Privacy policy

Smyl is a product of Sternpay Inc. Ltd, a company registered in England and Wales. Sternpay Inc. Ltd (“Smyl”, “we”, “us”) is the controller of the personal data described here, except where we say we act for a shop. Smyl is a financial technology product, not a bank. You can reach us about anything in this policy at hello@smylpay.com.

This policy covers the Smyl app, smylpay.com, shop pages, the shop dashboards at smyl.dev, and the emails we send.

Sternpay Inc. Ltd, company number 15075172, registered office 124 City Road, London EC1V 2NX.

Searching

We record what was searched, the rough area it was searched from (roughly 100 to 150 km across, never your position), and how many shops it found. That shows shops what people want and shows us which searches need fixing. Searches are not linked to your name or account. To stop abuse, we give the app a random code when it first needs one, which it keeps for 30 days. We don’t store the code itself: we store a scrambled version, use it only to limit how often one phone can search, look up postcodes or ask for sign-in codes, and to count each phone once a day in Popular near you, and delete it 2 days after the app last used it.

Your location

If you allow it, the app uses your location to show how far shops are. It is rounded to about 110 metres on your phone before it is sent, used for that search, and not stored. You can switch it off in your phone’s settings. Instead of your location, you can type a postcode: we look it up when you type it and again each time the app opens (only the postcode is sent, to postcodes.io). Only the postcode is kept on your phone, never its position, and not by us. Signing out or deleting your account removes it from the phone. We keep a list of postcodes we’ve looked up (never who looked them up) for 30 days, so we don’t have to ask postcodes.io again.

We keep only a rough area, never your position. For Popular near you, we count which library items were searched in an area about 20 km across, and delete those counts after 2 days. When you ask to be told about something, we keep that rough area with the alert so we can tell you when a shop near you lists it.

The search on smylpay.com works the same way. You type a postcode, which we look up once (only the postcode is sent, to postcodes.io), or let your browser share your location. The position is rounded to about 110 metres, used only to show distances on that page, and not stored. What you search for on the website is not recorded. To stop one visitor using up everyone’s postcode lookups, we count lookups per scrambled code made from your IP address (for IPv6, from the first part of it that identifies your connection), never the address itself, as described under Abuse limits.

Your account

You sign in with your email address and a one-time code. We keep your email address, the name you choose to show, the shops you follow, the items you ask to hear about, whether you asked us to tell you when paying by bank is on near you, and your notification settings.

Your Smyl code

The app shows a code for staff to scan at the counter, which sends the sale to your phone for you to approve with your bank. Each code is random, stops working within about 10 minutes, and only links the scan to your account. We delete old codes within the hour.

Paying with Smyl

When you scan a shop’s code, our regulated payment provider asks your bank to send the payment, and you approve it in your own banking app. We never see or store your bank login. We receive and keep the amount, the shop, the time, whether the payment succeeded, the payment reference, and, where your bank provides them, the name and account details of the account you paid from. We use those to show your receipt, to send refunds back to the right account, and to prevent fraud. The payment provider also handles your data under its own privacy policy, which you’ll see before you pay for the first time.

Receipts

Each payment creates a receipt in your Smyl history: the shop, the items and prices if the shop rang them up, and the total. Receipts are made at the moment you pay and don’t change if the shop later edits its catalogue.

Smyl points

You earn 1 point for every whole £1 you pay by bank with Smyl, up to daily limits for each shopper and each shop that stop misuse. You can spend them at the counter to take money off a sale, if you choose to at checkout; at least £1 of every sale is still paid by bank. We keep your points total and a record of each change to it with your account. Points expire if you don’t earn or spend any for 12 months. Earning or spending any points starts the 12 months again. The 12 months pause while points can’t be spent anywhere on Smyl. We’ll remind you at least 30 days before. The reminder is a notification, or an email if your phone isn’t set up for notifications, and an expiry is recorded in your points history. Your points total goes when you delete your account. Receipts, including the points they earned and spent, are kept for 6 years without your name.

Smyl pays the shop the value of the points you spend, from Smyl’s own money, through our payment provider. The shop sees the points used on that sale and their value. If a purchase is refunded, the points you spent on it come back to your balance and the points it earned are taken back. We keep a record of what we paid each shop for 6 years, as accounting law requires.

What a shop sees about you

When you pay a shop, or a shop scans your Smyl code, that shop sees your display name and your purchases from that shop: what, when and how much. It uses this for its own sales records and to issue refunds. Smyl doesn’t turn it into a customer list, visit history or notes about you. For these records we act on the shop’s behalf, and the shop is responsible for how it uses them. A shop never sees your email address, your bank login, your other shops, or whether you follow other shops. Shops see how many people follow them, never who. As with any bank transfer, the payment usually appears on the shop’s bank statement with the name on your bank account.

Reviews and reports

You can review a shop you have paid. Your review, your display name and its date are public on the shop’s page, and the shop can reply publicly. If you report a review, post or shop, we keep the report, what it was about and our decision. The person or shop involved is told our decision and the reason, but never who reported it. You are told what we decided about your report too, in the app, or by email if your phone isn’t set up for notifications. If you delete your account while we are still looking at a review you wrote, or while our decision on it applies, we keep that review hidden, without your name, until the decision no longer applies, and never for more than 12 months after you delete your account.

Applying

When you apply on smylpay.com we receive your shop’s name, address, postcode, category and description, your name, email address and phone number, and anything else you choose to tell us in the last box. We use them to contact you and set up your shop. We keep notes of the calls, emails and visits we have with you, from your application onwards, so anyone at Smyl who helps you knows what has been agreed.

Your shop page

Once your shop is on Smyl, we publish its name, street address and postcode, map position, description, opening hours, categories, catalogue, prices, availability and posts, on a public page and in search, and any photos you add, on your page only, never in search. Photos are resized in your browser before they are sent, which removes the location and camera details stored inside them. We show a phone number only if you give us one for shoppers; the contact number on your application stays private to Smyl. If you trade from home, tell us and we’ll agree with you what to show.

Claiming a shop Smyl listed

To claim a shop Smyl listed, you sign in with your email and ask us to check it’s your shop: we keep your name, your role at the shop, the phone number you give us and anything you add, so we can call you or visit. We don’t send text messages, so we don’t use the shop’s phone number for this. We record who claimed each shop and how, so we can undo a claim that wasn’t genuine.

Checking a business before it takes payments

To switch on Pay by Bank, banks and the law require us to check who owns the business. The owner gives us the business’s details, their own name, date of birth and home address, a photo of their passport or driving licence, and the bank account payments should go to. Sometimes we also ask for a document showing the shop trades at its address, such as a business rates bill. Smyl’s review team checks them, and we share only what is needed with our verification and payment providers to confirm the business (see Verification before taking payments). Every time a reviewer opens an ID photo it is recorded. We never show any of it on the shop’s page or to the shop’s managers or staff. Photos (not PDFs) are re-encoded in the browser before they are sent, which removes the location and camera details stored inside them. Smyl’s review team deletes the ID photo and any such document once the application has been decided, or after about 30 days if it isn’t finished. We keep the decision and the business details for 5 years after the business stops taking payments with us, or 5 years after we decide if payments were never switched on.

Owners and staff

For each person on a shop’s team we keep their name, the email they sign in with and their role (owner, manager or counter staff). The shop’s owners can see the names, roles and sign-in emails of everyone on their team. An invite holds the invited email address until it is accepted or expires.

We email each person on the team about their shop: a refund that didn’t go through, a new review, items running low and a weekly look at their top items, and, only if they turn it on, news from Smyl. Each person chooses which of these they get in their own notification settings, and can turn any of them off. These emails never name a customer.

Smyl’s support staff can look up a shopper’s account to help them or a shop: their receipts, reviews and reports. Every lookup is recorded, and only Smyl’s admins see a full email address. If you ask us to delete your account, an admin deletes it the same way you could in the app.

When someone reports a problem with a payment, our staff keep notes on it, seen only by Smyl staff. They refer to the payment, not to you by name, hold only what’s needed to sort it out, and are kept as long as the payment record they belong to, even if you delete your account.

