LEGAL

Privacy policy

Last updated: 23 October 2026

This privacy policy explains how LOYIAL processes personal data when you visit loyial.com, create or use a merchant account, use a LOYIAL loyalty card, contact us, subscribe to a paid plan, or install the LOYIAL Merchant progressive web app.

1. Who is responsible for your data?

For the LOYIAL website, merchant accounts, billing administration, support and our own analytics, the controller is the person or legal entity operating LOYIAL. You can contact us about privacy at hello@loyial.com.

When a business uses LOYIAL to run its loyalty programme, that business is generally the controller of its customers’ loyalty data: for example, membership, card, points, visit, reward and point-request data. LOYIAL processes that data to provide the service on the business’s instructions. If you use a customer card, you may therefore also contact the relevant business about its processing of your loyalty data.

The legal name, registered address and other statutory details of the controller should be added to this notice before publication where LOYIAL is operated through a legal entity different from the LOYIAL brand.

2. What data we process

Merchant account and business data

We process the account email address, a securely hashed password, the business name and category, uploaded business logo, loyalty programme settings, offers, onboarding progress, security settings and actions taken in the dashboard. We do not store your password in readable form.

Customer loyalty data

A customer can join a business without providing an email address, telephone number or password. The service creates a random browser identifier and associates it with the customer’s cards. We may process the identifier, card number, membership, points, visits, point requests, rewards and redemptions for the relevant business. A QR code contains an opaque or signed identifier used by the service; it is not intended to contain a customer’s name or contact details.

We do not ask the customer to provide special-category data, such as health, biometric, political or religious information. Businesses must not enter such data into loyalty settings, offers or free-text fields.

Security and device data

For merchant authentication and security we process session information, login and security events, and, when enabled, two-factor authentication data. If you enable push notifications, we store the subscription endpoint and the cryptographic keys supplied by your browser so that a notification can be delivered to that device. We do not use push subscription data to identify customer-card users.

Contact messages

If you contact us, we process the name, email address, optional business name or telephone number, and the message you send. We use these details to respond, handle support and keep a reasonable record of the communication.

Payments and subscriptions

Subscriptions are handled through Stripe Checkout and the Stripe customer portal. LOYIAL stores identifiers and subscription state needed to provide access and show billing status, such as a Stripe customer ID, subscription ID, price, status, billing-period end and whether cancellation at period end was requested. LOYIAL does not receive or store the full payment-card number or the card security code. Stripe processes payment information under its own privacy documentation and the applicable agreement with the merchant.

3. Website analytics and advertising attribution

Optional analytics and marketing measurement are off by default. With “Analytics”, the public website may record a random pseudonymous browser identifier, page and section views, approximate scroll depth, time spent, button clicks and contact-form stages. We do not record the values typed into the contact form as analytics events.

With “Marketing measurement”, we may record the referring host, UTM source, medium and campaign, and only whether advertising identifiers such as fbclid, gclid or msclkid were present. We do not store the raw values of those click IDs in our analytics events or IP addresses as an analytics event field. Source totals are stored in aggregate without a visitor ID.

Where Google Analytics 4 or Meta Pixel has been configured, each is loaded only after the corresponding consent. Meta Pixel may receive standard events such as PageView and CompleteRegistration to measure visits and successful free registrations only when marketing measurement is allowed. We do not intentionally send names, email addresses, card numbers, QR tokens or dashboard data to Google Analytics or Meta Pixel. Google and Meta may process technical data under their own privacy terms.

You can choose “Essential only”, “Analytics”, “Marketing measurement” or “Accept all” in the banner, and change your choice from “Cookie settings” in the footer of the home page. Refusing analytics or marketing measurement does not prevent you from using LOYIAL.

4. Why we use the data and our legal bases

To create and operate merchant accounts, loyalty cards, points, offers, requests, rewards and the dashboard: performance of the service contract or steps requested before entering into it.
To process subscriptions, invoices and access status: performance of the subscription contract and compliance with legal obligations.
To answer contact and support requests: steps taken at your request, performance of a contract where applicable, or our legitimate interest in handling business communications.
To protect the service, prevent abuse, enforce access controls and investigate security incidents: our legitimate interest in operating a secure service.
To comply with tax, accounting, legal and regulatory obligations: compliance with a legal obligation.
To measure the public website: your consent for Analytics.
To measure campaign performance and source attribution: your separate consent for Marketing measurement.

