Privacy notice

Two kinds of people, two different roles

A business signs up to LoyalX and runs a loyalty club. For that business's own account details, LoyalX decides what is collected and why.

The customers of that business join its club. Their details belong to the business, not to LoyalX: the business decides what to collect and what to do with it, and LoyalX holds and processes it on the business's instructions. If you are a customer and want your details changed or removed, the business is the right place to ask first — but you can also ask us and we will act.

What we hold about a business account

When somebody creates a LoyalX account we store:

• Email address, display name and chosen language.
• A password hash, if the account has a password. Passwords themselves are never stored, and we cannot read them.
• If Google Sign-In is used: the Google account identifier and the email and name Google gives us. We ask Google for identity only.
• Sessions, each with the browser's user-agent string and a keyed hash of the IP address. The IP address itself is never written to the database.
• Business details entered during setup: name, legal name, business number, branches, contact and privacy-contact addresses, loyalty programme settings and branding.

This is used to run the account, sign people in, keep the account secure, and contact the business about its own service.

What a business's customers give

When a customer joins a club, the form asks for:

• A first name.
• A phone number or an email address, whichever the business chose as its identifier. At least one is required so the card can be found at the counter.
• The language they chose, and whether they agreed to the notice and terms — with the version of that text and the moment they agreed.
• Whether they said yes to marketing, separately from the terms, with its own version and timestamp.
• Their loyalty activity: stamps, visits, rewards earned and redeemed, which branch and which member of staff served them.

There is no surname field, no address, no date of birth, no free-text note and no profile. LoyalX does not add fields because they might one day be useful.

Marketing messages, and what agreeing to them means

When somebody joins a business's loyalty club, the form asks one optional question: whether they would like to receive special offers, promotions and updates from that business. It is never ticked in advance, it is never combined with the agreement to join, and the club works exactly the same either way.

Email is currently the only way LoyalX delivers marketing. There is no SMS sending and no WhatsApp sending: no provider is connected, and the system refuses a send on either channel rather than attempting it.

If a new delivery channel is ever added, an agreement given under this notice does not carry over to it. Agreeing today means agreeing to what this notice describes, and a channel that did not exist when somebody answered cannot be covered by their answer. A new channel will ask its own question.

Somebody can agree without giving an email address — for example at a business that only collects phone numbers. Their agreement is recorded as given, and they are not included in any email audience, because there is nowhere to send.

Each answer is written to an append-only record holding the exact wording version agreed to, the version of the registration form it appeared on, the time, the business, the customer and the language it was shown in. Changing an answer adds a new record; it never edits or erases the old one.

An agreement can be withdrawn at any time from the customer's own card page, using the same link that shows their stamps. Withdrawing it stops all marketing immediately and does not affect the loyalty card, the stamps or any reward already earned.

A suppressed address is a separate matter from an agreement. If an address bounces or a complaint is received, LoyalX stops sending to that address regardless of what was agreed, because deliverability is a fact about the mailbox and not a statement the person made.

Marketing would be sent by the business whose club was joined, using LoyalX as its delivery service. To be exact about what exists today: no business has ever sent a campaign, and there is no tool in the product for doing so yet — what is built is the consent, the eligibility and the unsubscribe. LoyalX does not market to the customers of any business for its own purposes, and no code path selects a business’s loyalty customers as recipients of a LoyalX campaign.

Wallet cards and QR codes

A loyalty card can be added to Apple Wallet or Google Wallet. The pass carries the customer's first name, their member code, the stamp balance, the reward, and the business's own branding and contact details. It does not carry the customer's phone number or email address.

The QR code on the card is an opaque reference with a signature, not the customer’s details. If a card is closed, the reference stops working and the pass is revoked. For Apple passes we also hold a per-device identifier and a push token so the card can update itself; both are deleted seven days after a pass is revoked, and both remain for as long as the pass is live.

Tracking

LoyalX runs no analytics, no tracking pixels, no advertising tags and no session-recording tools. There is no Google Analytics, no Meta pixel and no third-party script of any kind on this site.

Four cookies are used, all set by LoyalX itself and none for advertising:

• The session cookie, which keeps a signed-in business user signed in. Set when signing in, cleared on sign-out, and valid for at most thirty days.
• A cookie remembering which business you are currently working in, if your account belongs to more than one. Kept for a year.
• A short-lived cookie used only during Google Sign-In, to protect the sign-in from being tampered with. It lasts ten minutes and is deleted as soon as sign-in finishes.
• A cookie remembering whether you chose Arabic, Hebrew or English. Kept for a year.

IP addresses are used to rate-limit abuse and are stored only as a keyed hash, which cannot be reversed to the address. No table in the database holds a readable IP address.

