Loyalty by BebraTech

This Privacy Policy describes how BebraTech ("we", "our", or "us") collects, uses, and protects information when you use the Loyalty by BebraTech Chrome browser extension (the "Extension").

The Extension integrates a customer loyalty management system into the Checkbox point-of-sale platform and the KeyCRM CRM system, enabling business operators to manage loyalty points, discounts, and customer bonuses directly within those platforms.

The Extension collects and processes the following categories of data:

Operator Authentication Data

• Business operator email address used to log in to the BebraTech ServiceHub platform
• Authentication tokens (JWT / API keys) issued by the BebraTech platform upon successful login
• KeyCRM API key entered by the operator in the Extension settings

Customer Loyalty Data (processed on behalf of the business operator)

• Customer full name and phone number — read from the Checkbox or KeyCRM interface
• Loyalty points balance, tier level, and transaction history
• Loyalty card identifiers (barcode / card number)
• Discount amounts applied to transactions

Technical & Session Data

• Extension settings and preferences stored locally
• API responses from Checkbox, KeyCRM, and BebraTech ServiceHub (temporarily in memory)

We use the collected data solely for the following purposes:

• Authenticating the business operator with the BebraTech ServiceHub API
• Retrieving and displaying the customer's loyalty profile, points balance, and transaction history
• Applying loyalty discounts and recording point transactions on behalf of the operator
• Identifying customers by scanning loyalty cards (barcode prefix "777")
• Synchronising loyalty data between Checkbox, KeyCRM, and the BebraTech platform

We do not use your data for advertising, profiling, or any purpose unrelated to the loyalty management functionality described above.

Authentication tokens and operator settings are stored locally in the browser using the Chrome Storage API (chrome.storage.local). This data never leaves the user's device except when transmitted to our API over encrypted HTTPS connections.

Customer loyalty data is fetched on demand from the BebraTech ServiceHub API and is held only in memory during the active session. It is not written to persistent local storage.

All communication between the Extension and external APIs uses TLS/HTTPS encryption. Sensitive credentials are not stored in plaintext or in insecure browser contexts.

The Extension communicates with the following external services:

• BebraTech ServiceHub (bebratechservicehub.bebra.tech) — our own platform that manages the loyalty program data, authentication, and business logic.
• Checkbox (checkbox.ua) — a Ukrainian point-of-sale platform. The Extension injects UI elements into Checkbox web pages to display loyalty information. No data is sent to Checkbox servers by the Extension directly.
• KeyCRM (keycrm.app) — a Ukrainian CRM system. The Extension reads customer data from KeyCRM pages and sends loyalty-related updates to the BebraTech API, not directly to KeyCRM servers (except via the operator's own KeyCRM API key).

Each third-party service is governed by its own Privacy Policy. We encourage you to review the policies of Checkbox and KeyCRM.

We do not sell, rent, or share personal data with third parties for marketing or commercial purposes.

Data may be shared only in the following limited circumstances:

• With the BebraTech ServiceHub API as necessary to provide the loyalty management service
• When required by applicable law, court order, or governmental authority
• To protect the rights, property, or safety of BebraTech, our users, or the public

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access – request a copy of your personal data we hold
• Rectification – request correction of inaccurate data
• Erasure – request deletion of your personal data
• Portability – receive your data in a structured, machine-readable format
• Objection – object to certain processing activities

To exercise any of these rights, please contact us at the address listed in the Contact section below.

Authentication tokens stored locally are retained until the operator logs out of the Extension or uninstalls it. Customer loyalty data processed during a session is not persisted locally and is discarded when the browser tab is closed or refreshed.

Server-side data stored in the BebraTech ServiceHub is retained for as long as the business operator's account is active or as required by applicable law. Upon account termination, data is deleted within 90 days.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. Continued use of the Extension after changes are posted constitutes your acceptance of the updated policy.

For significant changes, we will make reasonable efforts to notify users through the Chrome Web Store listing or other appropriate means.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Company: BebraTech
• Email: privacy@bebra.tech
• Website: https://bebra.tech

We will respond to all legitimate requests within 30 days.