Privacy Policy

If you run a business that uses LoyaltyOS — we hold your account and your business records, and we decide how they are handled. This policy governs that directly.

If you scanned a QR code at a shop and joined their rewards — the shop decides what to collect about you and what to do with it. We hold that information on their behalf and act on their instructions. Practically: we can tell you what we hold and pass a request on, but if you want your record deleted or corrected, the shop is the one who can decide it, and asking them directly is faster.

One person can be a customer of several shops. Each of those is a separate record with a separate shop deciding about it, even though you only ever verified your phone number once.

From a business owner or member of staff:

• Name and email address, and a password — or, if you sign in with Google or Apple, the name and email address they give us. We never receive your Google or Apple password.
• Business details: trading name, industry, address, timezone, phone number, and the locations you add.
• A record of significant actions taken in the account — who voided a transaction, who changed a reward, who merged two customer records — so that a business can answer its own questions about its own till.

From a customer of one of those businesses:

• A mobile phone number, verified by a one-time code. This is the only piece of information the system genuinely requires, because it is what makes your card yours.
• Optionally, and only if given: an email address, a name, and a birthday.
• Your activity at that business: visits, purchases and their amounts, points earned and spent, rewards earned and redeemed, gift card balances, and who referred you if anyone did.
• Anything the shop writes down about you themselves — a note, or a tag like “regular” or “oat milk”. What goes in there is the shop’s choice, not ours.

Collected automatically:

• Standard server records — IP address, browser, the page requested, the time — kept to keep the service running and to investigate abuse.
• An anonymous scan identifier, described under Cookies below.

This is the part most worth understanding, so it gets its own section.

Your phone number identifies one person. Your membership of a particular shop’s rewards is a separate record attached to that shop. A shop can see the record that belongs to them — your visits there, your points there, your balance there — and cannot see that you are a customer of any other business, cannot see what you spent elsewhere, and cannot see the underlying identity that connects them.

That separation is enforced by the database itself, on every query, rather than by the application remembering to filter. A shop that knows you as “Big Mike” has renamed their own copy of the record; it does not rename you anywhere else.

• To run the thing: award points, track rewards, hold gift card balances, and show a shop who its customers are.
• To show a business its own numbers — busiest hours, repeat rate, what sells with what.
• To send the messages described below, when they have been agreed to.
• To bill merchants, support them, and investigate fraud or abuse.
• To comply with the law when we are required to.

We do not sell personal information, and we do not share it for advertising. There are no advertising networks in this product and no third-party analytics scripts on its pages.

We also do not pool one shop’s customer data into a product sold to another. Aggregate figures shown to a merchant are computed from that merchant’s own records.

There are three, all set by this site, and none belonging to anyone else.

sb-…-auth-tokenEssential · 30 days, or until the browser closes if you did not tick Remember me.

Keeps you signed in. Without it, every page would ask again.

loyaltyos.persistEssential · 30 days.

Remembers whether you ticked Remember me, so the choice survives the next sign-in.

loyaltyos_scanMeasurement · 1 year.

A random number with no name attached, so that one person scanning four times is not counted as four people. It is salted and hashed before it reaches the database, is never linked to an account, and cannot be used to follow anyone from one business to another.

The last one deserves a sentence of its own. A shop wants to know whether fifty scans were fifty people or one person scanning fifty times, and that question needs an identifier. So it gets a random number that means nothing, which is combined with a secret and hashed before it is stored, so that even someone holding the raw table cannot use it to follow a person between businesses. It is never attached to an account.

Marketing texts and marketing emails are off unless you turn them on. That is the default in the database, not a setting someone has to remember to choose.

Service messages are different and are not marketing: a one-time code to verify your phone, a receipt, a note that a reward you earned is about to expire.

