Privacy policy
Flidiz — last updated 14 September 2026
Who processes your data
The Flidiz service is published by Kevmax SARL.
Contact us about your data — support@flidiz.com.
We have not appointed a data protection officer; whether one needs to be appointed is currently under review.
What we collect, and why
We collect nothing “just in case”. Every item below serves a purpose you can see for yourself.
So that you can have an account
Your phone number or email address, a password, and the name you choose to display.
Your password is never stored: we keep a fingerprint of it that lets us check that you know it, without allowing anyone to recover it.
So that your points exist
The businesses whose programs you join, your balance with each of them, and the history of your visits — date, amount, points earned or spent.
This is the service itself: without this history, a dispute over a credited point could not be settled.
To notify you
A technical identifier for your phone, provided by Apple or Google, which lets us send it a notification. It says nothing about your location or how you use your phone.
If you turn on proximity alerts
No location is ever recorded. The calculation happens on your phone: it compares your position with the addresses of the businesses you have joined, and sends the server nothing but the identifier of the business you came close to.
We therefore cannot reconstruct your movements, even if we wanted to — and this impossibility is checked automatically with every release of the software.
What the business owner sees
A business owner whose program you have joined sees your display name, your balance with them, and your visits to them.
They see neither your other memberships, nor your points elsewhere, nor your email address or phone number — unless you give them these yourself.
A business owner who buys a promotion campaign aimed at people who are not members never sees who was reached: they receive only a number.
How long
| Your data | Retention period |
|---|---|
| Your account | For as long as you keep it |
| After you request deletion | 30 days, then anonymisation |
| Your visits and your points | 10 years, anonymised along with your account |
| One-time login codes | 30 days |
| Your closed sessions | 90 days |
| Proximity alerts triggered | 90 days |
| Your phone, if it stops checking in | 12 months |
| Proof of your consents | Kept |
Why ten years for your visits. The law requires businesses to keep their accounting records, and your visits are part of them. We keep them, but anonymised: they no longer carry your name, your phone number or your address, and nothing makes it possible to trace them back to you.
This anonymisation is irreversible. There is no lookup table and no backup of your original identifiers — and this is checked automatically.
Your rights
| You can | How |
|---|---|
| See all your data | From the app, in one step |
| Get it in a readable format | Same step: a structured file |
| Correct anything that is wrong | From your profile |
| Delete your account | From the app, effective within 30 days |
| Refuse notifications | Settings, at any time |
| Withdraw a consent | Settings, with immediate effect |
Withdrawing a consent is as easy as giving it, and takes effect straight away — not at the next overnight batch.
For any request the app does not cover, write to support@flidiz.com: we reply within one month. You may also lodge a complaint with the CNIL, the French data protection authority.
Who we share data with
| Who | What they receive | Why |
|---|---|---|
| Google (Firebase) | Your phone’s identifier, the message title | To send you the notification |
| Apple and Google Wallet | Your card identifier and your balance | To display your loyalty card |
| App Store, Google Play | Nothing about you | They collect the business owner’s subscription |
| Our hosting provider | All the data, without accessing it | To run the service |
| Our SMS provider | Your number, the code | To send you a login code |
Several of these companies are established outside the European Union. These transfers rely on the European Commission’s standard contractual clauses, which these providers’ terms include.
The content of a notification never includes your balance, your name or your contact details: it passes through Apple’s and Google’s servers, and is displayed on a lock screen that other people can see.
How we protect it
- Your passwords are never stored in plain text, nor in any reversible form.
- Your visits are written to a ledger that no one can modify or erase, even with direct access to the database — the guarantee is enforced by the database itself.
- Back-office access requires a second factor, and every time your data is viewed there, a trace is kept.
- No identifier travels in plain text through our caches or our technical logs.
If we fall short
In the event of a breach of your data that presents a risk, we notify the CNIL within 72 hours, and you as well if the risk is high. Reports should be sent to support@flidiz.com.