JoinMeal Ads & Data Use Notice (Hong Kong) v1.0

1. Scope

This Notice applies to data use and disclosure arrangements in connection with:

• Promotional content/advertising displayed in the JoinMeal app or related services (including JoinMeal’s own promotions and, if introduced in the future, third-party advertisements);
• Sponsored content or promoted group-order posts (if any);
• Promotions or co-marketing activities with partner merchants/partners (“Partners”); and
• Measurement, reporting, fraud/abuse detection, and optimization for promotions, ads, and recommendations.

2. Current Status and Possible Future Changes (Important)

2.1 Current

JoinMeal currently does not display third-party advertisements. We may display JoinMeal’s own promotions or Partner-related promotional content (if any).

2.2 Future

We may introduce third-party advertisements and/or third-party ad delivery or measurement tools in the future (e.g., analytics, attribution/measurement, anti-fraud tools). If any such introduction involves new data categories, purposes, or classes of transferees, we will provide an update in a reasonable manner (e.g., by updating this Notice and/or our Privacy Policy or providing in-app prompts), and we will provide applicable choices and controls as required under the PDPO.

3. Key Concepts and Definitions

3.1 “Ads/Promotional Content”

Promotional messages displayed in the Service, including JoinMeal promotions, Partner promotions, sponsored content, and (if introduced in the future) third-party advertisements.

3.2 “Personalized Recommendations”

Recommendations, sorting, or ranking of group orders, merchants, categories, or content that may be tailored based on how you use the Service.

3.3 “Partners”

Third parties that cooperate with us for promotions, sponsored content, co-marketing campaigns, events, or related collaborations.

3.4 “De-identified/Aggregated Data”

Data that has been processed to remove direct identifiers of your identity or is presented in aggregated form such that it is not reasonably used to identify an individual, although appropriate safeguards may still be applied depending on the context.

4. Data Categories We May Use (for Recommendations, Promotions, and Measurement)

Depending on how you use the Service and your device permissions, we may use the following categories of data for the purposes described in Section 5:

4.1 Account and Basic Data

• HKUST email (primarily for account verification, service communications, and security; generally not used as an identifier shared with advertisers)
• Nickname/avatar
• Basic account status (e.g., verification status)

4.2 Usage and Interaction Data

• Group-order posts you create, view, join, follow, or otherwise interact with
• Search terms, clicks, views, and engagement signals (e.g., time spent, join events)
• Time and frequency of Service usage
• Broad preference signals inferred from activity (e.g., frequently viewed categories)

4.3 Pickup Context and (Where Applicable) Location-Related Data

• Pickup point/building information you enter
• Approximate location (e.g., city/district-level derived from IP address), subject to technical feasibility
• Precise location only if you grant device-level permission (if used, we apply data minimization and limit use to relevant features/contexts)

4.4 Device and Technical Data

• IP address
• Device information (model, OS version, app version, language)
• Security and anti-abuse signals and system logs (for anti-fraud/anti-abuse and service stability)

4.5 Promotion/Campaign Performance Data (Where Applicable)

• Event records such as whether you saw promotional content, clicked it, or joined a promotion-related group order
• Aggregated performance metrics (e.g., overall impressions/clicks/joins)

5. How We Use Data (Purposes)

We may use the above data to:

5.1 Deliver Promotional Content and (Where Applicable) Ads

• Display JoinMeal’s own promotions and service information
• Display Partner promotions, events, or sponsored content (if any)
• Control frequency and reduce repetitive or disruptive content

5.2 Provide and Improve Personalized (or Non-Personalized) Recommendations

• Recommend group orders, content, or categories you may be interested in
• Sort/rank listings (e.g., “Recommended for you”, “Trending”, “Nearby”)
• Improve user experience and content discovery efficiency

If you choose to limit personalization, we may still provide non-personalized or contextual recommendations, such as sorting by time, popularity, or pickup location you select.

