Mobile App Privacy Policy

1. About This Supplement

This Mobile App Privacy Policy supplements our general Privacy Policy and applies specifically to the TravelCard mobile application for iOS and Android, operated by Travel Card Ltd. ("Travel Card", "we", "us", or "our").

Our general Privacy Policy governs all data practices across our platform. This supplement describes the additional information the mobile app collects and the device features it uses. Where this supplement conflicts with the general Privacy Policy on an app-specific matter, this supplement controls. It complies with Israeli privacy laws, including the Privacy Protection Law, 1981, and Amendment No. 13.

2. Information the App Collects

2.1 Account and Profile

To sign you in and operate your account, we process your name, email address, and phone number. Authentication is handled via Firebase Authentication using phone number, one-time passcode (OTP), password, or Apple Sign-In.

2.2 Financial and Expense Data

The app processes data needed for corporate travel and expense management, including payment card details, transactions, receipts (including images you capture), allocations, and travel bookings (such as hotels and trips).

2.3 Device and Technical Data

We collect device identifiers, operating-system version, a push-notification token, app usage and analytics events, and crash and diagnostic data to keep the app secure, reliable, and improving.

3. Device Permissions

The app requests the following permissions, each only for the stated purpose:

• Camera — to scan QR codes and photograph your receipts.
• Photo Library — to save photos of your receipts (iOS). On Android, the app does not read your media library.
• Location (while using the app) — to display hotel maps. We do not track your location in the background.
• Face ID / Biometrics — to provide secure, convenient sign-in (see Section 4).
• Notifications — to keep you updated about your card and account activity.
• Files / Documents — to save files related to your travel card.

You can grant or revoke any of these permissions at any time in your device settings.

4. Biometric Authentication

Face ID, Touch ID, and equivalent biometric checks are performed entirely by your device's operating system. We never receive, see, or store your biometric data. When you enable biometric unlock, your authentication token is stored securely in your device's keychain / secure storage and is accessible only on that device while it is unlocked.

5. Push Notifications

With your consent, we send push notifications about your card and account activity. Delivery uses Expo's push service together with Apple Push Notification service (APNs) and Google Firebase Cloud Messaging (FCM). You can disable notifications at any time in your device settings.

6. Third-Party Services in the App

The app relies on the following service providers, each governed by its own privacy terms:

• Google Firebase — authentication, analytics, and crash reporting (Crashlytics).
• New Relic — application performance and stability monitoring.
• Google Maps — to display hotel locations.
• Expo — app delivery and push-notification infrastructure.
• AI assistant — when you use in-app AI features, your queries are processed to generate responses.

We share only the data necessary for these services to function, consistent with Section 5 of our general Privacy Policy.

7. Data Stored on Your Device

Authentication and device tokens are kept in your device's secure keychain / encrypted storage. The app may also cache data locally for performance. This local data is removed when you log out or uninstall the app.

8. App Stores

You download the app from the Apple App Store or Google Play. Those platforms process certain data (such as download and basic usage information) under their own privacy policies, which are outside our control.

9. Children's Privacy

The app is intended for business use by individuals aged 18 or older. We do not knowingly collect personal information from anyone under 18.

10. Your Rights and Choices

You can manage permissions and notifications at any time in your device settings. To exercise your rights to access, correct, or delete your personal information under Israeli law and our general Privacy Policy, contact us at privacy@travelcard.io.

11. Changes to This Policy

We may update this supplement from time to time. Material changes will be reflected by updating the effective date above and, where appropriate, through an in-app notice.

12. Contact Us

Questions about this Mobile App Privacy Policy can be directed to privacy@travelcard.io. Travel Card Ltd., Tel Aviv, Israel.