Crumple App Privacy Policy

Effective Date: 17th December 2024

Last Updated: 25th August 2026

Crumple Ltd (previously known as Crumple Receipts Ltd) ("we," "our," "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the Crumple application ("the App") and the Crumple website ("the Website"). By accessing or using the App or the Website, you agree to the practices described in this Privacy Policy. If you do not agree, please refrain from using the App or the Website.

This policy applies to consumers using the Crumple app to receive and manage digital receipts. If you are a business using the Crumple Business Dashboard, please refer to the Business Privacy Policy instead.

1. Information We Collect

When you use the Crumple app, we may collect the following types of personal and non-personal information:

1.1 Personal Information

• Name
• Email address
• Phone number
• Year of Birth
• Gender
• Postcode
• Country
• Store receipts
• IP addresses
• Device information
• Location data

Your Year of Birth is collected primarily to support ongoing age verification, helping ensure that you are only presented with age-appropriate content, promotions, and campaigns delivered through our platform by participating businesses, including categories that may be subject to age restrictions.

Your Year of Birth, Gender and Postcode are also used to help our partnered shops better understand their customer demographics, which may be visualised through charts and maps on the Crumple Business Dashboard.

1.2 Cookies and Similar Technologies

On the Crumple website we use cookies, local storage and session storage. Those needed to run the site — keeping you signed in, remembering your cookie choice, and protecting our forms from automated abuse — are always active. Analytical cookies are set only if you turn them on, and you can change your choice at any time using the "Cookie preferences" link in the footer.

Our Cookie Policy lists each one, what it is for, and how long it lasts.

1.3 Usage Data and Analytics

We collect non-identifiable information to improve our services, such as:

• App usage patterns and interactions
• Receipt-related activities (e.g. frequency of receipt access)
• Engagement metrics

This data is processed securely and aggregated to optimise app performance and provide insights to our partnered shops.

2. How We Use Your Information

We use the information collected for the following purposes:

• To provide our services: Creating and managing your account, delivering digital receipts, and personalising your experience.
• To improve the App: Using analytics to identify usage trends and enhance functionality.
• To support partnered shops: Sharing relevant data with shops to improve receipt quality and service and to help our partnered shops better understand their customer demographics.
• To comply with legal obligations: Fulfilling legal and regulatory requirements.
• To prevent abuse of our systems: Identifying irregularities in IP addresses, devices and locations of user sign-in and activity to help prevent malicious and unauthorised access and account abuse.

Our lawful bases for using it

Data protection law requires us to have a lawful basis for each of the purposes above. Ours are:

• Performance of a contract (Article 6(1)(b)): Creating and managing your account, receiving the digital receipts that partnered shops issue to you, and making them available to you in the App. Without this information we cannot provide the service you have asked for.
• Legitimate interests (Article 6(1)(f)): Keeping your receipts available for the period described in section 5, so that you keep a durable record of your purchases; giving partnered shops the aggregated demographic insight described in section 3.1; improving the App, including analysing how it is used; presenting you with content appropriate to your age; and protecting our systems, our users and our partnered shops from fraud, abuse and unauthorised access.
• Consent (Article 6(1)(a)): Analytical cookies on the Crumple website. You give this through our cookie banner and can withdraw it at any time using the "Cookie preferences" link in the footer — see our Cookie Policy. Where we ask for your consent for anything else, we will tell you at the time.
• Legal obligation (Article 6(1)(c)): Responding to valid requests from courts, law enforcement or a regulator, and keeping any records the law requires us to keep.

Where we rely on legitimate interests, we weigh those interests against your rights and freedoms before proceeding. You can ask us for more information about that assessment, and you can object to the processing at any time — see section 4.4.

3. Data Sharing and Disclosure

Your data may be shared in the following instances:

3.1 Partnered Shops

Your data may be shared with partnered shops to deliver digital receipts and provide analytics.

3.2 Third-Party Service Providers

We use a small number of third-party providers to operate the App and the Website. Each processes data on our behalf for the purpose described, and each is contractually obliged to do so securely and in compliance with applicable laws:

• Google Firebase: Authentication, database and file storage for your account and receipt data.
• Google Analytics: Usage analytics and engagement measurement, as described in section 1.3.
• Resend: Delivery of transactional email, including receipts emailed to you by a shop and messages about your account such as email verification and password resets.
• Google reCAPTCHA: Protecting sign-in and account security flows against automated abuse.

We may change these providers, or add others, where necessary to operate or improve the service. The current list is maintained in this Privacy Policy.

3.3 Legal Compliance

We may disclose your personal data if required by law or in response to valid legal requests, such as subpoenas or court orders.

