Last updated: April 29, 2026

RefCentre ("we", "us") operates the RefCentre mobile application and refcentre.am website (the "Service"). This policy explains what data we collect, why, and how you can control it.

1. Data we collect

• Phone number — to authenticate you via SMS one-time password. Stored encrypted (AES-256-GCM) at rest, with a separate hashed copy used only to look up your account during login.
• Name — first and last name, pulled from your customer record at our point-of-sale system when you make a purchase in store.
• Purchase history — date, amount, and bonus earned for transactions you make in our physical store, synchronized from our accounting system every 5 minutes.
• Bonus balance — your current loyalty bonus total, sourced from the same accounting system.
• Device push notification token — issued by Apple (APNs) or Google (FCM via Expo), used only to send you notifications you have opted into.
• Device platform (iOS / Android) and app language preference — to render the right UI.
• Anonymized analytics — anonymous usage events via Google Analytics 4 (screen views, taps, app opens). This data does not include your name, phone number, or any personally identifying information.

2. What we do not collect

• We do not collect your location.
• We do not access your camera, microphone, photos, or contacts.
• We do not collect any data from users we know to be under 18.

3. Third parties

We use the following processors strictly to provide the service. We do not sell, rent, or share your data with any other party.

• Armsoft Trade 7 (our point-of-sale and accounting system) — stores your purchase history and bonus balance.
• Nikita SMS (sendsms.nikita.am) — delivers your one-time password via SMS.
• Expo Push Notification Service — relays push notifications to your device.
• Apple App Store / Google Play — distributes the app and handles in-store reviews.
• Google Analytics 4 — anonymized usage analytics, retained for 14 months.

4. Data retention

Active accounts are retained for as long as you use the service. When you delete your account (in-app, see section 6), your personal data is anonymized within 90 days and only summary statistics retained.

5. Your rights

You can: (a) access the data we hold on you, (b) request correction of inaccurate data, (c) delete your account at any time. Contact privacy@refcentre.am for (a) and (b); use the in-app delete-account button for (c).

6. Account deletion

Open the app → Profile → Delete Account → confirm. Your phone number is immediately invalidated for login, and all associated data is anonymized within 90 days.

7. Security

Phone numbers are encrypted at rest. JWT auth tokens are stored in your device's secure enclave (iOS Keychain / Android Keystore). All API traffic is HTTPS / TLS 1.2+. We do not log credentials, OTPs, or auth tokens.

8. Changes

We may update this policy. Material changes will be announced in-app and via the news feed. The "Last updated" date above always reflects the current version.

9. Contact

RefCentre, 40 Yerevanyan St., Masis, Ararat, Armenia
Email: privacy@refcentre.am