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Dashboard statistics and campaign reports are operational information, not automated decisions about individuals.

5. Cookies, local storage and similar technologies

LOYIAL uses necessary cookies for login sessions, security and the customer-card experience. The customer-card cookie is a random value used to recognise the same customer browser; it does not contain the customer’s name, email or points. It is currently designed to last for up to one year and can be removed by clearing browser data. Removing it may make previously stored cards unavailable on that browser.

For optional Analytics and Marketing measurement, the browser stores your consent choice. The random analytics identifier is created only with Analytics consent, while attribution information is used and stored only with Marketing consent. We do not use advertising cookies on the public website by default.

Stripe may set or read technologies when you leave LOYIAL for Stripe Checkout or the billing portal. Stripe’s own privacy information applies to that processing.

6. Who may receive data?

We do not sell personal data. We may disclose data only as needed to operate the service, including to:

hosting, infrastructure, database, backup and technical service providers;
email or SMTP providers used to deliver support and operational messages;
Stripe for checkout, subscriptions, billing portal and payment-related processing;
Google Analytics, only if configured and you have given Analytics consent;
Meta Pixel, only if configured and you have given Marketing consent;
browser push services, such as the service used by the relevant operating system or browser, when a merchant enables notifications;
public authorities, courts, advisers or other recipients where disclosure is required by law or necessary to protect rights and security.

Service providers process data under appropriate contractual arrangements and only for the purposes for which they are engaged. Some providers may process data outside the European Economic Area. Where required, we use an adequacy decision, standard contractual clauses or another lawful transfer mechanism and apply appropriate safeguards.

7. How long we keep data

We keep merchant account and loyalty data while the account or business programme is active and for as long afterwards as reasonably necessary for security, disputes, accounting, legal obligations and legitimate business records. We delete or anonymise data when it is no longer needed for those purposes.

Contact messages are kept for as long as needed to answer and manage the request, and for a reasonable period afterwards where necessary to document the communication or resolve a dispute. Billing and transaction records may be retained for the period required by tax, accounting and payment obligations. Analytics events are kept only for operational measurement and are deleted or aggregated when they are no longer needed.

Because the exact retention period can depend on the business, plan, legal obligation and type of record, we can provide the applicable retention information when responding to a specific request.

8. Your rights

Subject to the conditions and limits of data-protection law, you may have the right to request access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. Where processing is based on consent, you can withdraw consent at any time; withdrawal does not affect processing carried out before withdrawal.

Merchant users can contact us at hello@loyial.com. A customer should normally contact the business whose loyalty programme they joined; LOYIAL will assist the business where it processes the data on the business’s behalf. We may ask for reasonable information to verify identity and protect another person’s data.

We normally respond without undue delay and, in any event, within the period required by applicable law. You also have the right to lodge a complaint with the supervisory authority in your country. In Greece, the competent authority is the Hellenic Data Protection Authority.

9. Security

We use measures appropriate to the risk, including password hashing, authenticated sessions, secure cookie settings in production, CSRF protection, access controls, two-factor authentication where enabled, signed customer QR tokens, rate limiting and encrypted transport. No internet service can guarantee absolute security. If we become aware of a personal-data breach that requires notification, we will follow the applicable legal process.

10. Children and sensitive data

LOYIAL is a business loyalty service and is not directed at children. We do not intentionally collect children’s contact details or special-category data. Businesses are responsible for using the service lawfully and for not requesting unnecessary personal information from customers.

11. Changes to this policy

We may update this policy when the service, suppliers or legal requirements change. The “Last updated” date at the top shows when the current version was published. If a change materially affects the way we use data, we will provide an appropriate notice where required.

12. Contact

For privacy questions, rights requests or concerns, email hello@loyial.com. Please include enough information for us to understand whether your request relates to a merchant account, a customer card, a contact message, analytics or billing.