Privacy Policy

This Privacy Policy explains how [COMPANY LEGAL NAME] ("LoyVue", "we", "us") collects, uses and protects personal data when you visit loyvue.com, use the LoyVue dashboard or branch apps, or hold a loyalty card issued through LoyVue.

1. Who we are and our role

LoyVue is a software service that lets businesses ("Businesses" or "merchants") create digital loyalty programs and issue loyalty cards to their customers ("Cardholders").

• For merchant accounts (the people who sign up and use the dashboard), LoyVue is the data controller.
• For Cardholder data (the customers of a Business), the Business is the data controller and LoyVue acts as a data processor, handling that data only on the Business's instructions to provide the service. If you are a Cardholder, please direct privacy requests to the Business that issued your card; we will support them in answering you.

Controller contact: [COMPANY LEGAL NAME], [REGISTERED ADDRESS], [PRIVACY EMAIL]. [DATA PROTECTION OFFICER / EU OR UK REPRESENTATIVE, IF APPLICABLE]

2. Data we collect

Merchant account data

• Account details: full name, business name, email address and password (stored as a secure hash, never in plain text).
• Workspace settings: locations (including addresses and map positions), programs, rewards, products or services, card designs, team members and their roles.
• Billing data: plan, billing period and subscription status. Card payments are handled by Stripe; we do not receive or store full card numbers.
• Communications: messages you send through our contact form or by email.

Cardholder data (processed for Businesses)

• The details entered when a card is issued, such as name and phone number.
• Loyalty activity: card number, program, visits, stamps, points, amount spent, rewards earned and redeemed, transaction dates, the service purchased and the location.
• Wallet data: which wallet the card was added to (Apple Wallet or Google Wallet) and the technical registration needed to update the card on a device.
• If a Business connects an e-commerce integration such as Salla, order information received from that platform to credit loyalty balances.

Technical data

• Log and security data such as IP address, browser type, device information and the pages or actions requested, used to run and protect the service.
• Branch app data: app version and platform, used to check for required updates. The camera is used only to scan loyalty card codes.

3. How we use data and legal bases

• To provide the service (create accounts, issue and update cards, record visits and rewards, run the dashboard and branch apps) — performance of our contract with the Business.
• To process payments and manage subscriptions through Stripe — performance of contract.
• To send service emails such as password resets, security notices and platform announcements — contract and legitimate interest.
• To keep LoyVue secure and prevent fraud and abuse — legitimate interest.
• To comply with legal obligations, such as tax and accounting records — legal obligation.
• To answer your messages — legitimate interest.

We do not sell personal data, we do not use it for advertising, and we do not use analytics or advertising trackers on our website.

4. Service providers we share data with

We share data only with providers that help us run LoyVue, under contracts that require them to protect it:

• Stripe — payment processing and subscription billing. Stripe processes payment data under its own privacy policy.
• Apple (Apple Wallet) and Google (Google Wallet) — to deliver cards to phones and push card updates. Once a card is in a wallet, the wallet provider's own privacy terms also apply.
• Salla — only when a Business chooses to connect its Salla store.
• OpenStreetMap — map tiles and address search in the dashboard; your browser sends requests, including your IP address, to OpenStreetMap servers.
• Hosting and infrastructure — [HOSTING PROVIDER AND REGION].
• Email delivery — [EMAIL DELIVERY PROVIDER].

We may also disclose data if required by law, to protect our rights or users' safety, or as part of a merger or acquisition, in which case this policy will continue to apply.

5. International transfers

Some providers, including Stripe, Apple and Google, may process data outside your country, including in the United States. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses.

6. How long we keep data

• Merchant account and workspace data: for as long as the account is open, then deleted within [DELETION PERIOD, e.g. 30 days] of account closure, except where we must keep it longer.
• Cardholder data: for as long as the Business keeps it in LoyVue, or until the Business's account is closed.
• Billing and invoice records: for the period required by tax and accounting law [RETENTION PERIOD].
• Backups: removed on a rolling basis within [BACKUP RETENTION PERIOD].

7. Account and data deletion

• Merchants can ask us to close their workspace and delete its data by writing to [PRIVACY EMAIL] from the account's email address. Before closing, you can ask us for an export of your customer and visit data.
• Businesses can ask us to export or delete a specific Cardholder's record.
• Cardholders can remove a card from Apple Wallet or Google Wallet at any time, which stops further updates to that device. To have your loyalty record deleted, contact the Business that issued the card; if you can't reach them, write to [PRIVACY EMAIL].

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive it in a portable format, and to withdraw consent. You also have the right to complain to your local data protection authority. To exercise these rights, contact [PRIVACY EMAIL]. We will answer within the time required by law and may need to verify your identity.

9. Security

We use encryption in transit (HTTPS), hashed passwords, access controls and role-based permissions for team members. No system is completely secure, so please use a strong password and tell us immediately at [SECURITY EMAIL] if you suspect unauthorised access.

10. Children

LoyVue is a business service and is not directed at children. Businesses must not use LoyVue to collect data from children below the age of digital consent in their country without the permission required by law.

11. Cookies

We use only the cookies needed to run the website and dashboard. See our Cookie Policy.

12. Changes

We may update this policy as LoyVue changes. We will post the new version here with a new date and, for significant changes, notify account owners by email or in the dashboard.

13. Contact

Questions about privacy: [PRIVACY EMAIL] or our Contact & Support page.