This policy explains what we do with your information when you have a Moonode Wallet card and a member page. The rest of moonode.com follows its own policy: moonode.com/terms.
1. In short
- We keep little: your first name, your stamps and anything you choose to add.
- Nothing is sold. No advertising. No trackers on your member page.
- Your information is kept in the cloud, in Europe.
- You can download or delete everything yourself, at any time.
2. Who is responsible
- By default, Moonode Inc., a Quebec company based in Montreal, Quebec, is responsible for your information.
- Some merchants choose to be responsible themselves. Their name and email then appear in the "Your data" block of your member page, and Moonode Inc. runs the card for them, under a written agreement.
- Moonode LLC, its parent company in the United States, only holds the Apple account that signs the cards. It receives none of your information.
- Person in charge of the protection of personal information at Moonode Inc.: support@moonode.com
3. What we collect and why
| Information | Why | Required |
|---|
| First name | to greet you, and to find your card at the counter | yes |
| Full name | to show it on the card, if you give it | no |
| Birth month and day (never the year) | to find your card at the counter if you change phones (section 4) | no |
| Email or, if the program uses text messages, phone number, asked after your first stamp | to send you a code to recover your card and, for an email, to warn you if it moves to another phone or email (section 4) | no |
| Stamps and rewards | to run the program | yes |
| Your card's scans at the counter (date and time, branch, result) | to keep your balance and rewards, and to prevent fraud | yes |
| Apple or Google, and your language | to produce the right card, in your language | yes |
| Update identifier and token provided by Apple Wallet, and whether the card is in Apple Wallet | to keep your card up to date, and to count installed cards | yes |
| Card issue date | to show "Member since" | yes |
| Day of your last member page visit (one day only, replaced at each visit) | to count active members | yes |
| Your choice about the merchant's offers | to respect that choice | yes |
| Branch and poster (QR code) of your sign-up, if you signed up yourself | to count sign-ups by branch and by poster | yes |
| Fingerprint of your phone's cookie, if you signed up or recovered your card online (never the cookie itself) | to recognize this phone if it comes back, and to limit the number of cards created from one phone (section 11) | yes |
| Version, language and date of the texts you accepted | to keep proof of your consent | yes |
| Reinstallations of your card on a new phone (date, means, branch) | to limit reinstallations and protect you against fraud | if you change phones |
Your card also gets a number (the QR code), a 6-character code (on the back) and a personal link. In your record, we never store that link in plain form; like any address you visit, it appears in plain form in our infrastructure's technical logs, kept for 30 days at most (section 8).
If the merchant offers it, you can also choose "Keep my card on this phone": your card then stays a web page on your phone, which shows its QR code, to present at the counter, and its 6-character code, which stands in for the code on the back. Apple and Google are not involved and do not receive this card; we record "web card" instead of Apple or Google.
If the merchant offers it, you can also tap "Add to the Moonode app" on your member page. The Moonode app then keeps your card on your phone, with no link at all to your Moonode account if you have one. The home screen widget shows neither your first name nor the QR code. In the app and on the widget, a card from a mosque or a faith-based organization (section 14) appears as "Member card", without the program's name or logo, until you choose to show that name. If your card is deleted, the app also erases it from your phone, along with its widget.
We collect this information from you only: when your card is created, in person or through the sign-up form, when you receive stamps, when you use your member page and when you recover your card.
Each card is a separate record, specific to one merchant's program. If you have cards with several merchants, we do not link them together, even if you give them the same email, and each merchant sees only its own card.
4. Lost or new phone
- Your balance is kept on our servers, not on your phone.
- If the merchant offers recovery, your member page suggests, after your first stamp, that you add your email or, if its program uses text messages, a Canadian or US phone number. It is optional, a card keeps only one, and nothing is sent to you at that point.
- This email or number is only used to send you a one-time code to reinstall your card with its stamps on a new phone. An email is also used to warn you when your card is reinstalled on another phone at the counter or by us, and when that email is removed. If the merchant turns it on, an email is also used to send you a reminder after a long absence (section 10); never to send you the merchant's offers, which only reach the card itself.
- We keep it encrypted. The merchant and its staff never see it; your member page and our tools only show a masked part of it. You can remove it yourself at any time, with the code on the back of your card.
- If the merchant offers recovery, its staff can also find your card at the counter with your first name and your birthday (day and month), if you gave it. They type this information: they never see the birthday on record.
- Once reinstalled, your card has a new QR code, a new code on the back and a new link: the old phone can no longer use it.
5. What we do not collect
- No IP address in your record. It is used to block abuse and stays at most 30 days in our technical logs. Our image delivery service also sees it when your phone loads an image.
- No location. The card has no feature to locate you, identify you without your knowledge or profile you.
- No identifier of your device other than Apple Wallet's and the fingerprint of your phone's cookie (sections 3 and 11), none of your contacts, no birth year, no postal address, no payment data, and no email except the one you add to recover your card (section 4) or if you write to us.
- No history of your taps: we count taps per button, for all members together.
- No automated decisions about you.
6. Who receives your information
- Apple: with Apple Wallet, your card is a file on your phone, and in iCloud if you use it. To update it, we send Apple an empty signal with your Wallet's token, and nothing else.
