their Wallet at any time, and can ask the business, club, or us to delete records associated with their pass. Requests to us: privacy@ottakin.ca.

Retention

We keep account and activity data while the account is active and for a reasonable period afterward to allow reactivation, then delete or anonymise it. Diagnostic data is kept for up to 90 days.

Children

Ottakin is not directed at children. Club memberships are intended for post-secondary students and other adults.

Changes

We may update this policy. If a change is significant we will notify account holders by email or in the dashboard. Continued use after a change means you accept the updated policy.

Contact

Ottakin, Ottawa, Ontario, Canada. Privacy questions and requests under Canadian privacy law (PIPEDA): privacy@ottakin.ca. General: hello@ottakin.ca.