5.3 Measure Performance, Analyze, and Improve (with Data Minimization)

• Measure impressions, clicks, and engagement for promotional content
• Understand what is effective and improve content and features
• Detect fraud, invalid traffic, abuse, or scams, and maintain platform integrity

We currently do not use third-party advertising delivery tools or third-party advertising attribution/measurement tools. We may use third-party service providers for operational analytics, diagnostics, or crash/performance monitoring for the operation and improvement of the Service (not for third-party advertising). If we introduce third-party advertising and/or related delivery or measurement tools in the future, we will handle updates as described in Section 2.

5.4 Compliance, Dispute Handling, and Safety

• Enforce rules and policies relating to promotional content
• Prevent misleading promotions, scams, or improper content
• Retain records where reasonably necessary for investigations, audits, or legal compliance

6. What We Do Not Do (Key Commitments)

6.1 No Selling of Personal Data

We do not sell your personal data to advertisers or Partners.

6.2 No Sharing of Directly Identifying Information for Ads/Promotions

We do not provide advertisers or Partners with directly identifying information about you (such as your HKUST email or other identity-identifying information), except where:

• You choose to participate in a redemption, event, or promotion and disclosure is necessary to provide/administer that activity; and
• We apply data minimization and provide required notices and choices where applicable.

7. What We Share and With Whom

We may share limited data (with data minimization) in the following situations:

7.1 Service Providers (Processors)

We may use vendors for infrastructure, push/email delivery, content delivery, security protection, or general technical support. These providers process data only under our instructions and are subject to confidentiality and security obligations.

7.2 Partners (Promotion/Event Administration)

If you participate in a Partner promotion or event (e.g., redeem an offer or register for an event), we may share the minimum necessary information with the Partner to administer the activity (e.g., confirm redemption status, record participation), subject to applicable laws and contractual safeguards.

7.3 Aggregated or De-identified Reports

We may provide aggregated or de-identified performance reports to Partners (e.g., overall impressions/clicks/joins) to evaluate promotion effectiveness.

7.4 Legal and Safety Disclosures

We may disclose data where required or permitted by law, or to protect users and the platform.

8. Direct Marketing (Push/Email)

If we use your personal data for direct marketing (e.g., promotional push notifications or marketing emails), we will comply with PDPO requirements and provide a free opt-out mechanism. Details of direct marketing practices are set out in our Privacy Policy and the consent/opt-out mechanism provided at the time of collection.

For direct marketing communications, JoinMeal sends such communications itself or through service providers acting under our instructions (processors). This does not mean we provide your HKUST email address to Partners for their independent direct marketing, unless you separately consent or such disclosure is necessary to administer an activity you choose to participate in (e.g., redemption or event registration) in accordance with this Notice and our Privacy Policy.

9. Your Choices and Controls

9.1 Personalization (Recommendations/Promotions)

We may provide “personalization” settings in the app. If such toggles are not available at this stage, you may email info@receipt-fly.com to request limitation of personalized use. We currently provide limitation requests via email; we will apply it to recommendation ranking and similar personalization features to the extent reasonably practicable (e.g., switching recommendations to non-personalized/contextual modes).

9.2 Marketing Communications

You may opt out of promotional push/email communications at any time as described in our Privacy Policy.

9.3 Device-Level Controls

You can manage notification permissions and location permissions in your device settings. If ad identifier mechanisms are introduced in the future, you may be able to reset or limit them depending on your OS capabilities.

10. Cross-Border Processing

Your data may be processed outside Hong Kong (e.g., where vendors operate). We take reasonable steps consistent with PDPO principles to protect personal data, including contractual safeguards and security controls. Please refer to our Privacy Policy for more details.

11. Data Retention

We retain promotion/recommendation-related data only for as long as necessary to achieve the purposes described in this Notice (e.g., performance reporting, anti-abuse, compliance), after which we delete or anonymize it in accordance with our retention practices, unless retention is required or permitted by law.

12. Updates to This Notice

We may update this Notice from time to time and will notify you via in-app notice, announcement, or other reasonable means. The updated version becomes effective as of the “Effective Date” above.

13. Contact Us

If you have questions or requests about this Notice or our data practices: