Privacy Policy

Eknas is operated by Eknas, Kathmandu, Bagmati Province, Nepal. This policy explains what personal information we collect when you use Eknas, why, who can see it, where it is stored, how long we keep it, and the choices and rights you have under the Individual Privacy Act, 2075 (2018), the Individual Privacy Regulation, 2077 (2020), the Electronic Transactions Act, 2063 (2008) and other laws of Nepal.

Eknas runs the platform and is responsible for the information in it. Each business that uses Eknas also receives information about its own members and decides for itself how it uses that information for its loyalty program and marketing, so it is responsible for that use too. Their duties are set out in our Terms of Service and summarised below.

You give us

• Account details: name, email address and password (stored only as a secure one-way hash). If you turn on two-step sign-in, an encrypted authenticator key.
• Profile details: Nepal mobile number and date of birth. We ask for these before you can collect points.
• Address: your street or tole, city and district.
• Hobbies and interests: the hobbies you pick (for example music, trekking or cricket, plus up to three of your own) and the kinds of places you love.
• Choices: your notification and email preferences.
• Visit ratings and reviews (optional): the stars and comment you choose to leave about a purchase. Comments are public, as explained in Who can see your information.
• Business details (businesses only): the owner's and staff members' names, emails and phone numbers and their roles; the business name, category, description and contact details; its locations with their map positions; menus and photos; logo and cover images; and the loyalty programs, rewards and offers it sets up.
• Payments to Eknas (businesses only): plan requests, the payment screenshot you upload with any reference number and note (a screenshot can show the payer's name, phone or account number), and the invoices we issue.
• Support requests and messages you send us.

Given to us by a business

• Customers added at the counter: if you don't use the Eknas app yet, a business's staff can add you with your mobile number and name (and, if you give it to them, your email address) so the purchases they record earn you points. If you later sign up for Eknas with the same mobile number, that history is linked to your account only after staff at that business check in person that it's you and confirm it by scanning your code. If you see purchases that aren't yours, tell us at [email protected].
• Purchases: each time you buy something, the business records the bill amount in Nepalese rupees and, if staff add one, a short note of what the purchase was for (for example “2 plates chilli momo”).

Created when you use Eknas

• Loyalty activity: the cards you hold; your check-ins and purchase history (amount, note, date, time, business, branch, the staff member who recorded it and how); points earned and their expiry dates; purchases a business voided; rewards unlocked and redeemed; and reward codes issued.
• Learned interests: the kinds of shops you search for, view and join, which we use only to order the shops shown to you in Explore.
• Notifications sent to you in the app and whether you have opened them.
• Email records: for each email (sent, or shown in the app instead), the address, subject, what it contained and whether it was delivered. Password reset links and codes are never stored in these records.
• Consent records: the version of our Terms and this policy you accepted, when, and the IP address and browser used.
• Security and technical data: IP address, browser and device type, sign-in times, sessions, and a record of important actions (the audit log).

Information about businesses we may contact

Eknas's sales team looks for businesses in Nepal that might want to use Eknas. To do this we collect contact details that a business has made public, such as its name, phone number, address, website or public social media page, including with the help of an AI tool that searches the web (see AI processing), and we keep notes of our conversations with it. We use these details only to contact the business about Eknas. A business can ask us to delete them or to stop contacting it at any time by emailing [email protected].

Things we do not collect

• Camera: when you scan a QR code, the camera image is read on your device to find the code. No photos or video are sent to us or stored.
• Location: if you tap “Near me”, your location is used in your browser to sort shops by distance. It is not sent to us or stored.
• Customer payments: you pay the business directly. Eknas doesn't process those payments and doesn't see how you paid.
• We don't collect citizenship numbers, payment card details, or contacts from your phone.

