Privacy Policy

Who we are

This Privacy Policy explains how your personal information is collected, used, shared, and protected when you use the Tiger mobile application (“Tiger”, the “App”, “we”, “us”, or “our”) on Android and iOS.

If you have any questions about this policy or your personal data, contact us at rutatiina@gmail.com.

Tiger is a loyalty and brand-discovery service. It lets you discover nearby brands and businesses, earn and redeem loyalty reward points, and shop from participating brands.

Scope of this policy

This policy applies to the Tiger mobile app and the services provided through it, including our backend services hosted at tiger.blendsnpearls.com. It does not apply to the separate privacy practices of third-party services we integrate with (such as Google, Apple, or your mobile network operator), which are governed by their own privacy policies.

Information we collect

Account and profile information

When you create and maintain an account, we collect:

• First name and last name
• Username
• Email address (and whether it has been verified)
• Phone number (and whether it has been verified)
• Date of birth
• Gender
• Profile photo
• Preferred language
• Country code and currency
• Account status and account creation/update dates

Loyalty and rewards information

To operate the loyalty programme, we collect and maintain:

• Reward points earned, redeemed, available, shared, donated, pending, issued, and declined
• Reward points balances and related transaction activity
• Reward redemption and reward-code activity

Location information

With your permission, we collect:

• Latitude and longitude
• Resolved street address
• Country code derived from your location

We use location to power location-based features such as finding nearby businesses, and we may store your most recent location on your profile. We only access your location while you are using the App; we do not track your location in the background. You can control or revoke location access at any time in your device settings.

Authentication and security information

To secure your account and detect fraud or unauthorised access, we log information about sign-in attempts, including:

• IP address
• User agent / browser name
• Device information, device type, and operating system name
• Session identifier
• Authentication method used
• Login outcome, reason, attempt counts, lockout status, and security flags
• Response time and source
• Timestamp, and location/longitude/latitude associated with the attempt
• One-Time Passwords (OTPs) used for verification

Device and technical information

• Device information (model, type, operating system)
• SIM information, used to support payment/USSD flows and device validation
• Phone state information, used for device/SIM validation and telephony features
• Firebase Cloud Messaging (FCM) token and push identifier, used to deliver notifications

Communications and preferences

• Email subscription preference
• SMS subscription preference
• In-app messages and unread message counts

Payment-related information

• Payments are processed via USSD through your mobile network operator and other configured payment channels.
• The App does not store your Mobile Money credentials, card numbers, or bank credentials.
• We perform a device-validation check before processing USSD payments to help prevent fraud.

Device permissions and why we use them

The App requests the following device permissions. You can grant or revoke most permissions at any time in your device settings; some features may not work without them.

Biometric authentication is performed entirely by your device’s operating system. Your biometric data never leaves your device and is never transmitted to us.

How we use your information

We use your information to:

• Create and manage your account and profile
• Authenticate you and secure your account (OTP, PIN, biometrics, and login-attempt monitoring)
• Award, track, redeem, share, and donate loyalty reward points
• Show nearby businesses and provide location-based features
• Process payments via USSD and other configured payment channels
• Send you transactional notifications and, where you have opted in, marketing communications (push, email, SMS)
• Detect and prevent fraud and unauthorised access

Where applicable law requires a legal basis for processing, we rely on: performance of our contract with you (providing the services); your consent (for example, location and marketing communications); our legitimate interests (security, fraud prevention, and improving the service); and compliance with our legal obligations.

How we share your information

We do not sell your personal information. We share data only as described below.

Service providers and integrated third parties. We use the following third-party services, which may receive or process certain data to provide their functions:

Participating brands and businesses. When you earn or redeem loyalty points at a participating brand, that brand may receive the information necessary to administer your reward, such as your name and the relevant transaction or reward-code activity.

Legal and safety. We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of our users, the public, or us.

Business transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Data storage, security, and retention

On your device. We store certain data locally on your device, including: encrypted secure storage for sensitive data such as tokens and your PIN (protected by your device keystore/keychain); a local cache of profile and app data; app preferences; and cached images.

On our servers. Your profile, rewards data, login-attempt audit records, and messages are stored on the Tiger backend (tiger.blendsnpearls.com).

Security. We use industry-standard measures including encrypted transport (HTTPS), encrypted on-device storage of sensitive credentials, OTP and PIN verification, optional biometric locking, and login-attempt monitoring with lockout. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Retention. We keep your personal information for as long as your account is active and as needed to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or anonymise your personal information as described below, except where we are required to retain certain records (for example, limited security or transaction records) to comply with legal obligations or prevent fraud.

International data transfers

Some of our service providers (including Google and Apple) process data internationally. Where your data is transferred outside Uganda, we take steps to ensure it is protected in a manner consistent with this policy and applicable law.

Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Delete your personal information
• Object to or restrict certain processing
• Withdraw consent (for example, for location or marketing) at any time
• Request a portable copy of your data

You can exercise these rights by contacting us at rutatiina@gmail.com, or for many actions, directly within the App. We will respond within the timeframe required by applicable law.

Users in Uganda have rights under the Data Protection and Privacy Act, 2019. Users in other jurisdictions (such as the European Economic Area or the United Kingdom) have the rights granted to them under their local data-protection laws.

Account deletion and data erasure

You can request deletion of your account and associated personal information at any time by:

• Using the delete account option within the App (in your account settings); or
• Submitting a request at tiger.blendsnpearls.com/delete-account; or
• Emailing rutatiina@gmail.com.

When you delete your account, we delete or anonymise your personal information, except where we are required to retain certain records to comply with legal obligations, prevent fraud, or resolve disputes.

Communications and marketing

You have separate email and SMS subscription preferences stored on your profile. We send transactional messages (such as security and reward notifications) as part of the service. You can opt out of marketing communications at any time through your in-app subscription preferences or by using the unsubscribe option in the message.

Push notifications are delivered via Firebase Cloud Messaging. You can disable push notifications in your device settings.

Children's privacy

Tiger is not directed to children under the applicable minimum age in their jurisdiction, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us at rutatiina@gmail.com and we will take steps to delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the App. Your continued use of Tiger after changes take effect means you accept the updated policy.