Privacy policy
Last updated —
What Bounou holds about you, why, who else sees it, and what you can do about it. This describes what the system actually does — if something here does not match how Bounou behaves, the behaviour is the mistake and we want to hear about it.
01Who we are
Bounou is operated by Les Tickets Bounou, Rue Autriche, 4023 Sousse Erriadh, Tunisia. We issue and administer digital meal, service and gift vouchers in Tunisia, and we are responsible for the personal data described here.
For anything on this page, write to [email protected].
02What we hold about members
Your name, email address, phone number and preferred language. Your password, kept as a one-way hash we cannot reverse — nobody at Bounou can read it.
The vouchers assigned to or bought by you: their kind, their face value, and where and when each was redeemed. The devices you are signed in on. Anything you send us through the contact form or support.
03What we hold about businesses, partners and organizations
The entity's legal name, tax identifier, contact details and the addresses of its counters.
The documents you upload to prove identity and eligibility. Tunisian anti-money-laundering law requires us to collect and keep these; we do not use them for anything else.
Every voucher issued, confirmed, claimed, settled or paid out, and which member of your team did it. A shared login would make that record meaningless, which is why each person gets their own.
04Why we hold it
Most of it because the service cannot work without it: a voucher that records nothing cannot be redeemed, disputed or settled.
Some of it because the law requires it — identification and accounting records we are obliged to keep.
Some of it to keep you safe: sign-in attempts, device sessions and rate-limit counters exist to stop somebody taking your account or your vouchers.
We do not profile you, we do not advertise to you, and we do not sell anything about you to anybody.
05Who else sees it
Only whoever has to. A business sees the vouchers redeemed at its own counters — not your other vouchers, and not where else you shop.
A partner sees the orders it confirmed. An organization that assigns you vouchers sees that they were assigned and that they were used, not what you bought with them.
Bounou administrators see what administering the system requires, and every administrative action is recorded against the person who took it.
06Companies that handle data for us
Hetzner, which runs the servers, in Helsinki, Finland. Cloudflare, which protects the connection and stores uploaded documents. Resend, which delivers our email.
If you choose to sign in with Google or Facebook, that provider learns you signed in to Bounou. If you do not use it, they learn nothing. We ask that provider for your name and email address and nothing else — we never post anything on your behalf, and we never read your contacts, your files or your mail.
The map inside our apps draws its background from CARTO, using OpenStreetMap data, so that service sees the map tiles your device asks for while the map is open. It never learns who asked.
07Where it is kept
On servers in Finland, inside the European Union. Everything travels encrypted, and uploaded documents are stored in the European jurisdiction of our storage provider.
08How long we keep it
Accounting and anti-money-laundering records for as long as Tunisian law requires, which outlasts your relationship with us.
Everything else until you close your account, and after that only what a dispute or a legal obligation still needs.
Vouchers you already redeemed remain as accounting entries even after your account is closed, because a ledger that can be rewritten afterwards is not a ledger. They stop being attached to a name.
09This website
This site sets no cookies, runs no analytics, and loads nothing from anybody else's server — the fonts are served from here, not from a font company.
The language you are reading is part of the address, not something stored about you.
The signed-in console and the apps do keep a cookie and a token, for one purpose: keeping you signed in, and letting you sign a device out again.
10Location
The apps ask for your location for one question — which of these places is near me — and only when you ask it. The answer is worked out for that screen and not kept.
Refuse, and the map still works. It opens over Tunis instead of over you.
11Your rights
You can ask what we hold about you, have it corrected, object to how we use it, or ask us to delete it. Write to [email protected] and we answer within a month.
Where we have to keep something, we tell you which obligation makes us rather than simply refusing.
You can also complain to the Instance Nationale de Protection des Données à Caractère Personnel (INPDP), Tunisia's data protection authority.
12Children
Bounou is for adults. We do not knowingly hold data about children, and an account we learn belongs to one is closed.
13Changes
When this changes in a way that matters we say so on this page and, if you have an account, by email. The date at the top is the version you are reading.