- Google: with Google Wallet, Google keeps your card: the name shown, your stamps, the card code and link, the QR code number and the program name.
- The merchant: overall statistics only, never your record, unless the merchant is itself responsible for your information (section 2). At the counter, its staff see your first name and your stamps, the list of the latest scans at their branch (time, first name, result) and, to find your card, since when you have been a member; never your email, your number or your birthday on record.
- Our providers, bound by contract: hosting, image delivery, email (including sending recovery codes and security notices) and, if the program uses text messages, text messaging.
- At Moonode Inc., only the people who administer the service have access, each with a personal account.
- We never sell, rent or trade your information.
7. Where your information is kept
Our servers and backups are in the cloud, in Europe. Google keeps Google Wallet cards, including in the United States. Recovery emails are sent through an email provider in Canada. If you give a phone number, it goes through a text messaging provider that may be outside Quebec. Your information may therefore be communicated outside Quebec, with protective measures, including by contract.
8. How long
| What | How long |
|---|
| Your card and its information | while it is active; deleted after 24 months with no activity at all |
| At your request | deleted right away from your page, or within 30 days by email |
| Recovery email or number | with the card, or until you remove it |
| Recovery code request | 24 hours |
| Counter scans and corrections that changed your balance or handed over a reward | with the card |
| Refused scans and checks at the counter, and the record of a reinstallation, in the program's log | 90 days |
| A scan made without network, on the counter device | until it is sent when the network returns; after 24 hours it is no longer counted |
| Backup copies and technical logs (including the address of a visited page, such as your personal link) | 30 days |
When your card is deleted, we erase your information from your Google Wallet card, then deactivate it. Each card is a separate record: deleting it erases everything about it, including your recovery email or number. An Apple Wallet card is a file on your phone: it keeps the name shown until you remove it from your Wallet.
9. Your rights
You can access your information and get a copy, have it corrected or deleted, receive it in a common format (JSON) and withdraw your consent, for example to offers.
- On your member page, "Your data" block: "Stop receiving messages", "Download my data" and "Delete my card and my data". Downloading and deleting ask for the code on the back of your card.
- Or by email to support@moonode.com, describing your card (program, first name, code on the back).
We answer in writing within 30 days at most, free of charge. To make a complaint, write to support@moonode.com: we acknowledge it within 2 business days and answer in writing within 30 days at most. If our answer does not satisfy you, you can contact Quebec's Commission d'accès à l'information (cai.gouv.qc.ca) within 30 days.
10. Messages on your card
- Card updates (stamp added, reward ready) are always sent to you.
- The merchant's offers reach you as long as you are an active member (at least one visit in the last 24 months) and you have not stopped them; each one says who sends it, and "Stop the offers", on your member page, turns them off in one tap.
- If the merchant turns it on and you gave an email, a reminder after a long absence reaches you the same way; "Stop the reminders" turns them off the same way, and every email also offers a one-click unsubscribe.
- "Stop receiving messages", on your member page, turns off both at once and takes effect immediately.
11. Cookies and trackers
Your member page and the sign-up and recovery pages use no advertising cookies and no audience measurement tools. Your language and theme choice may be kept in your browser, as well as your "Later" choice when your member page suggests securing your card (14 days). We count visits and taps on our own servers, as totals only.
The sign-up and recovery pages use three cookies, which no script on the page can read:
| Cookie | Why | How long |
|---|
| Your phone's cookie | to offer you your card if you come back to the sign-up page, and to limit the number of cards created from one phone | 400 days at most |
| Download | to hand your Apple Wallet card to this phone only | 15 minutes |
| Card choice | after a correct recovery code, to reinstall the card you choose | 10 minutes |
Your phone's cookie is never set by simply visiting a page: only when you tap the button to add the card or when you recover your card, and the text under the button says so beforehand. We only keep a one-way fingerprint of it, different for each program, never the cookie itself. "Forget this phone", offered on these pages when they recognize your phone, deletes it; you can also delete it in your browser settings.
12. Security and incidents
- Your link cannot be guessed, and in your record we only keep it in encrypted form; it does appear in plain form, like any address visited, in our infrastructure's technical logs, kept for 30 days at most (section 8). Your page only shows your first name, never your full name or your codes, except the QR code and the 6-character code of a web card (section 3).
- Connections are encrypted and access to our admin tools is limited.
- Adding or removing a recovery email or number requires the code on the back of your card, and the removal of an email is reported to that address. A recovery code is valid for 10 minutes and 5 tries.
- If a confidentiality incident creates a risk of serious harm to you, we notify you and the Commission d'accès à l'information.
- No measure is perfect: do not share your link and keep your phone locked.
13. Under 14
The card is for people aged 14 and over. Under 14, a parent or guardian must consent. If a card was created without that consent, write to us and we will delete it.
14. Religious organizations
A card from a mosque or a faith-based organization can reveal a religious belief. For these programs, the card is automatic: first-name card, discreet card, no checkbox, and your membership is never used to target you. The subject and sender of a recovery email never carry the name of these programs, and a text message never names any program.
15. Changes
We post any change to this policy on this page, with its date, and announce it on your member page before it applies.
16. Contact us
Person in charge of the protection of personal information, Moonode Inc., Montreal, Quebec, Canada
support@moonode.com