Privacy Policy
This Privacy Policy explains what personal data SMILE MMC collects through the Brands’Box mobile app (iOS and Android) and the brandsbox.az website, why we use it, who we share it with, how we protect it and what rights you have regarding it.
- Effective date7 November 2026
- Data controllerSMILE MMC
- Applies toThe app and brandsbox.az
Other languages:AzərbaycancaРусский
Who we are
Brands’Box is a service that brings discounts and special offers from partner brands in Azerbaijan together in one app. The service and the processing of your personal data are operated by SMILE MMC (“we”, “Brands’Box”), a company operating in the Republic of Azerbaijan. For the purposes of this policy, SMILE MMC is the owner and operator (controller) of your personal data.
This policy applies to the Brands’Box app (iOS, Android), the brandsbox.az website, the 2222 short-number SMS and *224# USSD service, and the partner accounts used by staff of partner businesses.
By creating an account or using the service, you confirm that you have read this policy. If you do not agree with it, please do not use the service. Questions: support@brandsbox.az, +994 12 505 48 38.
Data we collect
Data you provide
- Phone number — for sign-up and sign-in (an SMS verification code is sent), subscriptions and discount codes. Phone verification is also required when you sign in with Google or Apple.
- Full name (a single field), gender and, optionally, your email address.
- Profile photo — only if you take one with the camera or choose one from your gallery.
- Password — optional; stored only as a hash.
- In-app activity: your favourite branches, the ratings and comments you leave for branches, promo codes you claim and your notification settings.
- Your requests — messages to our support team and feedback you send (including any screenshots you attach).
Data collected automatically when you use the service
- Discount history: at which branch, when, on what terms and how a discount was applied — if partner staff entered your QR code or 4-digit code, the staff member; if you confirmed the discount yourself, the confirmation code.
- Confirming a discount yourself (“Customer self-confirmation”): whenever you scan the Brands’Box QR code at the counter or select a nearby branch, we record the branch, the discounts you selected, the time, how the branch was selected (QR, nearby branches or branch page), your coordinates at that moment and their accuracy, your distance from the branch, the result of the attempt (confirmation or reason for rejection), the app version and IP address.
- Subscription data: subscription status, the channel used to subscribe, start and end dates, and the results and amounts of balance charge attempts.
- Location — only if you allow it (see “Location, camera and other permissions”).
- Device data: platform (iOS/Android), device brand and model, app version, selected language and the push notification token.
- Technical logs: for every request to our servers we record the IP address, the app/browser identifier (user agent), and the time, address and content of the request. Sensitive fields such as passwords, tokens and verification codes are masked in these logs.
- Notifications sent: the text, time and delivery status of push, SMS and email messages sent to you.
When you sign in with Google or Apple
When you sign in with a Google or Apple account, that service gives us your account identifier, your email address (and whether it is verified), your name and, for Google, your profile picture. We never see your Google or Apple password. If you use Apple’s “Hide My Email”, we only receive the address generated by Apple.
From your mobile operator and the SMS channel
When you text the 2222 short number or use the *224*1# / *224*2# USSD commands, the operator passes us your phone number and the text of your message. If you subscribe through this channel, an account is created automatically with your phone number only. The payment gateway tells us the result (successful or failed) of each balance charge.
If you previously subscribed to the Brands’Box 2222 SMS service, your phone number, your email address (if one was recorded) and your subscription history were transferred from the previous system to the new one so that your subscription could continue.
The brandsbox.az website
The website does not use analytics, advertising or tracking cookies. Your selected language is stored in your browser’s local storage, and fonts are loaded from Google Fonts (Google may see your IP address when this happens). The web server keeps standard technical logs (IP address, request, time).
Data we do not collect
- Bank card details — there are no card payments in the app.
- Your contacts, microphone, calendar, SMS messages or other files on your device.
- Advertising identifiers (IDFA, Android Advertising ID). The app contains no advertising, analytics or tracking SDKs, and we do not track you across other companies’ apps or websites.
- Biometric data — Face ID and fingerprint sign-in are checked by your device’s own system, and this data never leaves your device.
How we use your data
- Account and sign-in: verifying your phone number with an SMS code, enabling sign-in with Google/Apple and keeping you signed in.
- The core service: showing nearby branches, discounts and events on the map and in lists, generating your personal QR code, letting partners apply discounts or letting you confirm a discount yourself at a branch, and keeping your discount history.
- Subscription and payment: activating, renewing and stopping your subscription, charging the fee to your mobile balance through your operator and handling payment-related requests.
- Notifications: sending verification codes and service messages about your subscription and, according to your settings, push, SMS and email notifications about discounts, special offers and events; if you turn on Radar alerts, letting you know when you are near a branch with an active discount.
- Support: answering your requests and investigating problems.
