Privacy Policy

Overview

Ruffus (operated by Boucle Technologies Inc., based in Québec, Canada) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information about you when you use our services — whether you're a merchant setting up a loyalty program or a customer collecting stamps.

We comply with Québec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25), Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA), and Canada's Anti-Spam Legislation (CASL). If you are located in the European Union, the rights described in this policy also satisfy the GDPR.

Information We Collect

We collect only the personal information necessary to provide the Ruffus service (the principle of data minimisation required by Law 25). This includes:

• Account information (name, email address, business name)
• Mobile phone number, when you sign in with a text-message (SMS) verification code or opt in to loyalty text messages
• Payment information (processed securely via our payment provider — we never store card numbers)
• Loyalty card activity (stamps collected, rewards redeemed, scan timestamps)
• Device and usage data (browser type, IP address, pages visited)

How We Use Your Information

• To provide and improve the Ruffus service
• To send transactional emails and service notifications
• To process payments and manage subscriptions
• To detect and prevent fraud or abuse
• To comply with legal obligations

Cookies & Tracking

We use cookies and similar technologies to keep you signed in, understand how you use our service, and improve performance. We do not sell your data to advertisers or use third-party ad tracking.

Any marketing or promotional emails we send are subject to CASL — you will only receive them if you have given express or implied consent, and every message includes a clear unsubscribe link. Transactional and service emails (account confirmation, billing receipts, security alerts) do not require marketing consent and cannot be opted out of while your account is active.

You can control cookies through your browser settings. Disabling cookies may affect your ability to use certain features of Ruffus.

Mobile Phone Numbers & SMS

We collect your mobile phone number when you create or access a Ruffus account using a text-message (SMS) verification code, and when you choose to receive loyalty text messages from a business you have joined. Verification codes and essential account notices are transactional — we send them whether or not you have opted in to promotional messages.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories of information exclude text messaging originator opt-in data and consent; this information will not be shared with or sold to any third parties or affiliates for marketing purposes.

Promotional text messages are optional. The consent checkbox shown at sign-up is never required to create an account or to receive a verification code, and it is unchecked by default. You can withdraw your consent at any time by replying STOP to any message, or by emailing privacy@ruffus.app. Message frequency varies, and message and data rates may apply.

Sharing Your Information

We do not sell your personal information. We may share it with:

• Service providers who help us operate Ruffus (payment processors, hosting, analytics)
• Law enforcement or regulators when required by law
• Acquirers in the event of a merger, acquisition, or asset sale

Your Rights

Under Québec's Law 25 and PIPEDA, and regardless of where you are located, you have the right to:

• Access the personal data we hold about you
• Request correction or deletion of your data
• Object to or restrict certain processing activities
• Data portability — receive your data in a structured, commonly used format
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
• Lodge a complaint with the Commission d'accès à l'information du Québec (CAI) if you believe your rights have been violated

To exercise these rights, email our Privacy Officer at privacy@ruffus.app.

Merchant Data Processing

When merchants use Ruffus to run a loyalty program, their customers' data (names, emails, stamp activity) is processed by Ruffus on the merchant's behalf. In this context, the merchant is the data controller and Ruffus acts as a data processor, handling that data only as instructed and as described in our merchant agreements.

If you are a customer of a business that uses Ruffus and wish to exercise your data rights, please contact that business directly. We will assist them in responding to your request as required by our agreements.

Artificial Intelligence (AI)

Ruffus includes an AI-powered support assistant in the merchant dashboard. When a merchant uses it, the messages typed into that conversation are sent, along with our public product documentation, to our AI provider (Anthropic) to generate a reply. The assistant has no access to account records, customer lists, or billing data.

We do not use personal information or loyalty program data to train artificial intelligence models, and our agreement with our AI provider does not permit it to train its models on what we send. If a conversation is escalated to our support team, the merchant reviews and confirms what is sent before it reaches us.

We do not use automated decision-making that produces legal or similarly significant effects about you. If we add further AI-assisted features that process personal information, we will update this policy before they go live.

Data Retention

We retain your personal information for as long as your account is active. After cancellation or account closure, a 30-day grace period applies — you will receive a warning email before anything is removed, and you can export your data during that window. After the 30 days, your data is permanently deleted or anonymised, unless we are required by law to retain it longer.

We also keep security and access logs — including a record of when a member's email address is disclosed to merchant staff — for up to 24 months, so that a later access request or complaint can be investigated. These logs are then deleted automatically.

Certain billing and financial records may be retained longer where required by law.

International Transfers

Ruffus is operated from Québec, Canada. Your information may be stored and processed in Canada or in other countries where our service providers operate (including the United States). As required by Québec's Law 25, we conduct a Privacy Impact Assessment (PIA) before transferring personal information outside Québec, to ensure it receives a level of protection equivalent to what is required here.

For EU users, we rely on appropriate safeguards such as Standard Contractual Clauses when transferring data outside the EEA.

Children's Privacy

Ruffus is not directed at minors under the age of 14. Under Québec's Law 25, we do not knowingly collect personal information from anyone under 14 without parental or guardian consent. If we become aware that we have inadvertently collected such information, we will delete it promptly. Please contact us at privacy@ruffus.app if you believe a minor has created an account.

Security

We use industry-standard encryption and security practices to protect your data. No method of transmission over the internet is 100% secure, but we work hard to protect your information against unauthorized access, alteration, disclosure, or destruction.

In the event of a confidentiality incident (data breach) that presents a risk of serious harm, we will notify the Commission d'accès à l'information du Québec (CAI) and all affected individuals as soon as reasonably possible, as required by Law 25.

Changes to This Policy

We may update this Privacy Policy from time to time. We'll notify you of material changes by email or by posting a notice on our website at least 15 days before the changes take effect. Your continued use of Ruffus after the effective date constitutes your acceptance of the updated policy.