Privacy Policy

LoyaltyLoop ("LoyaltyLoop", "we", "us", "our") provides a digital loyalty-card platform that lets local businesses ("Business Owners") replace paper stamp cards with a QR-code-based digital loyalty program for their customers ("Card Holders"). This policy explains what personal data we collect from both groups, why we collect it, who we share it with, and what rights you have over it. It applies to loyaltyloop.co and app.loyaltyloop.co.

We are a small, sole-operator business. If anything here is unclear, the fastest way to get an answer is to email us directly — see Contact & data requests below.

1. What data we collect

If you sign up as a Business Owner

When you create a LoyaltyLoop account, we collect your name, email address, password, business name, business phone number, sector, brand color, and (optionally) a logo image. If you subscribe to a paid plan, our payment processor Stripe collects and stores your payment card details directly — we never see or store your full card number.

If you scan a loyalty card as a Card Holder

When you scan a business's QR code to collect a stamp, we collect your phone number (used as your unique identifier for that business's card) and, if you choose to provide them, your name and email address. Card Holders do not create a password or log in to any account — there is no Card Holder login system.

Automatically collected data

Our hosting providers (Vercel for the marketing site, Bubble.io for the application) may automatically log standard technical information such as IP address, browser type, and request timestamps, for security and operational purposes. We do not currently run any analytics or advertising tracking on either site.

2. Why we use your data

• To create and operate your Business Owner account and loyalty cards
• To record and track stamp collection and reward redemption for Card Holders
• To process subscription payments and communicate about your subscription (trial reminders, payment receipts, failed-payment notices)
• To send transactional emails you'd reasonably expect (welcome emails, reward-earned notifications, password resets)
• To generate Apple Wallet / Google Wallet passes when you request one
• To maintain the security and proper functioning of the service

Our legal basis for this processing is primarily performance of a contract (providing the service you signed up for or that a business owner is using to serve you), and legitimate interest in keeping the service secure and functioning correctly.

3. Who we share data with

We don't sell your data. We share it only with the service providers ("processors") that make LoyaltyLoop work:

• Bubble.io — hosts our application and database
• Vercel — hosts our marketing website and a small backend service used for payments and wallet-pass generation
• Stripe — processes subscription payments; handles and stores your payment card details under its own security standards
• Brevo — sends transactional emails on our behalf (welcome, reward, and billing-related emails)
• Apple and Google — when you request a wallet pass, the relevant stamp-count and branding information is sent to Apple Wallet / Google Wallet to generate that pass

These providers may process data on servers located outside your country, including outside the UK/EEA. Each of them maintains its own security and compliance program (Stripe, Bubble, Vercel, and Brevo all publish their own data-processing and security documentation); we choose providers that offer appropriate safeguards for international data transfers.

4. How long we keep your data

We keep Business Owner account data for as long as your account is active, and Card Holder data for as long as the loyalty card it's attached to exists. Business Owners can permanently delete their account and all associated data at any time via Settings; for all other deletion requests (see below), we will delete your data within a reasonable period, except where we're required to keep certain records (e.g. payment records) for legal or tax purposes.

5. Your rights

If you're in the UK or EEA (and as a matter of good practice for everyone, regardless of location), you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Request a copy of your data in a portable format
• Object to or restrict certain processing
• Withdraw consent at any time, where processing is based on consent

Business Owners can delete their own account and all associated data (loyalty cards, customers, stamps, rewards, and locations) immediately and permanently at any time from Settings — no need to contact us. To exercise any other right, or if you're a Card Holder requesting deletion, email us — see below. As a small team, we handle these requests manually and will respond within 30 days.

6. Security

We restrict access to Business Owner and Card Holder data so that a business can only ever see its own customers' data, never another business's. Payment card data is handled entirely by Stripe and never touches our own systems. No method of transmission or storage is 100% secure, but we take reasonable technical and organizational measures to protect your data.

7. Cookies

Our marketing website does not currently use any tracking, advertising, or analytics cookies. Our hosting providers may set strictly necessary technical cookies required for the site to function. If this changes in the future, we will update this policy and, where required, ask for your consent.

8. Children's data

LoyaltyLoop is intended for use by business owners (adults running a business) and their customers. It is not directed at children, and we do not knowingly collect data from anyone under 16.

9. Changes to this policy

We may update this policy as the service evolves. We'll update the "Last updated" date above when we do. Material changes will be communicated to Business Owners by email.

10. Contact & data requests

For any question about this policy, or to request access to, correction of, or deletion of your data, email hello@loyaltyloop.co.