Privacy policy and terms

Who processes the data

The Unemi service (the «Unemi» and «Unemi Staff» apps and the unemi.kz website) — IE Unemi (individual entrepreneur, IIN 981108450273), Astana, Kazakhstan.

For data questions write to support@unemi.kz. We answer within three working days.

What we collect

From a customer: an account identifier, a name and profile photo if you set them, the interface language, the history of stamps and rewards, and a technical device identifier — it exists so your stamps survive a reinstall.

Gift certificates: the certificate page unemi.kz/g/… opens without signing in and collects no data about you — it shows the venue, the amount or service, the balance, the expiry date, the greeting written by the giver and the recipient's name in the “For” field if the cashier, the giver or the venue entered one. That name is visible on the page, in the certificate PDF, in the app of whoever added the certificate, and to the venue in its dashboard and at the checkout; entering it is optional. If you add a certificate to the app, it is linked to your account, and the app shows its balance, expiry date and redemption history (dates and amounts). The venue only sees that the certificate is in the app — not the name in your profile.

Visit reviews: a rating from 1 to 5 stars, the points you ticked («Long wait», «Friendly» and others), up to 500 characters of text if you write any, and whether you chose «Don't show my name to the venue». A review is tied to the visit — the checkout operation, its time and location. Together with the review we store a hash of the technical device identifier: it shows us when one phone leaves ratings from several accounts. The venue does not see this hash. If you report a venue's reply, we keep the reason and your note.

Support requests: if you write to us from the app (profile → «Support»), we receive the text of your message, the name from your profile, the account identifier, the app language, the platform (Android or iOS) and the app version, plus a contact for our reply — an email address or phone number, if you leave one. If you write about a particular visit from your visit history, the venue and time of that visit are added to the request.

Your birthday: day and month, without the year — only if you add them yourself in the app profile. The date is set once; after that it can only be changed through support.

You can use the app as a guest — no email, no phone number, no registration. The service does not require a phone number or email address: you can choose to leave one in the «Support» form so that we can reply to you.

From staff: name, role, venue and a PIN stored as a one-way hash. The PIN itself is never stored and cannot be recovered — the owner can only set a new one.

Technical data: crash reports and usage statistics — with your account identifier, but without your name or contacts. The advertising identifier is not collected and personalised advertising is switched off.

Why we need it

To give stamps and rewards, to show your card in the app, to notify you when a reward is ready and to protect the program from gaming.

The business sees anonymous visit statistics and the customer's name on the staff screen — otherwise it is unclear who the reward goes to. Customer contacts are not shared with the business.

A review lets the venue learn how your visit went and reply to you. In a review, the venue's owner and managers see the rating, ticked points and text, the time, location and cashier of the visit, and — unless you hid your name — your name and how many times you visited them over the past year. Cashiers do not see reviews, and neither do other users: if the venue turns on its average rating, the app shows only the average and the number of ratings, with no texts or names. Only you see the venue's reply to your review. Reports about a reply are handled by Unemi, not the venue — we answer within 20 days; the venue can also report a review to us, and after a report we may hide it.

A support request lets us look into your problem and reply to you at the contact you left. The platform and app version help us find the cause of a failure.

Your birthday lets the places you have visited in the last 12 months congratulate you and, if they have switched it on, give you a coupon or points. The gift appears in the app for everyone who added the date at least 30 days in advance, while the greeting notification arrives only if you have agreed to receive offers from places. Places never see the date: Unemi sends the greeting and the gift on their behalf, and a place only sees how many of its customers celebrate this month.

Where the data lives

Since 16 October 2026, the service's data has been stored and processed on servers in Kazakhstan: customer cards, visits and checkout operations, stamps, points, subscriptions and rewards, gift certificates, reviews, support requests, venue and staff data, photos and other files. Backups are kept in Kazakhstan too, on a separate server. The unemi.kz website and the venue dashboard also run on servers in Kazakhstan. Dashboard emails for businesses — email confirmation, password change and invitations — are sent from the mail server of our hosting provider Hoster.kz in Kazakhstan: the recipient's address, the name used in the greeting and the link in the email pass through it.

What stays outside Kazakhstan are the Google and Apple services behind sign-in, notifications, crash reports and the map. Sign-in is handled by Firebase Authentication (Google), which holds your account identifier, the email address and name from Google or Apple if you sign in with them, and your profile name and a link to your profile photo if you set them. Notifications are delivered by Firebase Cloud Messaging — on iPhone together with Apple's push notification service — so the device token and the text of each notification pass through them.

Crash reports and app usage statistics go to Firebase Crashlytics and Google Analytics for Firebase — with your account identifier, but without your name or contacts; Google Analytics on the website and in the dashboard is covered in «Analytics on the website and in the dashboard». The venue map is shown by Google Maps in the Android app and in the dashboard, and by Apple Maps on iPhone. Messages the venue owner gets from the Unemi bot in Telegram are stored by Telegram (see «Who we share it with»).

How long we keep it and how to delete it

Your account and its data are kept while you use the service. You can delete the account in the app: profile → delete account. The profile, the device link and notification tokens go with it.

A gift certificate is not lost when you delete your account: it is unlinked from the account and its link works again. Before deletion the app offers to save the links. The venue keeps the records of the certificate's sale, redemptions and refund as accounting of the guest's money.

