Privacy & Cookie Policy

Last updated: 27 September 2026

PalmTree helps people discover and support Black-owned businesses, and gives business owners tools to grow. This policy explains what personal data we collect through the PalmTree app (iPhone and Android) and palmtreeapp.co.uk, why we collect it, who we share it with, and the choices and rights you have.

1. Who we are

PalmTree is run by Brandon Milambo, a sole trader trading as PalmTree, of Apartment 35c, C Alto, Sillavan Way, Salford M3 6GB, United Kingdom. We are the "controller" of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Questions about this policy or your data: support@palmtreeapp.co.uk.

2. The data we collect

When you create an account

• Your name, email address and profile photo (if you add one), and a unique account ID.
• If you sign in with Apple or Google, we receive the name and email address they share with us. If you choose Apple's "Hide My Email", we receive a relay address instead.

When you use the app

• Location: only if you allow it, to show businesses and events near you. You can turn this off at any time in your phone's settings.
• Your activity: businesses you save as favourites, check-ins and visits, recommendations you make, spending goals and amounts you choose to log, loyalty cards and rewards, and events you book.
• Camera: only when you use it to scan an event ticket or loyalty QR code. We don't store the camera images.
• Notifications: if you allow them, a device token so we can send you push notifications.
• Device and usage data: device model, operating system, app version, language, approximate location from your IP address, and how you use the app (for example, which screens you open), collected through Firebase.

When you buy something

• PalmTree Pro is bought through the App Store or Google Play. Apple or Google take your payment; we never see your card details. We receive a record of your subscription (status, plan, trial and renewal dates) through RevenueCat.
• Event tickets and Spotlight are paid for by card through Stripe. Stripe handles your card details; we receive the order details, the amount and a payment reference.

If you own or manage a business

• The business details you give us when you list or claim a business: business name, address, contact email, phone number, website, social media links, opening hours, description and photos. Most of this is shown publicly in the app, because that's the point of a listing.
• Your contact details as the owner, and information we use to check you're entitled to claim the business.
• PalmTree Pro data such as loyalty card settings and the anonymous, aggregated insights we produce for your dashboard (views, visits and reward redemptions).

We may also add business listings using publicly available information (for example from business directories, websites or partner organisations). If you own a business we've listed and want it changed or removed, email us.

When you visit our website

• If you accept analytics cookies, Google Analytics collects pages visited, links clicked, where you came from (for example Instagram), your device and browser, and approximate location. If you reject cookies, none of this is collected. See section 7.
• Our web host keeps standard server logs (IP address, pages requested, time) for security.

When you contact us

The messages you send us and your contact details, so we can reply.

3. Why we use your data, and our legal basis

UK law requires us to have a legal basis for each use of your data:

• To provide the service you've asked for (your account, listings, loyalty cards, bookings, PalmTree Pro): because it's necessary for our contract with you.
• Location, push notifications, website analytics cookies and marketing emails: based on your consent, which you can withdraw at any time.
• Keeping PalmTree secure, preventing fraud and abuse, understanding how the app is used and improving it: based on our legitimate interests in running a safe and useful service. We make sure these don't override your rights.
• Keeping financial records and responding to lawful requests: because we have a legal obligation to.

We do not sell your personal data, and we don't use it for automated decisions that have legal or similarly significant effects on you.

4. Who we share it with

We use trusted service providers who process data on our behalf, under contracts that require them to protect it:

We also share data:

• With businesses, in limited ways: when you use a business's loyalty card or book its event, that business can see what's needed to honour it (for example your name on a ticket, or your stamp count). Business owners on PalmTree Pro see aggregated insights, not your personal profile.
• If the law requires it, for example to respond to a court order or the police.
• If PalmTree is sold or merged, with the new owner, who must keep protecting your data under this policy.

5. International transfers

Some of our providers store or process data outside the UK, mainly in the USA. When they do, we rely on UK-approved safeguards: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

6. How long we keep it

• Account data: while your account is open. When you delete your account, we delete or anonymise your personal data within 30 days, apart from what we must keep below.
• Payment and transaction records: 6 years, to meet UK tax and accounting rules.
• Business listings: while the listing is live, or until the owner asks us to remove it.
• Website analytics: 14 months in Google Analytics.
• Support emails: up to 2 years after the conversation ends.

You can delete your account in the app or by following the steps on our Delete My Data page.

7. Cookies and similar technologies

Cookies are small files a website stores in your browser. On palmtreeapp.co.uk we use:

We don't use advertising cookies. You can change your choice at any time: Cookie settings.

In the app, Firebase uses similar technology (device identifiers) to measure how the app is used and to deliver notifications.

8. Your rights

Under UK data protection law you have the right to:

• get a copy of the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict or object to how we use it, including objecting to marketing at any time
• receive your data in a portable format
• withdraw consent at any time, where we rely on consent

To use any of these rights, email support@palmtreeapp.co.uk. We'll respond within one month and won't charge you.

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Security

We use encryption in transit, access controls and the security features of our providers to protect your data. No system is completely secure, so if we ever have a data breach that puts you at risk, we'll tell you and the ICO as the law requires.

10. Children

PalmTree is not intended for children under 13, and we don't knowingly collect data from them. If you believe a child under 13 has given us personal data, contact us and we'll delete it.

11. Links to other sites

PalmTree links to business websites, social media and other services. They have their own privacy policies, and we're not responsible for how they handle your data.

12. Changes to this policy

We'll update this page when our practices change and change the "last updated" date at the top. If a change is significant, we'll let you know in the app or by email.