Trust & Security

Our Commitment

Your Data & Privacy

• Data minimisation: We collect only what’s needed to provide the service and verify eligibility.
• Transparency: Clear, plain-English policies about what we collect, why, and for how long.
• Privacy by design: Access is limited by role (least-privilege). Sensitive data is segregated.
• Your rights: You can access, correct, export, or request deletion of your personal data (subject to legal retention).
• Global standards: We align our practices with applicable privacy laws in our operating regions (e.g., Australian Privacy Principles, and GDPR where relevant).

Security of the SaveKey App & Gift Card

• Encryption everywhere: Data in transit is protected with TLS; sensitive data at rest is encrypted.
• Account protection: Optional 2-factor authentication (2FA), device checks, and session timeouts.
• Gift card security: PIN/OTP-based redemption and device-bound checks; no card numbers stored in plain text.
• Balance visibility: Real-time balance and transaction history in the app help you spot anything unusual fast.
• Lost or stolen: Instantly lock your card/account from the app or contact support to freeze and re-issue.

Payments, Rewards & Value Protection

• Instant crediting: 100% back (redeemable value) is credited to your SaveKey balance after eligible payments.
• Redemption controls: Category and partner-level controls (e.g., groceries, meals, medicines, education, stays, services).
• Risk engine: Automated fraud checks, velocity limits, and anomaly detection to prevent misuse.
• Clear nature of value: 100% back is redeemable value with participating partners—not cash—valid up to 5 years from credit date.

Partner Onboarding & Due Diligence

• Business verification (KYB): We verify partner identity, business registration, and service scope.
• Quality & reliability checks: We assess service quality and test redemption flows before going live.
• Ongoing monitoring: Partner performance, dispute patterns, and customer feedback are reviewed continually.
• Removal policy: Non-compliant or low-trust partners are suspended or removed swiftly.

Operational Security

• Secure development lifecycle: Code reviews, dependency checks, and security testing prior to releases.
• Patching & updates: Prompt patching of systems and libraries; least-privilege access policies enforced.
• Logging & monitoring: Centralised logs, alerting, and investigation workflows for suspicious activity.
• Backups & recovery: Encrypted backups and disaster-recovery processes with defined RPO/RTO targets.

Incident Response & Notifications

• 24/7 escalation: Defined runbooks for security, availability, and fraud incidents.
• Customer notifications: If your data or value may be affected, we’ll notify you promptly as required by law and our policies.
• Responsible disclosure: Security researchers can report issues at security@savekey.co. We prioritise triage and fixes.

Scam & Phishing Safety

• We never ask for your PIN/OTP or password by email, phone, or social media.
• Always check messages come from @savekey.co domains or the official app.
• If unsure, freeze your card in the app and contact support@savekey.co.

Where We Operate & Store Data

• SaveKey is founded in Australia with phased expansion by city/town.
• Data may be processed in regional cloud infrastructure appropriate to your location and the services used, subject to contractual and legal safeguards.

Your Controls

• Manage access: Turn on 2FA, review active sessions, and lock your card from the app.
• Download or delete data: Request export or deletion (subject to legal/operational retention).
• Support: Email support@savekey.co for identity/account help, redemptions, or suspected fraud.

Key Guarantees 

• We will protect your account with modern security controls and respond quickly to issues.
• We will be transparent about how your data and value are used.
• We will act fast on suspicious activity and keep you informed when it matters.