3.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our business, your information may be transferred to the relevant third party. We will notify you of any such change through the App or by email.

4. Your Rights

As a data subject under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights regarding your personal information:

4.1 Access and Portability

You may request access to the personal information we hold about you, information about how we process it, and a copy of it in a portable format.

4.2 Correction and Deletion

You can request corrections to inaccurate or incomplete data, or deletion of your personal information, subject to applicable legal obligations. Please view our Deletion Request page for more information, and section 5 below for what happens to your receipts.

4.3 Restriction of Processing

You may request that we restrict the processing of your personal information in certain circumstances, such as while a dispute about its accuracy is being resolved.

4.4 Objection to Processing

You may object to the processing of your personal information where that processing is based on our legitimate interests. We will stop processing unless we have compelling grounds to continue. Website analytics are handled separately, by consent: you can turn them off at any time using the "Cookie preferences" link in the footer, as described in our Cookie Policy.

4.5 Withdrawal of Consent

Where processing is based on your consent, you may withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before you withdrew it.

To exercise any of these rights, please contact us using the details provided in the "Contact Us" section.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk if you believe your personal information has been processed unlawfully.

5. Data Retention

We retain your personal information only for as long as necessary for the purposes outlined in this Privacy Policy or as required by law. Specific retention periods include:

• Account and profile data: Retained for as long as your account is open, and for a reasonable period after closure to handle any outstanding queries or legal obligations.
• Receipts: Receipts issued to you through the Crumple receipt service are retained for a minimum of six years from the date of issue, as records of genuine transactions. How far back your account lets you browse is a separate matter: a free account may be limited to the most recent two years, with a paid subscription opening up the full history. Receipts outside that window are not deleted, and you can always request a copy of them under section 4.1 free of charge. Receipts older than two years may also be held in archival storage, in which case they may be excluded from summaries, totals and bulk exports, and bulk retrieval may take up to 30 days.
• Technical and security data: IP addresses, device information and sign-in records are retained for a limited period for the security, fraud-prevention and abuse-prevention purposes described in section 2.
• Usage and analytics data: Retained in aggregated or non-identifiable form for as long as it remains useful for the purposes described in section 1.3.

Receipts after a shop closes its Crumple account

A receipt in your Crumple wallet is your record of a transaction with the shop that issued it. If that shop later closes its Crumple account, receipts it has already issued to you remain available to you, and the retention commitment above continues to apply to them. Closing an account stops new receipts being issued; it does not withdraw receipts already given.

Receipts when you close your account

When you close your account, your personal information is deleted. Your receipts are not deleted: the transaction data within them is used by the shop that issued them for its own sales records, tax and legal purposes. Those receipts are unlinked from you, so that no personally identifiable information is retained connecting you to them.

You will no longer be able to access those receipts once your account is closed, so please save copies of any you need for proof of purchase, returns, tax or bookkeeping before your deletion request completes. Please view our Deletion Request page for more information.

When data is no longer needed, it is securely deleted or anonymised.

6. Data Security

We implement industry-standard security measures to protect your personal information from unauthorised access, disclosure, alteration, or destruction. These include:

• Encryption of data in transit using TLS
• Secure storage of information within Google Firebase infrastructure
• Access controls limiting who can reach your personal information
• Multi-factor authentication (MFA) support to help protect your account
• Regular security audits and monitoring

Despite these efforts, no method of transmission or storage is 100% secure. Therefore, we cannot guarantee absolute security. You can help protect your account by using a strong, unique password and keeping your credentials to yourself.

Security incidents

If we become aware of a breach of security affecting your personal information, we will notify the Information Commissioner's Office where we are required to do so. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay, and tell you what happened, what information is affected, and what we are doing about it.

7. Children's Privacy

The App is not intended for children under the age of 13. We do not knowingly collect personal information from children. If we become aware that a child’s information has been collected without parental consent, we will take steps to delete it.

8. International Data Transfers

Your information may be processed and stored on servers located outside the United Kingdom, including within the European Economic Area and the United States, via the service providers listed in section 3.2 (primarily Google Firebase).

We ensure that all international data transfers comply with UK GDPR requirements, including relying on appropriate safeguards such as adequacy decisions or standard contractual clauses where applicable.

For more information about how Google handles data, please refer to:

9. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable laws. Significant updates will be communicated through the App or via email. Please review this Privacy Policy regularly to stay informed of any changes.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us through:

• The Crumple app
• Our website: https://crumple.digital

By using the Crumple app, you acknowledge that you have read, understood, and agree to this Privacy Policy.