Legal

Privacy Policy

Last updated 27 October 2026

This policy explains what One Bonus collects, why, who sees it, and the control you have over it. It covers the shopper app, the merchant app and onebonus.am.

1. Who controls your data

Vector IT LLC (“One Bonus”) operates the platform and is the controller of the data described here.

A merchant you join is a separate controller for the customer record it holds about you — your name, phone number, purchase history with that merchant and your balance with it. If you want that record corrected or erased by the merchant, you can ask us and we will pass it on, or you can ask them directly.

2. What we collect

We do not collect your card number or bank details. A merchant enters a card for the subscription on the payment processor’s page; we keep only its brand, last four digits, expiry date and the processor’s token. Purchase amounts reach us only as a total, entered by the merchant or sent by their point-of-sale system to calculate points. We do not track your location in the background or keep a location history.

3. How we use it

• To run the loyalty programs you have joined and to keep your balances correct and auditable.
• To show you your card, your history, and offers from merchants you are a member of.
• To send you notifications about your account — points earned, a reward ready, points about to expire. Marketing and offer notifications are separate and can be turned off per category in Settings.
• To detect and prevent fraud, farming of promotions, and unauthorised access.
• To produce aggregate analytics for merchants. Merchants see their own customers, never another merchant’s.
• To meet accounting and legal obligations.

We do not sell your personal data, and we do not use it to build advertising profiles for third parties.

4. Who sees your data

• Merchants you join. A merchant sees the customer record for their own business: your name, phone, your activity with them, your balance and tier. A merchant never sees your activity with a different merchant.
• Service providers that we use to operate the platform, under contract and only for that purpose: cloud hosting, Firebase Cloud Messaging (push notifications), Firebase Crashlytics (crash reports), Apple and Google Wallet (if you add your card), the payment processors ArCa and Idram (merchant billing), an email delivery provider, phone verification, and Google Analytics for website visits (only if you accept analytics cookies, see section 10). Where the shopper support chat is used, the conversation is relayed to our support operators.
• Authorities, where we are legally required to disclose.

Some of these providers operate outside Armenia. Where data is transferred abroad we rely on the provider’s contractual data-protection commitments.

5. How long we keep it

• Account data — while your account is open. When you close it we delete or anonymise your profile.
• Loyalty ledger entries — retained after closure in a form that no longer identifies you, because a balance ledger must stay internally consistent and reconcilable.
• Session and device records — expired sessions are purged automatically; a short grace window is kept to investigate suspicious sign-ins.
• Records we must keep by law — accounting and tax records, for the period the law requires.

6. Your rights

You can:

• see and correct your profile in the app;
• ask for a copy of your data;
• close your account, which deletes or anonymises your personal data (Settings → Close account);
• withdraw consent for optional data such as date of birth or gender;
• turn notification categories on or off;
• see every device signed in to your account and revoke any of them;
• object to processing based on our legitimate interest;
• complain to the data-protection authority in your country.

To exercise any of these, write to info@onebonus.am. We respond within 30 days.

7. Deleting your account

• One Bonus app — Settings → Close account.
• One Bonus Partner app or the business console — the owner emails info@onebonus.am.
• Without the app — email info@onebonus.am from the email address or phone number on the account.

We delete or anonymise the account and its personal data within 30 days, except the records listed in section 5.

8. Security

Traffic is encrypted in transit. Passwords and PINs are stored only as one-way hashes — we cannot read them. Access to production data is restricted, and every administrative action is written to an audit log. Sign-in attempts are rate-limited and lock after repeated failures. Balance changes are append-only, so a change cannot be made without leaving a record.

9. Children

One Bonus is not intended for children under 16. If you believe a child has given us personal data, contact us and we will delete it.

10. Cookies and the website

onebonus.am uses the storage needed to make the site and the consoles work — for example holding your language choice and a signed-in session.

If you accept analytics cookies, the public pages also load Google Analytics, which sets its own cookies (_ga) and sends Google the pages you view, your device type and your approximate location so we can count visits. Without your consent it does not load at all, and the merchant and admin consoles never load it. You can change your choice at any time with “Cookie settings” at the bottom of every public page; rejecting removes the Google Analytics cookies. We do not run third-party advertising on the site.

11. Changes

We may update this policy. The “last updated” date at the top always reflects the current version, and we will notify you in the app or by email before a material change takes effect.

This policy is published in English. If a translation conflicts with the English text, the English text governs.