Privacy Policy
Last updated: 26 July 2026
This Privacy Policy explains how LoyalFlow ("LoyalFlow", "we", "us") collects, uses, and protects personal information when you use our digital loyalty-card platform (the "Service"). It applies to business owners who run loyalty programs with us, and to customers who join a business's loyalty program through us.
For the customers of a business, that business decides what data is collected and why (it is the "data controller"), and LoyalFlow processes that data on the business's behalf (as a "data processor").
1. Information we collect
From business owners: name, email address, hashed password, business details (name, address, logo), and billing information processed by our payment provider.
From customers who join a program: full name, date of birth, phone number, optional email address, and loyalty activity (visits, points/stamps, rewards redeemed). This information is used to create and update your digital wallet card.
Automatically: a single essential session cookie to keep you signed in, and basic technical logs needed to operate and secure the Service.
2. How we use information
To create and manage loyalty memberships; to issue and update your Apple Wallet / Google Wallet card; to send loyalty notifications you have opted into; to provide dashboards and analytics to the business; to process subscription billing; and to keep the Service secure and working.
3. Legal basis and consent
We process customer data on the basis of the consent you give when you join a program, and to perform the loyalty service you requested. You may withdraw consent at any time (see "Your rights" below).
4. Who we share it with
We share data only as needed to run the Service: with the business whose program you joined; with wallet providers (Apple and Google) to issue your card; with our payment processor (Stripe) for billing; and with infrastructure providers that host the Service. We do not sell your personal data.
5. Data retention
We keep personal data for as long as your membership or account is active, and only as long afterwards as needed for legal, accounting, or security purposes. You can request deletion sooner (see below).
6. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to withdraw consent or object to certain processing. To exercise these rights, contact us or the business that runs the program. We respond within the timeframes required by applicable law.
7. Security
Passwords are stored hashed, sessions are protected, and access to data is restricted. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your information.
8. International transfers
Your data may be processed in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.
9. Children
The Service is not directed to children under the age required by local law to consent to data processing, and we do not knowingly collect their data.
10. Changes to this policy
We may update this policy from time to time. Material changes will be reflected by updating the date above.
11. Contact
Questions about privacy? Contact us at privacy@loyalflow.dev.