• To create and secure your account, and to let you sign in.
• To run loyalty cards: record purchases, add points (including double points days), expire points where a business has set that, unlock rewards and check single-use reward codes.
• To show you your purchase history and points at each business.
• To let staff find your card by your mobile number when you don't have your phone with you, and to link purchases saved with your number to your account once they confirm it's you.
• To send in-app notifications about your points, rewards, reward codes, receipts and points about to expire.
• To tell you when a loyalty program you hold a card for is ending, with the date earning stops and the final date to redeem your rewards, and to remind you before that date. These notices are always shown in the Eknas app (notifications).
• To personalise offers: businesses you're a member of can use your birthday, city, district, hobbies and activity on their card (for example a birthday-month offer, or a note for regulars they haven't seen for a while) to choose which offers to send you, and Eknas uses your interests to order the shops shown in Explore.
• If you allow it, to show you offers, events and birthday messages from businesses you joined, and occasional news from Eknas.
• To publish your ratings and review comments on business pages, as described below.
• To give businesses tools to run their program, including AI-assisted tools and, where set up, the developer API.
• To prevent and investigate fraud and misuse, and to keep the Service secure.
• To bill businesses, check their payments and keep the accounting and tax records the law requires.
• To answer support requests, and to understand, in aggregate, how Eknas is used so we can improve it.
• To comply with the law and respond to lawful requests from authorities in Nepal.

We collect and use your information with your consent, which you give when you create an account, sign in and complete your profile; because it is needed to provide the Service you asked for; to keep the Service and its users safe; and where the law requires us to.

Offers, events and birthday messages are optional. You choose during sign-up, and you can switch them off at any time in Profile → Notifications.

Receipt and reward notifications are optional too. Switch off Receipts and reward notifications in Profile → Notifications. You can change your address and hobbies in your profile at any time.

Withdrawing consent doesn't affect anything done before you withdrew it. Some information is needed to run your cards; if you don't want it used at all, you can delete your account.

Businesses you're a member of

When you join a business's loyalty card, or its staff add you at the counter, that business can see your name, mobile number, date of birth (and age), address (street or tole, city and district), hobbies, email address if staff saved one, whether you accept offers, and your activity on its card: purchases (amounts and notes), points, branches, ratings and rewards. Its owner and managers see your full mobile number; cashiers see only part of it. A business can export its members' details on some plans. Businesses you are not a member of cannot see your profile: if their staff enter your full mobile number at the counter, they see only your initials, so they can ask your name and add you with your agreement. Counter lookups are limited per day and recorded.

Each business is responsible for how it uses its members' information, including anything it exports or copies outside Eknas, and must follow the law and our Terms. To stop a business contacting you outside Eknas, ask the business directly, or tell us.

Systems a business connects

Where the Eknas team has set up the developer API or webhooks for a business, that business's own systems (for example its point of sale or website) receive its members' names, partly hidden mobile numbers, cards, points, purchases and rewards. The business is responsible for those systems.

Anyone who visits a business's Eknas page

If you rate a purchase, your stars count towards that business's public rating on its Eknas page. If you also write a comment, the comment is shown publicly on that page with your star rating, your first name and the first letter of your last name (for example “Aarav S.”), how long ago you wrote it and a “Verified visit” label. Your mobile number, email, address, full name, purchase amounts and other details are never shown. The business can post a public reply under your review. Eknas may hide comments that break the community rules. Ratings with no comment are not listed individually.

Google review invites

Where a business has added its Google Business Profile link, after you rate a purchase Eknas may show a link inviting you to also review the business on Google. If you choose to, you post that review yourself, from your own Google account, under Google's terms and privacy policy. Eknas never posts on Google for you, doesn't send your details to Google, and doesn't show Google ratings or reviews on Eknas.

The Eknas team

Authorised Eknas team members can see account information to provide support, check payments, prevent fraud, keep the Service running and send platform announcements. Access is limited to what each role needs, and some team members can see only businesses in the cities they look after. To fix a problem, a team member may open a business's account as its owner would see it; this is recorded in the audit log, and some actions, such as cancelling a subscription, can't be taken that way.

Service providers

We use these providers. They receive only what they need to do their job and process it on our instructions or under their own terms:

• Hostinger hosts the Eknas application and database on a server in Mumbai, India, where all the information in this policy is stored.
• Cloudflare carries traffic to and from Eknas and protects it from attacks, so it handles your IP address and the pages and data you request.
• Brevo delivers security emails, and receives your email address and the content of the email.
• Google (Gemini) and Groq provide AI processing, as described in AI processing.
• Maps: when a map loads, your browser requests map tiles directly from OpenStreetMap, openstreetmap.fr and Esri, which receive your IP address but no account information. Place searches and pinned locations in the location picker are sent through Eknas to OpenStreetMap's Nominatim service (the search text or the pin's position), without your IP address or account details. Directions open in Google Maps only if you choose them.

When the law requires it

We may disclose information if required by the laws of Nepal, a court order, or a lawful request from a government authority, or to protect people from harm or fraud.

We never sell your information

We do not sell or rent personal information, and we do not allow businesses to do so.

Some Eknas tools use AI models from Google (Gemini). When Gemini is busy or unavailable, or a tool needs web search, the request goes to Groq instead. We send only the text a tool needs. AI is not used to identify customers, to make decisions about them, or to build profiles of them.

• Tools for businesses: drafting offers and replies to reviews, suggesting reward ideas, and turning a business's own figures into insights. We send the business's own details and totals and, for a review reply, the review text, star rating, the reviewer's first name, their number of visits, the branch and the note on that purchase. We don't send customers' mobile numbers, email addresses, dates of birth or addresses.
• Tools for the Eknas team: drafting replies to businesses' support messages (which include the messages and the names of the people who wrote them), summarising a business account's health from its totals and our notes, and drafting announcements and reward ideas.
• Finding businesses for Eknas's sales team: an AI tool searches the web for contact details that businesses have published, as described in Information we collect. It doesn't use information about Eknas customers.

These providers process the text on their own systems, which may be outside Nepal, under their terms. Depending on the service plan we use, a provider may keep what we send for a limited time and may use it to improve its services, which is another reason we keep it to the minimum. AI suggestions are drafts: a person at the business or at Eknas decides whether to use them. We keep a record of each AI request (which tool, when, who used it and how much it cost) for about 13 months, for security, cost and fair-use limits.

Information about Eknas's own employees (such as employment details, attendance, leave, payroll and documents) is handled internally for HR and legal purposes, is visible only to authorised Eknas staff with the relevant role, and is never shared with businesses or customers. Salary and bank details are limited to the people who run payroll. Eknas team members receive a separate notice explaining how their information is used.

• Account and profile: while your account is open. When you delete your account, your name, mobile number, email address, date of birth, address, hobbies, interests, notification choices and notifications are erased straight away, active reward codes are cancelled, you are signed out everywhere and your login is closed.
• Loyalty activity: kept with each business so its reports, sales totals and accounts stay accurate. When a business ends a loyalty program or leaves Eknas, your cards, points and purchase history for it stay in your account as a record, as our Customer Reward Protection Policy promises. After you delete your account, purchase amounts and points stay only in anonymised form (shown as “Deleted customer”), no longer linked to you, and notes on them are removed.
• Customers added at the counter: kept as part of that business's records until the history is linked to an Eknas account with the same mobile number, when the separate record is merged into that account and removed, or until you ask us to delete it.
• Ratings and reviews: shown on the business's page while your account is open. When you delete your account, your comments are removed; your stars stay in the business's average without being linked to you. To have a single review removed sooner, email [email protected].
• Email records: up to two years, so we can check delivery and answer questions. When you delete your account, the email address and contents are removed from these records.
• Consent records: for as long as your account exists, and afterwards without your IP address and browser details, so we can show which versions were agreed and when.
• Security logs (audit log): up to three years, so we can investigate misuse. When you delete your account, your email, name and IP address are removed from these entries.
• Sessions: a sign-in lasts up to 7 days and is deleted once it expires or you sign out. Records used to limit repeated attempts are deleted after 2 days.
• AI request records: about 13 months. Developer API request logs and webhook deliveries: 30 days. Visit counts: 90 days.
• Billing records (businesses), including invoices and payment screenshots: for as long as Nepal's tax and accounting laws require.
• Business contact details found for sales: kept while they are useful to us, and deleted on request.
• Reward codes: expire within minutes; the record of their use is kept with the loyalty activity.
• Backups: the database is backed up every night. Daily copies are kept for 14 days and weekly copies for 8 weeks, then overwritten, so deleted information can remain in a backup until that copy is replaced. Backups are used only to recover from a failure.

