We aim to collect only the minimum personal data needed to operate the Services, resolve issues and generate non‑identifying statistics about usage.

4.1 Information you provide directly

Account & profile data

When you create or access an account, you may provide:

• Name (required for registration or for example, as provided by Google when you sign in with Google)

• Email address (for example, as provided by Google when you sign in with Google);

• Mobile phone number (for example, when you log in by OTP / passwordless login);

• Date of birth (DOB) (if you choose to provide it);

• Country of residence (if you choose to provide it);

• Login method (e.g. “Google sign‑in”, “OTP login”, or other method we make available);

• Optional profile information (such as a profile image or display name).

Important: We may use DOB to determine your age/age band (for example, for age eligibility, age‑relevant experiences, and ad targeting controls). Where feasible for our product design, we may rely on an age band rather than your full date of birth.

Membership & loyalty data

If you add cards or memberships to the App, we process:

• The loyalty, membership, bank or partner programs you select;

• Basic identifiers you choose to store (e.g. a membership number or program ID);

• Your in‑app interactions with those cards (for example, viewing benefits, saving an offer, marking an offer as “used” or “favourite”).

Marking an offer as “used” inside DiscGo is an in‑app indicator only and does not prove that you actually redeemed the offer offline.

In‑app actions & preferences

We process information about how you use the App, such as:

• Categories you’re interested in (e.g. dining, travel, wellness);

• Offers or partners you view, search, save or mark as “used”;

• Your settings and preferences (e.g. notifications, language, region settings);

• Whether you choose an ad‑free subscription (if available).

Support & correspondence

If you contact us (for example, via in‑app chat or email), we process:

• The content of your messages;

• Your contact details (such as email address) and any metadata contained in your message;

• Any attachments you send (e.g. screenshots).

Please avoid including sensitive personal data (such as health data, religion, political opinions, or full card details) in support messages, as we do not need this to assist you.

4.2 Authentication and log‑in data

We use passwordless authentication and third‑party identity providers so that we do not need to store your password.

Depending on what you choose, you may log in using:

• Google Sign‑In
  Google authenticates you and then shares limited data with us (for example, your name, email address, profile image and a unique identifier). We do not receive your Google password. Your use of Google Sign‑In is also governed by Google’s own terms and privacy policy.

• OTP / passwordless login (email / SMS)
  A one‑time password (OTP) is generated and delivered by a secure third‑party authentication service acting on our behalf. We do not store OTP codes after they are used. We store only that your email or phone number has been verified, along with technical identifiers needed to maintain your session.

In the future, we may also support other identity providers (for example, Apple ID or other social logins). If we do, they will authenticate you and share limited account data with us (usually name, email and an identifier). We will continue to avoid storing passwords ourselves.

4.3 Information collected automatically

When you use the Services, we automatically collect certain information from your device or browser:

Device & technical data

• Device model and operating system;

• App version;

• Browser type (for website usage);

• Language and time zone;

• IP address (used for security, approximate location and fraud prevention).

Usage & diagnostics

• App open/close events, screens viewed and features used;

• Timestamps of actions (e.g. log‑in, adding a card, viewing an offer);

• Crash logs and error reports;

• Performance metrics (for example, response times).

This information is primarily used for security, performance monitoring, debugging and analytics, usually linked to an internal user or device ID rather than your name.

4.4 Location data

We may process location information in the following ways:

·       Approximate location, derived from your IP address (for example, to understand the city or region from which you access the Services); and/or

·       Precise location, derived from your device’s location services if you grant the App permission to access your location.

When you enable precise location access, we use it to:

·       show offers and retailers closest to your current location; and

·       improve the relevance of location-based content in the App.

Providing precise location data is optional. You can enable or disable location access at any time through your device settings. If you disable precise location access, the App may rely on approximate location or allow you to select a location manually, and some location-based features may be limited or unavailable.

We do not use precise location data for continuous or background tracking outside of the App’s active use, and we do not require location access for the core operation of the Services where location-based features are not being used.

4.5 Advertising and sponsored content data

DiscGo may monetise through Sponsored Listings, banner ads, and full‑screen ads (including video).

Depending on your settings, device permissions, and whether you use the ad‑supported version or an ad‑free subscription, we and/or our advertising partners may collect:

• Advertising identifiers (where available), such as Apple’s IDFA or Android/Google Advertising ID;

• Device and network data relevant to ad delivery, such as device type, OS, IP address, app version, language/time zone;

• Ad interaction data, such as ad impressions, clicks, video start/complete events, skip/close events (if applicable), and attribution data (for example, whether an ad led to an install or other action);

• Fraud and security signals used to detect invalid traffic and protect advertisers and users.

Sponsored Listings may also generate analytics such as views, clicks, saves, and “used” markers in the same way as other listings.

4.6 Payment and subscription data

If you purchase a paid subscription (for example, an ad‑free plan):

• Payments are processed by secure third‑party payment service providers (for example, payment gateways or app‑store billing providers) who are responsible for storing your full card details and complying with card security standards such as PCI‑DSS.

• DiscGo does not store your full card number, CVV or card PIN.

We may receive and process limited payment/subscription information, such as:

• Subscription plan, billing period and renewal status;

• Transaction reference, date, amount and currency;

• Store receipt/transaction identifiers (as applicable);

• Payment status (success/failed).

We use this to manage your subscription, deliver subscription benefits (for example, removing certain ads), handle billing‑related queries and comply with legal and accounting requirements.

4.7 Data from partners and other third parties

We may receive limited information about you or your device from:

• Technology and infrastructure providers (hosting, analytics, crash reporting, authentication, communications) – typically technical logs and usage metrics;

• Platform operators (for example, app stores) – information about installs, subscriptions, refunds and fraud checks;

• Advertising partners – ad delivery and measurement information;

• Partners and merchants – in rare cases, where necessary to troubleshoot a technical issue with a specific integration or to understand, in aggregated form, how DiscGo is used in connection with their offers.

We do not receive detailed transactional information from partners (for example, exactly what you bought in a physical store) unless clearly described in a specific feature.

4.8 Special categories and persons below 18

We do not intentionally collect:

• special categories of personal data (such as health data, biometric data, political or religious beliefs, or criminal records); or

• data relating to persons below 18 years of age.

The Services are not directed to persons below 18 years of age. If we learn that we have collected personal data from a person below 18 without appropriate consent or legal basis, we will delete it as soon as reasonably possible.