Who else sees the data

LoyalX runs on a small number of services, each of which sees a defined part:

• Vercel hosts the application, in Frankfurt. It processes every request, so in principle it sees anything typed into the site.
• Supabase provides the managed PostgreSQL database, in Frankfurt. It holds all of the data described above. LoyalX uses it as a database only — not for authentication and not for file storage.
• Resend sends transactional email: verification, password resets, staff invitations, support replies and deletion confirmations. It receives the recipient's address and the message.
• Apple receives the contents of a Wallet pass and the push notifications that update it, but only when a customer chooses to add a pass.
• Google receives the contents of a Wallet pass when a customer adds one, and handles Google Sign-In for business accounts that use it.

Nothing else. There is no object storage, no payment processor connected, no SMS provider, and no advertising or analytics platform.

Hosting and the database are in the European Union. Apple and Google process data outside it. The legal basis for those transfers is one of the points flagged above as needing professional review.

How long things are kept

A daily job enforces these automatically:

• Expired sessions are removed after a day; revoked ones after thirty days.
• Password-reset links last one hour, email verification links forty-eight hours, and deletion confirmation links two hours. Expired links are deleted a week later.
• Messages sent through the contact form are deleted after twelve months.
• A business data export is destroyed the moment it is downloaded, and in any case no later than the next daily maintenance run after it expires — it expires twenty-four hours after it is created.
• Loyalty transactions, consent records and the audit log are kept indefinitely and cannot be edited or deleted, including by us. They are the record of what happened, and they are what makes a disputed balance resolvable.

Not everything has a timer, and it would be misleading to list only the things that do. Kept indefinitely, with no automatic deletion: customer records and their loyalty history; consent records; the audit log; security events (a user id and a keyed hash of an IP address); pending and accepted staff invitations, which hold the invitee’s name and email address; business and branch contact details; and unsubscribe records. Unsubscribe records are kept on purpose and for the person’s benefit: the only way to honour "never contact me again" is to remember the address that asked.

Getting the data out

A business owner can download everything LoyalX holds about their business — profile, branches, programmes, customers, cards, balances, the full transaction history, rewards, staff, consent records and the activity log — as an archive of CSV files with a description of each.

The archive deliberately excludes anything that would be a credential: passwords, session tokens, two-factor secrets, Wallet pass tokens and customer card tokens. The download link is shown once, works once, and the file is destroyed as soon as it has been handed over.

Deleting a business, and what that means

An owner can ask for their business to be deleted. The request has to be confirmed by email and then waits fourteen days, during which the business is read-only and the owner can cancel. Nothing is erased before that.

It is worth being exact about what happens then, because it is not what "delete" usually implies:

• Every customer’s name, phone number and email address is erased from their customer record, and their marketing consent is withdrawn.
• One exception, and it is deliberate: if that customer had previously unsubscribed or their address had bounced, the address itself stays on the business’s do-not-contact list. Forgetting it would mean the next time it was collected there would be nothing to stop them being contacted again.
• The transaction ledger, the consent records and the audit log are kept. They are append-only and cannot be removed. What survives is a record that a stamp was given at a time to a customer who no longer has a name attached.
• Every card is closed, its link stops working, unredeemed rewards are voided and Wallet passes are revoked, so the card disappears from the customer's phone.
• The business account itself is closed and suspended rather than dropped from the database.
• The business owner’s and staff members’ own accounts are not deleted by this. Their names, email addresses and sign-in details belong to their LoyalX accounts rather than to the business, and those accounts continue to exist. Anyone who wants their own account removed should ask us directly.

An individual customer can be removed the same way without the whole business being deleted. Ask the business, or ask us.

How it is protected

• Every business's data is separated at the database level, not only in application code. A query that forgot to filter by business would return nothing rather than somebody else's customers.
• Passwords are hashed with argon2id. We cannot recover them and neither can anyone who obtained the database.
• Reset links, verification links, download links and card references are stored as hashes. A copy of the database yields no working links.
• Platform administrators use two-factor authentication, and the shared secret is encrypted at rest under a key that is not in the database.
• Administrative actions are written to an append-only log that the application itself has no permission to alter.

Your rights

You can ask what is held about you, ask for a copy, ask for it to be corrected, ask for it to be erased, and withdraw consent to marketing at any time. Withdrawing marketing consent does not affect the loyalty card.

If you are a customer of a business, ask that business first — they decide what happens to their customer records. You can also reach us directly: Contact LoyalX

Age

Joining a loyalty club requires confirming you are 16 or older. LoyalX is not intended for children and we do not knowingly collect their details.

Changes

When this notice changes materially, the version customers accept when they join changes with it, and the new version is recorded against each acceptance. So it is always possible to tell which text a given person agreed to.

Current version of the joining notice: join-2026-09-v1