- Security: preventing fake accounts, reuse of codes, automated requests (scraping) and unauthorised access; when you confirm a discount yourself, verifying that you are at the branch and detecting abuse (for example, confirmation outside a branch, confirmations at distant branches within a short time or exceeded limits); and detecting errors.
- Improving the service: using aggregated statistics to plan the partner network and offers.
- Legal obligations: complying with the law and with lawful requests from competent authorities.
We do not use your data to build advertising profiles, and we do not make fully automated decisions about you that have legal effects.
When you confirm a discount yourself, the system automatically checks distance, limits and suspicious activity. If the conditions are not met, that confirmation is rejected; after repeated violations, this feature may be temporarily disabled for your account. This applies only to self-confirmation — you can still receive a discount when the partner scans your QR code. If you disagree with a decision, write to support@brandsbox.az and a member of our staff will review your request.
Legal basis and consent
We process your personal data in accordance with the Law of the Republic of Azerbaijan “On Personal Data” and other applicable legislation. The grounds for processing are:
- Your consent — given when you accept the Terms of Use and read this policy at sign-up, and when you grant location, camera, photo and notification permissions in your device’s system dialogs.
- Providing the service — processing necessary to deliver the service you ask for (account, discounts, subscription).
- Legal obligation — for example, keeping accounting records of payments.
- Legitimate interest — keeping the service secure and preventing abuse.
You can withdraw your consent at any time: turn off permissions in your device settings, change notifications under “Notification settings” in the app, or delete your account. Withdrawal does not affect processing carried out before it; some features (for example, nearby branches) may work in a limited way without permissions.
What partner businesses can see
Partners are the companies and their branches that offer discounts on Brands’Box. When branch staff scan your QR code or enter your 4-digit discount code at the till, their app shows:
- your name and profile photo;
- your phone number (shown in the partner app with all but the last digits hidden);
- whether your subscription is active and when it ends;
- the discounts available to you at that branch.
When you confirm a discount yourself, the staff member sees the confirmation card on your screen: that your subscription is active, the discounts you selected, the branch, the confirmation code, your name and your masked phone number.
Applied discounts — including those you confirm yourself — stay in the branch’s history (with the date, the discount, your name and phone number) so that the partner can keep its records and check disputed cases. Partners do not see your location, coordinates, email, favourites or your activity at other branches.
Other users
Comments you write about branches are visible to other users together with your name and profile photo. You can delete your comment at any time.
Data of partner staff
For partner accounts we store the username, the password (as a hash) and the company and branch the account belongs to; every discount a staff member applies is recorded against their account.
Location, camera and other permissions
Location
- Location permission is optional. The app uses it to show nearby branches and discounts on the map and in “Radar”, and to filter results by distance.
- If you allow it, your device’s coordinates are sent to the server to find nearby branches. In addition, your last known location is stored in your profile: it is overwritten each time and no location history is kept. It is used to centre the map, show offers near you and produce aggregated service statistics; only authorised Brands’Box staff can view it.
- When you confirm a discount yourself, the app sends your device’s coordinates to the server once at that moment. The server compares them with the branch address and stores them in the confirmation record to verify that you are at the branch and investigate abuse. You cannot confirm a discount yourself without location permission; in that case, you can show your QR code to the staff.
- On Android, location is used only while the app is open — background location permission is not requested.
- On iOS, if you turn on “Radar alerts” yourself, the app asks for “Always” permission. iOS then monitors zones (about 300 m) around the nearest branches with active discounts; when you enter a zone, the app sends the server only that branch’s identifier, not your coordinates. The server sends you a push notification, which stays in your notification history. You can turn Radar alerts off at any time.
- When you ask for directions, the branch address opens in the map app you choose (Apple Maps, Google Maps, Waze); from then on, that app’s privacy policy applies.
Camera and photos
- The camera is needed by partner staff to scan a customer’s QR code, by customers to scan the Brands’Box QR code at the counter and confirm a discount themselves, and by any user to take a profile photo. QR codes are recognised on the device; camera images are not sent to our servers.
- Photo library access is used only to choose a profile photo (for partners — branch, company and event photos). Only the photo you choose is uploaded; it is cropped and compressed before upload.
Notifications and biometric sign-in
- Notification permission is requested to deliver push notifications and is optional.
- Face ID, Touch ID and fingerprint are checked by your device’s own system; we have no access to your biometric data.
You can change any permission at any time in your device settings.
Data stored on your device
The sign-in token is kept in the device’s secure storage (iOS Keychain / Android Keystore); language, theme, recent searches and Radar settings are kept in the app’s local storage. The list of recent searches is not sent to the server (the search query itself is sent to get results). On Android, if the app was installed from a branch link, the Google Play Install Referrer is read on the device only to open that branch and is not sent to the server.
Push notifications, SMS and email
- Service messages — verification codes, notices about subscription activation, renewal, cancellation and payment, discount codes and promo codes. These are necessary for the service and are sent regardless of your notification settings.
- Informational notifications — about new discounts, special offers and events. You can turn them off completely or choose channels (push, SMS, email), topics and the notification language under Profile → Notification settings.
- Push notifications are delivered via Google Firebase Cloud Messaging (on iOS together with the Apple Push Notification service). Your device’s push token is deleted when you sign out; you can also turn push off in your device settings.
- SMS messages are sent through the mobile operator’s SMS gateway. For the 2222 service, you can stop automatic renewal by texting STOP (or DAYAN) to 2222 or by dialling *224*2#.
- Email notifications are sent from our own mail server and only if you choose the email channel.
How long we keep data
We keep data only for as long as needed for the purposes it was collected for:
- Account and profile data — while your account is active.
- Verification codes are valid for 5 minutes; 4-digit discount codes received by SMS are valid for 24 hours. When you confirm a discount yourself, the confirmation card shown on screen is valid for a few minutes.
- Push token — until you sign out or the token becomes invalid.
- Records of subscriptions, payments and discount transactions — for the period required by law for accounting, tax and dispute resolution, including after account deletion.
- Technical logs (IP address, requests, SMS and notification logs) — up to 12 months, for security and troubleshooting.
- Records of self-confirmation attempts (including coordinates) — up to 12 months to investigate abuse; discount transactions created by successful confirmations are kept as transaction records described above.
- Deleted accounts — as described in the next section.
When the period ends, data is deleted or converted into a form that does not identify you (anonymous statistics).
Deleting your account and data
In the app
- Open Profile → Security → Delete account in the app.
- If a phone number is linked, confirm the deletion with the SMS code sent to it.
- The account is closed immediately: you can no longer sign in, push tokens, Google/Apple sign-in links and your subscription are cancelled, and no further charges are made.
If you cannot access the app
Write to support@brandsbox.az stating the phone number linked to your account, or call +994 12 505 48 38. To verify your identity, we may send a code to that number. We complete the request within 30 days.
If you only subscribed to the 2222 SMS service, you can stop the subscription by texting STOP to 2222 or dialling *224*2#, and request deletion of your account and data using the contacts above.
What is deleted and what is kept
After your account is deleted, your profile (name, phone number, email, gender, photo, location), favourites, ratings and comments, notification settings and device data are deleted or anonymised within 30 days. Records of payment and discount transactions may be kept for the period required by law, while technical logs and records of self-confirmation attempts may be kept for the periods stated in “How long we keep data” — they are not used to provide the service.
Account deletion cannot be undone.
Security
- The app and website communicate with our servers only over encrypted HTTPS (TLS) connections.
- The sign-in token is kept in the device’s secure storage; passwords are stored only as hashes.
- Sending and checking SMS codes is protected by rate limits; app requests are signed to protect against automated abuse.
- Access to data is granted on a role basis only to authorised staff who need it for their work.
No method of transmission or storage is completely secure, but we take reasonable technical and organisational measures to protect your data. If a data breach occurs, we will notify you and the relevant authorities where required by law.
Your rights
Under the applicable law you have the right to:
- be informed about the data we process about you, its source, purpose and recipients;
- receive a copy of your data;
- request correction of inaccurate or outdated data (you can change your name, gender, email and phone number yourself in the app);
- request deletion of your data or restriction (blocking) of its processing;
- withdraw your consent and opt out of informational notifications;
- lodge a complaint with the competent public authority or a court if your rights are violated.
To exercise these rights, contact us using the details in “Contact us”. We respond within the time limits set by law and may ask for additional information to verify your identity.
Children’s privacy
Brands’Box is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe such data has been provided to us, write to support@brandsbox.az and we will delete it.
Changes to this policy
We may update this policy to reflect changes in the service or in the law. The updated version is published on this page with a new effective date. We will inform you in advance about significant changes in the app or by notification.
This policy is published in Azerbaijani, English and Russian; if the versions differ, the Azerbaijani text prevails.
Effective date: 7 November 2026.
Contact us
Data controller: SMILE MMC (Brands’Box), Republic of Azerbaijan.
- Email: support@brandsbox.az
- Phone: +994 12 505 48 38
- WhatsApp: +994 50 548 03 43
- Address: 2 M. Afandiyev street, Sabail district, Baku, Azerbaijan
- Working hours: Monday – Friday, 09:00–18:00 (Baku time)
- Website: brandsbox.az
You can also reach us from the “Contact” section of the app.
The Brands’Box app
You can manage your profile, notification settings and account deletion in the app. Questions: support@brandsbox.az.