Privacy Policy

Last Updated and Effective Date: September 22, 2026

Welcome to leoooing ("we," "our," or "us"). We are committed to safeguarding your personal data and ensuring full transparency in our data processing practices. This Privacy Policy complies with the General Data Protection Regulation (GDPR), the Apple App Store Review Guidelines, and the Google Play Developer Policies.

By downloading, accessing, or using the leoooing mobile application (the "App") or our website (https://leooo.pt), you acknowledge the collection and processing of your personal data as described herein.

1. Data We Collect and Processing Purposes (Data Safety)

We process only data essential for providing loyalty rewards, managing your account, and improving your dining experience:

• Name & Contact Email Mandatory
  Purpose: Account management, authentication, and critical transactional notifications. When utilizing Apple Sign-In or Google Sign-In, we obtain only your authorized basic profile information and never store your third-party credentials.
• Unique User Identifiers (Firebase UID) Mandatory
  Purpose: Core app functionality and security. A pseudonymous identifier generated by Firebase to securely associate your device with your loyalty points balance and transaction history.
• Transaction & Loyalty Records Mandatory
  Purpose: Loyalty program execution. We track point accumulation, voucher redemptions, and order history to maintain your membership tier and rewards.
• Camera Access (QR Code Scanning) Optional
  Purpose: Loyalty points redemption. The camera is accessed exclusively while actively scanning in-store QR codes or receipt barcodes to claim loyalty rewards. We do not store, upload, or process static photographs or video feeds.
• Approximate / Precise Location Optional
  Purpose: Store locator. Used only while the App is in foreground use to display nearby leoooing locations and calculate travel distances. You may decline location permissions and manually choose your store.
• Date of Birth & Dietary Preferences Optional
  Purpose: Profile personalization. Provided voluntarily to receive birthday privileges and tailored menu recommendations (e.g., Vegetarian, Vegan, Allergen alerts).
• Push Notification Device Tokens (Expo Service) Optional
  Purpose: Operational notifications, order updates, and marketing campaigns. Notifications are strictly opt-in and can be deactivated at any time via your device settings.

2. Third-Party Service Providers and Data Transfers

We do not sell, rent, or commercialize your personal information under any circumstance.

We share data exclusively with trusted technical infrastructure providers necessary for operational execution:

• Google Firebase (Google Cloud Ireland Limited): Used for secure cloud authentication, Firestore real-time database hosting, and security logging.
• Expo / EAS (650 Industries, Inc.): Used for mobile framework runtime services and push notification dispatch.
• Apple / Google: Used solely for federated single sign-on (OAuth) upon user selection.

3. Data Security and Storage

All data transmitted between your device, our servers, and third-party APIs is encrypted using industry-standard Transport Layer Security (HTTPS/TLS). User account data is securely retained in production environments only as long as your membership account remains active.

4. Account Deletion and Data Erasure (GDPR & App Store Compliance)

You have the absolute right to terminate your account and erase all associated personal data permanently.

• In-App Self-Service Deletion: Navigate directly to Profile > Settings > Delete Account. Confirming this action immediately purges your Firebase Authentication profile, removes your Firestore account records, and revokes your loyalty balances.
• Web-Based Account Deletion: In accordance with Google Play and Apple requirements, users can also request deletion outside the App by visiting our online portal at https://leooo.pt/delete-account or emailing support@leooo.pt. Requests submitted via web or email will be verified and executed within 7 business days.

Notice on Erasure: Account deletion is permanent and irrevocable. Any remaining loyalty points, tier statuses, and past coupons will be permanently forfeited.

5. Your European Privacy Rights (GDPR)

If you are an EU/EEA resident, you have the following rights regarding your personal data:

• Right of Access & Portability: You may request an export of the personal data we hold about you.
• Right to Rectification: You may correct inaccurate profile data directly inside the App.
• Right to Withdraw Consent: You may revoke push notification, location, or camera permissions at any time via your operating system settings.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority. For Portugal, this is the Comissão Nacional de Proteção de Dados (CNPD) (https://www.cnpd.pt).

6. Children's Privacy

The App is rated for general audiences (PEGI 3 / IARC 3+) but is not targeted at children under the age of 13. We do not knowingly collect personal data from children under 13 without verified parental consent. If we detect that such data has been registered inadvertently, it will be deleted immediately.

7. Policy Amendments

We may amend this Privacy Policy periodically. Significant changes will be announced within the App or via your registered email address. The latest revision will always be accessible at this URL.