• Passwords are hashed with bcrypt; we never store or see your actual password. You can turn on two-step sign-in with an authenticator app.
• Sessions use secure, HttpOnly cookies, and every request is checked on the server, with protection against cross-site request forgery.
• Information is sent over encrypted connections (HTTPS).
• Businesses can only see their own members; staff roles limit what each person can see and do, and the Eknas team's access is limited by role.
• QR and reward codes are signed, short-lived and single-use; repeated wrong attempts are blocked.
• Emails never contain your password or a reward code that can still be used.
• Linking a mobile number's history to an account, counter lookups, sign-ins, exports, support sign-ins by the Eknas team and important changes are recorded in an audit log, and mobile number changes are limited.

No system is perfectly secure. If a breach is likely to affect your personal information, we will tell you without undue delay, tell the relevant authorities where the law requires, and explain what we are doing about it.

Under the Individual Privacy Act, 2075 (2018) and other laws of Nepal you can:

• See the personal information we hold about you, including your purchase history, and ask us for a copy of it;
• Correct it: most details, including your address and hobbies, can be edited in your profile;
• Delete your account and personal details from Profile → Delete account, with the limits explained in How long we keep it;
• Object to marketing and withdraw consent to offers, birthday messages and receipt or reward notifications at any time;
• Complain to us, and to the relevant authority in Nepal if you're not satisfied with our answer.

To make a request, email [email protected] from the address on your account. We may need to confirm it's you. We aim to respond within 15 working days. For information a business holds about you outside Eknas, contact that business; we will help where we can. If a business added your mobile number without your permission, tell us and we will remove it.

Eknas is not for anyone under 16, and sign-up checks this from the date of birth you give. If you are under 18, please use Eknas only with a parent or guardian's permission. If we learn that an account belongs to someone under 16, we will close it and delete its personal details.

We use only essential cookies: one keeps you signed in, and one protects forms against cross-site request forgery. Your theme and map-style choices are saved in your browser's own storage and never sent to us. We don't use advertising or cross-site tracking cookies, and our emails don't contain tracking pixels.

To see how busy Eknas is, we count page visits ourselves, without cookies or outside analytics services: the page opened, the kind of device (phone, tablet or computer) and the site you came from. Each visitor is counted under a code that changes every day and can't be traced back to your IP address, which we don't store for this. These counts are kept for 90 days.

Eknas's application and database run on a server in Mumbai, India. Cloudflare's network, our email provider (Brevo) and our AI providers (Google and Groq) may process information in other countries too. This means your information is stored and processed outside Nepal. We choose established providers, send each only what it needs, use encrypted connections, and limit who can access the server. By using Eknas you agree to this transfer. Wherever it is processed, we protect your information as this policy describes and handle it in line with the laws of Nepal.

If we change this policy, the version and effective date above will change and you will be asked to accept the new version the next time you sign in. If a change significantly affects how your information is used, we will also tell you in the app before it takes effect.

Questions, requests and complaints about personal information go to our Grievance Officer, Eknas. We aim to acknowledge a complaint within three working days and resolve it within 30 days.

• Email: [email protected]
• General support: [email protected]
• Post: Grievance Officer, Eknas, Eknas, Kathmandu, Bagmati Province, Nepal