Privacy & Cookie Policy

Who we are

Butterfly (this app) is operated by MyButterfly, registered at Amsterdam, Netherlands. For anything in this policy, or to exercise any of the rights below, contact us at info@mybutterfly.nl.

What we collect

Only what the loyalty program actually needs to work:

• Account details — your name, email address, and a password (stored securely hashed, never in plain text).
• Loyalty activity — your points balance at each restaurant, your redemption and points history, and the prize-draw entries you’ve earned.
• Sign-in via Google (only if you choose that option instead of a password) — your Google account’s verified email address and name. We never receive your Google password, and we don’t request anything from Google beyond your basic email/name profile.
• Push notifications (only if you turn them on) — a subscription identifier and encryption keys your browser generates, used solely to deliver notifications to that device. No location or personal profile is attached to this.
• Your location (only if your browser grants permission, e.g. to show “how far away” a restaurant is) — used entirely on your own device to calculate distance and center the map. It is never sent to or stored on our servers.
• Referral activity — if you invite a friend, we record that the referral happened so we can credit your prize-draw entry.

We do not collect payment card details, government ID, or any “special category” data (health, religion, etc.) — none of that is part of how this app works.

Why we process it (legal basis)

• Running your account and the loyalty program (points, redemptions, prize draws) — necessary to provide the service you signed up for.
• Push notifications and use of your live location — only with your explicit, revocable consent (the permission prompt from your browser, or the toggle in Settings).
• Bot / fraud protection on registration (via Cloudflare Turnstile) — our legitimate interest in keeping the prize draws fair and free of fake accounts.

Who we share it with

We don’t sell your data. A small number of service providers process it on our behalf, only for the purpose stated:

• Google — only if you use “Sign in with Google”, to verify your identity.
• Cloudflare (Turnstile) — bot detection on the registration form only.
• Our email delivery provider — to send account, password-reset, and prize-winner emails.
• Browser push services (e.g. Google, Mozilla, Apple, depending on your browser) — the standard, unavoidable delivery path for any web push notification, only used if you’ve opted in.
• Our hosting provider — to run the app and store the database.

Cookies & similar technology

We keep this to the minimum needed to make the app work — no advertising or cross-site tracking cookies are used.

• Login/session cookies (WordPress) — strictly necessary, to keep you signed in.
• Cloudflare Turnstile cookie — set only on the registration page, for bot protection.
• Google sign-in cookies — set only if you use that sign-in option.
• On-device storage (not a cookie, and never sent to us) — we remember whether you’ve dismissed the “add to home screen” prompt and how many times you’ve visited, purely so we don’t nag you about it repeatedly.

Because none of this is used for advertising or tracking you across other sites, Dutch/EU cookie law doesn’t require a consent banner for it — but you’re always free to clear cookies/site data in your browser at any time.

How long we keep it

We keep your account and loyalty data for as long as your account is active. If you’d like your account and personal data deleted, contact us and we’ll action it — this isn’t yet a self-service option in the app.

Your rights

Under GDPR (and the Dutch UAVG), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time (for push notifications or location — just turn them off in Settings)

To exercise any of these, contact us using the details above. If you’re not satisfied with our response, you have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Age requirement

This app is intended for people aged 16 and over, in line with the age of consent for online services under Dutch law. We don’t knowingly collect data from anyone younger.

Changes to this policy

If how we handle your data changes in a meaningful way, we’ll update this page and change the “last updated” date at the top.