Verification before taking payments

Before a shop can take payments, we and our verification and payment providers check the business and the people behind it. That can include company details from Companies House, the names, dates of birth and home addresses of owners and directors, a photo of an identity document, and proof that the bank account belongs to the business. We do this to prevent fraud and protect shoppers, and keep the records for 5 years after the shop stops taking payments with us, or 5 years after we decide if payments were never switched on. We don’t carry out criminal record checks.

Sales, customers and insights

A shop’s sales, refunds, follower figures and insights are private to that shop and its team. Shops see how many people follow them, never who. Other shops can never see them. Insights about searches are about products and areas, never about named shoppers.

When you follow a shop and one of its posts is on your screen in the app for a second, or you open its notification, we note that you saw it. The shop sees only a total, such as “Seen by 12 of 40 followers”, and no total at all while it has fewer than 5 followers. It never sees who. The note that you saw a post is deleted after 14 days.

• Contacting us. When you contact us through the app, the website or the Back office, we keep your message, your email address, what it’s about, anything you link to it (such as a receipt or a sale), and our replies. Only Smyl staff can read them. If you email a reply, a member of staff copies it into your request. If a message looks like it contains a card number, bank details or a sign-in code, we hide that part before we keep it. We keep these for 2 years after the request is closed, then delete them. If you delete your Smyl account, we remove your email address and name from your requests; when a shop was involved, we keep the message text so the shop’s records still make sense. The website form uses Cloudflare Turnstile to check you’re not a bot.
• Using our website and dashboards. Like any website, ours receives your IP address and browser details. Cloudflare uses them to deliver pages, block attacks and run the bot check on our forms, and keeps short-lived request logs.
• Abuse limits. To stop floods of emails and form spam we count requests per email address using scrambled codes, not the address itself, and delete each count at our next daily clean-up after its limit’s period ends (from a minute to 30 days; most are a day). Postcode lookups on smylpay.com are counted the same way per visitor: our website turns your IP address (for IPv6, its first 64 bits) into a scrambled code with a secret key, and we store only that code with an hourly count. It is never linked to anything else about you, and it is deleted at the next daily clean-up after the hour ends. When an email address is new to Smyl, the app first asks for a one-time permission to send it a code, stored the same scrambled way and deleted within a day. A request for a code without that permission is answered in the usual way but no email is sent; we keep a scrambled note of it so we know not to send one, and delete it within a day. Failed sign-in attempts are counted against the email address for a short time, to stop anyone guessing codes. We also keep a record of how past reports from an account were decided, to weigh new reports fairly.
• Talking to us. If you email us, we keep the conversation so we can help you and look back at it if you get in touch again.
• Where it comes from. Mostly from you. Some comes from others: your bank and our payment provider (payment details), Companies House and our verification providers (business checks), a shop (when it scans your Smyl code or refunds you), and other users (when they report something).
• What you have to give us. Search needs nothing. An account needs an email address. Paying needs your bank’s approval. Applying needs the details on the form, and taking payments needs the verification details. Without them we can’t provide that part of Smyl; everything else is optional.
• When something goes wrong. If the app or one of our sites hits an error, we record what went wrong: the error message, the page or screen, the app version and the time. We remove anything that could identify you before saving it, and we delete these records after 30 days. We use them only to fix problems.
• Staff actions. When someone at Smyl changes a shop’s information, moderates content or acts on an account, it is recorded with their name so we can check it was proper.

Smyl serves independent shops of every kind across the UK, including grocers for particular communities, halal butchers, religious bookshops and pharmacies. Where you shop, what you buy and who you follow can suggest your background, your faith or your health, even though you never told us. We treat that information with the same care as if you had: we never use it to profile you, never use it to target adverts, never sell or share it beyond what this policy describes, and never show one shop what you do at another.

UK data protection law requires a lawful basis for each use of personal data. Ours are:

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time (see your rights).

