How we handle personal data.

1. Who we are and what this policy covers

Omnyx ("we", "us") operates a loyalty, membership and campaign platform used by food and beverage and retail businesses in Singapore ("Partners") and their customers ("Members"). This policy explains how we collect, use, disclose and protect personal data in accordance with the Personal Data Protection Act 2012 of Singapore ("PDPA").

We play two roles. For data about our Partners and visitors to this website, we act as the organisation collecting the data. For data about Members collected through a Partner's loyalty or membership programme, we act as a data intermediary, processing that data on behalf of and for the purposes of the relevant Partner. Each Partner remains responsible for the personal data of its own Members as required by the PDPA.

2. What we collect from Members

When you join a programme or play a campaign through Telegram, we collect:

• Your Telegram user ID, username and first name, as provided by Telegram
• Your activity within the programme: stamps, visits, points, tier, vouchers, prize plays and redemptions
• Where a Partner's programme rewards spending, the transaction amount recorded at the point of sale — the bill total your server enters, or the total received from a Partner's connected point-of-sale system — used to calculate the points you earn. This is a transaction total only; we do not receive itemised receipts.
• Your consent records, including when consent was given or withdrawn

3. What we collect from Partners and website visitors

• Business name, contact person, email address and business details provided during onboarding or through our contact form
• Login credentials for the Partner dashboard (managed through our authentication provider; we never see your password)
• Programme configuration and usage data needed to operate and improve the service

Cookies and local storage

Our website sets no cookies of its own and uses no advertising or third-party analytics trackers. We do not track you across other websites. The only client-side storage we use is essential "local storage" kept on your own device to make the service work — for example, keeping you signed in to a dashboard, remembering a staff member's outlet PIN so it need not be re-entered every scan, and saving simple display preferences. This information stays on your device and is not used to profile you. Because we set no tracking cookies, there is nothing here that requires a cookie-consent banner under Singapore's PDPA; where the law requires consent for personal data, we obtain it through the sign-up and consent flows described in this policy. Some embedded third-party features (such as Telegram login) may set their own cookies when you use them — those are governed by that provider's own privacy policy.

4. Purposes for which data is used

• Operating loyalty, membership and campaign programmes: recording stamps, visits and any spend amount, calculating points and tiers, and issuing and verifying rewards
• Sending programme-related messages through Telegram, such as reward confirmations and campaign updates from the Partner whose programme you joined
• Providing Partners with aggregated insights about their own programme's performance
• Detecting and preventing fraud or abuse of programmes
• Responding to enquiries, providing support and administering accounts
• Complying with legal and regulatory obligations

5. Disclosure of personal data

We do not sell personal data. We do not release Member data to any third party for monetary or other consideration. Disclosure is limited to:

• Your Partner: a Partner can see the programme data of its own Members only. No Partner can see your activity with any other business.
• Service providers: infrastructure providers that host and deliver the service under contractual obligations of confidentiality and security (currently Supabase for database and backend hosting, Cloudflare for content delivery, and Telegram as the messaging platform).
• Legal requirements: where disclosure is required by law, court order or a government authority with lawful jurisdiction.
• Business transfers: in the event of a merger, acquisition or sale of assets, personal data may be transferred to the successor entity under equivalent protections, and affected individuals will be notified.

6. Overseas transfer

Our database infrastructure is hosted with Supabase in the Asia-Pacific region (currently Seoul, South Korea), and our website is delivered through Cloudflare's global network. Where personal data is transferred outside Singapore, we take steps to ensure it receives a standard of protection comparable to that under the PDPA, including through contractual safeguards with our providers.

7. Protection of personal data

• All data is encrypted in transit
• Database access is governed by row-level security so that each Partner can only reach its own data
• Administrative access is restricted, authenticated and logged
• Staff-facing actions require per-outlet PIN verification

No system is perfectly secure, and we cannot warrant that security will never be breached, but we review our safeguards on an ongoing basis.

8. Data breach notification

If a data breach occurs that is likely to result in significant harm to affected individuals, or is of significant scale, we will assess and notify the Personal Data Protection Commission and affected individuals in accordance with the PDPA's data breach notification obligations.

9. Accuracy and retention

We rely on the information provided by Telegram and by you, and we correct inaccuracies when they are brought to our attention. Personal data is retained only for as long as it is needed for the purposes above or to meet legal requirements. When a programme ends or an account is closed, associated personal data is deleted or anonymised within a reasonable period.

10. Your rights: access, correction and withdrawal of consent

• Access and correction: you may request a copy of the personal data we hold about you, or ask us to correct it.
• Withdrawal of consent: you may withdraw consent at any time. Members can do this directly inside the Telegram experience or by contacting us. Withdrawing consent means we can no longer operate your loyalty benefits, and any accumulated stamps, points or unredeemed rewards will lapse.
• Deletion: you may ask us to delete your personal data, subject to any retention required by law.

We respond to requests within the timelines prescribed by the PDPA, and in any case aim to respond within 14 days.

11. Cookies and similar technologies

Our marketing site sets no advertising or analytics cookies. The Partner dashboard uses strictly necessary browser storage to keep you signed in. Telegram Mini App pages use the session context provided by Telegram to verify your identity securely.

12. Marketing messages

Members receive programme messages through Telegram only from Partners whose programmes they have joined, and only where consent has been given. You can stop these at any time by leaving the programme, blocking the bot or withdrawing consent. We comply with the Do Not Call provisions of the PDPA; we do not send telemarketing messages to Singapore telephone numbers.

13. Children

The service is not directed at children under 13. Telegram's own terms require users to meet its minimum age. We do not knowingly collect personal data from children; if you believe a child has provided us personal data, contact us and we will delete it.

14. Third-party platforms

The service is delivered through Telegram, and our pages may link to third-party sites. Those platforms have their own policies which we do not control. We encourage you to review Telegram's privacy policy for how it handles your Telegram account data.

15. Data Protection Officer and contact

Questions, requests or complaints about personal data can be directed to our Data Protection Officer at hello@theomnyx.com. If you are not satisfied with our response, you may contact the Personal Data Protection Commission of Singapore.

16. Changes to this policy

We may update this policy from time to time. Material changes will be flagged on this page with a revised "last updated" date, and, where appropriate, notified to Partners directly. Continued use of the service after changes take effect constitutes acceptance of the updated policy.