Privacy policy

Bounou is operated by Les Tickets Bounou, Rue Autriche, 4023 Sousse Erriadh, Tunisia. We issue and administer digital meal, service and gift vouchers in Tunisia, and we are responsible for the personal data described here.

For anything on this page, write to [email protected].

Your name, email address, phone number and preferred language. Your password, kept as a one-way hash we cannot reverse — nobody at Bounou can read it.

The vouchers assigned to or bought by you: their kind, their face value, and where and when each was redeemed. The devices you are signed in on. Anything you send us through the contact form or support.

When you submit the first registration screen, we save your email address, phone number and selected account type before you choose a password. We retain your progress so you can resume, and our sales team can contact you to help complete registration.

The entity's legal name, tax identifier, contact details and the addresses of its counters.

The documents you upload to prove identity and eligibility. Tunisian anti-money-laundering law requires us to collect and keep these; we do not use them for anything else.

Every voucher issued, confirmed, claimed, settled or paid out, and which member of your team did it. A shared login would make that record meaningless, which is why each person gets their own.

Most of it because the service cannot work without it: a voucher that records nothing cannot be redeemed, disputed or settled.

Some of it because the law requires it — identification and accounting records we are obliged to keep.

Some of it to keep you safe: sign-in attempts, device sessions and rate-limit counters exist to stop somebody taking your account or your vouchers.

We never sell anything about you to anybody. Visits and our advertising are measured only if you agree — see «This website and the apps» below.

Only whoever has to. A business sees the vouchers redeemed at its own counters — not your other vouchers, and not where else you shop.

A partner sees the orders it confirmed. An organization that assigns you vouchers sees that they were assigned and that they were used, not what you bought with them.

Bounou administrators see what administering the system requires, and every administrative action is recorded against the person who took it.

Hetzner, which runs the servers, in Helsinki, Finland. Cloudflare, which protects the connection and stores uploaded documents. Our email leaves from our own mail server.

If you choose to sign in with Google or Facebook, the provider learns that you are signing in to Bounou. We receive the information needed to identify your account, including your name, email address and the identifier supplied by that service. We do not use this connection to post on your behalf or access your contacts, files or mailbox.

The map on our website and inside our apps loads its background directly from the OpenStreetMap Foundation. While the map is open, the Foundation receives the map-tile requests your device makes, with the technical information any connection carries, such as your device's IP address.

Google (Analytics and Ads) and Meta (Facebook), only if you accept measurement on the website, in the console or in the apps: they learn which pages you visited, how the apps are used, and which of our ads brought you there, and set their own cookies or identifiers to do it. Refuse, and they learn nothing from us.

With your measurement consent, Meta also receives registration milestones from our servers. Matching information can include SHA-256 hashes of your email address and phone number, advertising identifiers, your IP address and browser information. Server reporting follows the same consent choice. Registration and the assistance you request remain available when you refuse measurement.

Our core servers are in Finland, inside the European Union. Everything travels encrypted, and uploaded documents are stored encrypted. The providers named above process the data their service requires.

Accounting and anti-money-laundering records for as long as Tunisian law requires, which outlasts your relationship with us.

Everything else until you close your account, and after that only what a dispute or a legal obligation still needs.

Vouchers you already redeemed remain as accounting entries even after your account is closed, because a ledger that can be rewritten afterwards is not a ledger. They stop being attached to a name.

This site and the console load Google's tag and Facebook's pixel only if you accept the banner; they then set their own cookies to measure visits and our advertising. Refuse, and no measurement or advertising tag loads; the fonts are served from here, not from a font company. «Cookie settings» at the bottom of every page (in the console: Settings) asks again.

The apps ask the first time they open: accept, and they send how the app is used — when it opens and for how long — and which of our ads brought you, to Google Analytics for Firebase and to Facebook; refuse, and they send nothing. Their Settings ask again.

The website language is part of the page address. If you have an account, your preferred language is also saved in your account, and the console keeps it in a cookie, so that it is used the next time you sign in.

Once you are signed in, the console keeps a session cookie and the apps keep an authentication token, to keep you signed in and to let you sign a device out again. The console also keeps the language cookie described above.

The apps ask for your location for one question — which of these places is near me — and only when you ask it. The answer is worked out for that screen and not kept.

Refuse, and the map still works. It opens over Tunis instead of over you.

You can ask what we hold about you, have it corrected, object to how we use it, or ask us to delete it. Write to [email protected] and we answer within a month.

Where we have to keep something, we tell you which obligation makes us rather than simply refusing.

You can also complain to the Instance Nationale de Protection des Données à Caractère Personnel (INPDP), Tunisia's data protection authority.

Bounou is for adults. We do not knowingly hold data about children, and an account we learn belongs to one is closed.

When this changes in a way that matters we say so on this page and, if you have an account, by email. The date at the top is the version you are reading.