Shops see what section 3 describes and nothing more. The public sees shop pages, reviews and replies. Our providers process data for us under contracts that limit what they can do with it, and the regulated payment and verification providers also act under their own legal duties:

We also share information when the law requires it, for example with the police, HMRC or a regulator, or to protect someone’s safety, and only as much as is needed. If Smyl or Sternpay Inc. Ltd were ever sold or merged, your data would pass to the new owner under the same promises, and we would tell you first.

• Sell your data, or let anyone buy access to it.
• Use what you buy, search or follow to target adverts at you, here or anywhere else.
• Show one shop what you do at another, or who follows a shop.
• Show prices in search results, or rank shops by who is cheapest.
• Hold your money. Payments go straight from your bank to the shop’s.
• Make decisions about you by computer alone that have legal or similarly serious effects.

Our database is in the European Union (Ireland), which the UK recognises as protecting data adequately. Some providers, such as Cloudflare and the push notification services, operate worldwide. Where your data leaves the UK or the EU, it is protected by the safeguards UK law requires, such as adequacy regulations or the UK International Data Transfer Addendum to the EU standard contractual clauses.

We keep data only as long as we need it, then delete it automatically:

• Everything travels encrypted, and is encrypted where it is stored.
• Every request for a shop’s private information checks that the person asking belongs to that shop and has the right role. We test this against attempts to cross from one shop to another.
• Only the Smyl staff who need it can see private information, and what they change is recorded.
• Sign-in uses one-time codes, so there are no Smyl passwords to steal.
• We never receive bank logins or card numbers.

If something ever goes wrong with your data in a way that puts you at risk, we will tell you and the Information Commissioner’s Office as the law requires.

You have the right to:

• Get a copy of the personal data we hold about you.
• Correct it if it is wrong or incomplete.
• Delete it. Delete your Smyl account in the app (Account, then Delete my account), which happens straight away, or email us and we will do it within 30 days. Some records, such as payments, are kept for the periods above without your name.
• Object to anything we do on the basis of legitimate interests.
• Restrict how we use it while a concern is being looked at.
• Take it with you, in a format other services can read.
• Withdraw consent at any time, where we rely on it.

To use any of these rights, email hello@smylpay.com. It is free, and we reply within one month. We may ask you to confirm who you are first. For records a shop keeps about you, such as its sales records, we will help the shop answer you.

• Push notifications. Where your phone allows them (some Android phones allow them from install), we send what answers something you did: sales and refunds, items you asked about, replies to your reviews, and what we decided about something you reported or a review of yours. Posts from shops you follow come only after you say yes to them in the app. Posts, alerts, replies and report outcomes wait until morning between 9pm and 8am. We keep a code for each phone so we can reach it. Notifications stop when you sign out, and the code is deleted then, the next time the app opens, or within a day once your sign-in has ended (for example if you signed out without signal); deleting your account deletes it at once. A code from an older version of the app that never recorded its sign-in is deleted after 180 days unused. A notification never says anything about other shoppers, and one shop’s posts never reach another shop’s followers. We keep a copy of what each notification said for 30 days, to answer “I never got it” questions.
• Emails. We send sign-in codes, invites, receipts you ask for and messages about your account. We send marketing emails only if you have said yes, and every one has a way to stop them.
• Cookies and similar storage. We don’t use advertising or tracking cookies. Our sites store only what they need to work: keeping you signed in to a dashboard, remembering settings, and the bot check on our forms. These don’t need your consent because the site can’t work without them. The Cookies page lists each one. To see how many people visit smylpay.com and which pages help them, we use Cloudflare Web Analytics. It doesn’t use cookies or store anything on your device, doesn’t follow you to other websites, and gives us only totals, such as page views by country. We don’t use it in the Smyl app.

You must be 13 or over to have a Smyl account, and paying with Smyl needs a UK bank account in your own name. Anyone can search without an account. If you think a child under 13 has given us their data, tell us and we will delete it.

When we change this policy we update the date at the top. If a change matters to how your data is used, we will tell you in the app or by email before it takes effect.

Questions, requests or worries about your data: email hello@smylpay.com, and someone at Smyl will answer.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We’d appreciate the chance to put it right first.