Legal

Privacy Policy

Last updated 1 August 2026

This policy explains what One Bonus collects, why, who sees it, and the control you have over it. It covers the shopper app, the merchant app and onebonus.am.

1. Who controls your data

Vector IT LLC (“One Bonus”) operates the platform and is the controller of the data described here.

A merchant you join is a separate controller for the customer record it holds about you — your name, phone number, purchase history with that merchant and your balance with it. If you want that record corrected or erased by the merchant, you can ask us and we will pass it on, or you can ask them directly.

2. What we collect

We do not collect your card number or bank details. Purchase amounts reach us only as a total, entered by the merchant or sent by their point-of-sale system to calculate points. We do not track your location in the background.

3. How we use it

• To run the loyalty programs you have joined and to keep your balances correct and auditable.
• To show you your card, your history, and offers from merchants you are a member of.
• To send you notifications about your account — points earned, a reward ready, points about to expire. Marketing and offer notifications are separate and can be turned off per category in Settings.
• To detect and prevent fraud, farming of promotions, and unauthorised access.
• To produce aggregate analytics for merchants. Merchants see their own customers, never another merchant’s.
• To meet accounting and legal obligations.

We do not sell your personal data, and we do not use it to build advertising profiles for third parties.

4. Who sees your data

• Merchants you join. A merchant sees the customer record for their own business: your name, phone, your activity with them, your balance and tier. A merchant never sees your activity with a different merchant.
• Service providers that we use to operate the platform, under contract and only for that purpose: cloud hosting, Firebase Cloud Messaging (push notifications), Apple and Google Wallet (if you add your card), an email delivery provider, and phone verification. Where the shopper support chat is used, the conversation is relayed to our support operators.
• Authorities, where we are legally required to disclose.

Some of these providers operate outside Armenia. Where data is transferred abroad we rely on the provider’s contractual data-protection commitments.

5. How long we keep it

• Account data — while your account is open. When you close it we delete or anonymise your profile.
• Loyalty ledger entries — retained after closure in a form that no longer identifies you, because a balance ledger must stay internally consistent and reconcilable.
• Session and device records — expired sessions are purged automatically; a short grace window is kept to investigate suspicious sign-ins.
• Records we must keep by law — accounting and tax records, for the period the law requires.

6. Your rights

You can:

• see and correct your profile in the app;
• ask for a copy of your data;
• close your account, which deletes or anonymises your personal data (Settings → Close account);
• withdraw consent for optional data such as date of birth or gender;
• turn notification categories on or off;
• see every device signed in to your account and revoke any of them;
• object to processing based on our legitimate interest;
• complain to the data-protection authority in your country.

To exercise any of these, write to vectoritllc@gmail.com. We respond within 30 days.

7. Security

Traffic is encrypted in transit. Passwords and PINs are stored only as one-way hashes — we cannot read them. Access to production data is restricted, and every administrative action is written to an audit log. Sign-in attempts are rate-limited and lock after repeated failures. Balance changes are append-only, so a change cannot be made without leaving a record.

8. Children

One Bonus is not intended for children under 16. If you believe a child has given us personal data, contact us and we will delete it.

9. Cookies and the website

onebonus.am uses only the storage needed to make the site and the admin console work — for example holding your language choice and an administrator’s signed-in session. We do not run third-party advertising or cross-site tracking on it.

10. Changes

We may update this policy. The “last updated” date at the top always reflects the current version, and we will notify you in the app or by email before a material change takes effect.