• Every marketing email carries a one-click unsubscribe that works from your mail app’s own button, with nothing to log into.
• Texts come from the shop you signed up with. Message frequency varies, and message and data rates may apply. Reply STOP to stop, or HELP for help.
• We never share your mobile number, or your consent to receive texts, with third parties or affiliates for their marketing or promotional purposes.
• An opt-out applies to the shop that sent the message. Leaving one shop’s list does not remove you from another’s, because they are separate businesses who each asked you separately.

The shop, not us, decides what it sends and is responsible for having been allowed to send it.

Businesses on some plans can ask an AI advisor questions about their shop. Those questions are answered by a model run by Anthropic, and what gets sent to it is limited on purpose: counts, hours, segment sizes and product totals — never names, phone numbers, email addresses, or any individual customer’s record.

A merchant asking “who hasn’t visited in thirty days?” gets told there are thirty-four such customers and what to do about it; the list itself is produced by a database query on our side, under the same rules as every other screen. The model never sees it.

These companies process data so that the service can work. They are bound to use it only to provide their part of it.

SupabaseDatabase, authentication and file storage. This is where the data lives.

Everything: accounts, customers, transactions, gift card balances.

VercelApplication hosting and the network the site is served over.

Requests in transit, and standard server logs.

StripeSubscription billing for merchants.

The merchant's own billing contact and payment method. No customer data.

ResendSending email — receipts, invitations and merchant campaigns.

Recipient email address and the contents of the message.

TwilioSending SMS — verification codes and merchant campaigns.

Recipient phone number and the contents of the message.

AnthropicThe AI advisor.

Aggregate figures only — counts, hours, segment sizes, product totals. No names, phone numbers, email addresses or per-customer records.

Beyond that list, we disclose information only where the law requires it, where it is necessary to investigate fraud or protect someone, or — if the business is ever sold or merged — to the buyer, who would be bound by this policy until they gave you notice of a different one.

These companies operate in the United States. Data is stored and processed there.

• A customer’s record is kept for as long as the shop’s account is active, because it is what their rewards balance is made of.
• Points and gift card entries are an append-only ledger: an entry is never edited or removed. A correction is recorded as its own entry alongside the original. This is how a balance can be proven rather than merely asserted, and it means a mistake stays visible instead of vanishing.
• When a record is deleted it is first marked as deleted and stops appearing anywhere, then removed.
• After a merchant cancels, their data is kept for 30 days so that a change of mind or a billing dispute does not destroy a shop’s history, and is then deleted. We email the owner seven days beforehand, and that email carries a link that stops the deletion for as long as they want. Nothing is deleted that was not warned.
• One thing survives that deletion: the balance left on gift cards nobody has spent, kept as an amount and the last four digits, with no customer attached. That money is still owed to whoever holds the card, and deleting the record of it would not make the debt go away.
• Records we are required to keep — invoices and tax records — are kept for as long as the law requires, regardless of the above.

You can ask us for a copy of what we hold about you, ask for it to be corrected, ask for it to be deleted, and opt out of marketing at any time. Where local law gives you more than that — California, the European Union, the United Kingdom and others do — those rights apply and we handle the request the same way.

We will not treat you differently for exercising any of this. A customer who opts out of marketing keeps their points.

• Traffic is encrypted in transit, and data is encrypted at rest.
• Access between businesses is enforced in the database on every query, not by application code choosing to filter.
• Staff access inside a business is limited by role, and significant actions are recorded against the person who took them.
• No payment card numbers are stored, because none are received.

No system is perfectly secure, and anyone who tells you otherwise is selling something. If you believe an account has been compromised, write to support@loyaltyos.tech and we will treat it urgently.

This service is for businesses and their adult customers. It is not directed at children under 13 and we do not knowingly collect their information. A shop should not enrol a child in a rewards programme that collects a phone number. If you believe we hold information about a child, write to us and we will delete it.

When this policy changes, the date at the top changes with it. If a change materially affects how information is used, merchants will be told directly rather than left to notice.

Status X Technologies
247 Lodias Road
Lafayette, Louisiana 70508
United States
privacy@loyaltyos.tech

The companion document is the Terms of Service.