A review is kept until you delete it (profile → «My reviews» → the review → «Delete review»); after that the venue no longer sees it. When you delete your account, the text of your reviews and their link to you are erased at once, while the rating and ticked points stay with the venue without your name, as statistics. Requests to rate a visit are deleted with the account, or automatically after 400 days. Whatever has already reached the venue outside Unemi — Telegram messages (see «Who we share it with») and review files the venue exported — stays with the venue.

Support requests are deleted together with your account; if you keep the account, they are kept for one year from the day you sent them and then deleted automatically. To have them deleted sooner without deleting your account, write to us at support@unemi.kz: we will delete them within 15 working days.

Your birthday is kept while you have an account and is deleted together with it. To correct or delete the date without deleting the account, write to us in the app (profile → «Support») or at support@unemi.kz.

Anonymous visit history stays with the business as statistics — it cannot be traced back to a particular person.

Who we share it with

Nobody beyond our infrastructure providers (Hoster.kz hosting in Kazakhstan and its mail server for dashboard emails, plus Google and Apple — what each of them handles is set out in «Where the data lives»), the business whose card you started — to the extent described in this document — and Telegram, if the venue owner receives review messages there. Data is not sold and not used for advertising.

The venue owner learns about a low rating straight away: from a notification in the «Unemi Staff» app and, if they turned it on, from a message in their chat with the Unemi bot in Telegram. The message contains the rating, the location, the ticked points and the beginning of the text, up to 200 characters; your name is in neither the message nor the notification, even if you did not hide it. Telegram is a third-party service with its own privacy policy (telegram.org/privacy): the message stays in the chat even if you later delete the review, withdraw your consent or delete your account.

Support requests are read only by the Unemi team. We do not forward them to the venue or pass on your contact — even if you are writing about a visit to that venue.

What places can see

A venue is a company separate from Unemi, so we show it your reviews and your name on its customer profile only with your consent. We keep a record of when you gave it and to which version of the text.

The app asks for consent to share reviews with a checkbox on your first review. When a venue where you have a card starts using customer profiles, the app asks once for the general consent «What places can see» — in a separate window or with the same checkbox on a review. With this consent, the owner and managers see in their dashboard the name from your profile next to your history at that venue: visits and purchases, points, stamps and subscription, level, campaigns you received and your group, which Unemi works out automatically from your visits — for example, «haven't been in a while». The customer profile also shows your reviews of that venue — with your name, unless you hid it.

Without the general consent you are a «Guest» with a number to the venue: it sees your history there, but without your name or reviews. As before, the cashier sees your name when serving you. The venue never sees your phone number, email, profile photo, birthday or visits to other venues. Unemi logs every opening of a customer profile: who opened whose profile and when. The venue exports its customer list without names — with numbers only.

Changed your mind? Withdraw consent in your app profile: tap «Withdraw consent for reviews» or turn off «Your name for places» — that switch appears together with customer profiles. You can also write to us at support@unemi.kz and we will withdraw it for you. Venues then immediately stop seeing your name and all your reviews, including earlier ones, and the app will ask for consent again on your next review. Earlier reviews stay with you in «My reviews», where you can delete them.

Automated decisions

Some decisions in Unemi are made automatically, by rules the venue has set up in advance: which guests get a message from the venue, with or without a coupon (for example, those who haven't been in a while, on their 10th visit or when one stamp is left before a reward), and what level you have at the venue and what it gives you — the points percentage, level gifts and programs that open only from a certain level.

So that the venue can see whether a message helps, 10% of the guests it suits are drawn by lot into a comparison group: they do not get that message or coupon. Birthday greetings are never held back — everyone entitled to them gets them.

These decisions use your visits and purchases at that venue, your stamps and points, your level there and your birthday, if you added it. The venue never sees your date of birth.

You have the right to object to an automated decision — in the app (profile → «Automated decisions» → «Raise an objection», or profile → «Support») or by writing to support@unemi.kz. A person from the Unemi team reads every objection: at your request we will stop automated offers from that venue or from all venues, check how the decision was made and reply within three working days.

You can also switch automated messages off yourself: «Notifications from this place» on the venue's page or «Deals and gifts from places» in your profile.

Analytics on the website and in the dashboard

The unemi.kz website and the business dashboard use Google Analytics, a Google service. It shows us which pages and sections are opened and which buttons are pressed, whether a request went through, as well as the page language, the device and browser type and the approximate city. Names, contacts, the texts of requests, reviews and campaigns, PINs and API keys are not sent to analytics.

On the website, analytics cookies (_ga) appear only after you press «Accept» in the analytics notice. Until you answer, Google Analytics receives anonymous visit data without cookies; after «Decline» the website sends nothing to analytics. Your choice is kept in your browser — you can change it with the «Cookie settings» button at the bottom of any page.

In the business dashboard, events are linked to internal staff and business numbers, the role (owner or manager) and the plan — without names or contacts. This shows us where owners struggle and helps us find failures faster.

Google processes this data under its own privacy policy: policies.google.com/privacy. Google Analytics advertising features are switched off. You can turn off Google Analytics in your whole browser with the Google Analytics Opt-out add-on: tools.google.com/dlpage/gaoptout.

Terms of use

Unemi is the business's tool: the program terms (how many stamps, what reward, how long it is valid) are set by the business and can change. Rewards already issued are not cancelled by a rule change.

We are not liable if a business refuses to honour a reward, but please tell us — we part ways with businesses that break their own rules.

The service is provided «as is»; we work to keep it running but do not guarantee uninterrupted operation.