Privacy policy

This is a translation for convenience. In case of any discrepancy, the Spanish version prevails.

This policy explains how personal data is processed at Loyaltygo, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Who processes your data

Owner: Diego Ceniceros, tax ID (NIF) 33006489V, with address at Calle Espartinas 6, 28001 Madrid (España). Contact: soporte@loyaltygo.io.

Loyaltygo’s role depends on who you are, and it is worth telling apart because it changes whom you should contact to exercise your rights:

If you are the owner of a business that signs up for the service, Loyaltygo is the controller of your account data.
If you are a customer of a business and have obtained its loyalty card, the controller is that business: it is the one that decides what is done with your data. Loyaltygo acts as processor, that is, it processes that data solely following the business’s instructions and in order to provide it with the service.
If Loyaltygo has contacted your business to introduce the service, Loyaltygo is the controller of the contact details it used (section 4).

If you only visit the website, in order to know how many people visit it and where they come from, visits are counted in aggregate with Vercel Web Analytics. It does not set cookies or store anything in your browser: each visit is grouped with an identifier that is calculated on the server and discarded after 24 hours, and it does not allow you to be tracked across other websites. Loyaltygo is the controller of this measurement, on the basis of its legitimate interest in improving the website (Article 6(1)(f) of the GDPR). It is not used in the businesses’ dashboards, in the scanner or in the sign-up form for each business’s customers.

2. If you are the owner of a business

What data is processed

Account data: business name, email address and encrypted password.
If you sign in with Google, the basic profile data that Google shares when you sign in.
Subscription and billing data, handled by the payment gateway.
Minimal technical usage and security data (for example, the IP address in the logs).

For what purpose and on what legal basis

Providing the service, maintaining your account and giving you support — performance of the contract.
Charging the subscription and complying with tax and accounting obligations — legal obligation and performance of the contract.
Keeping the service secure, preventing abuse and logging errors — legitimate interest in the service working and not being used fraudulently.
Sending you essential notices about your account — performance of the contract. No commercial communications are sent without your consent.

How long

For as long as the account is active. If you delete it, the account data and your customers’ data are deleted immediately, except for information that must be kept due to a legal obligation (for example, billing, for the applicable tax and commercial retention periods).

If you create your card from Claude or ChatGPT

If you use the Loyaltygo connector in Claude or ChatGPT, we keep the design of the card you create (business name, type, stamps, reward and, if you upload it, your logo) for 90 days, so that you find it just as it was when you create your account.

If you connect your email to send campaigns

You can choose to have your campaign emails, birthday greetings and test emails sent from your own address. It is optional: if you don’t, they are sent from Loyaltygo’s email.

Gmail or Outlook: when you connect it, Google or Microsoft give us only the permission to send email on your behalf (in Google, gmail.send; in Microsoft, Mail.Send) and your email address. We cannot read, delete or modify your emails, or see your contacts.
That permission is used solely to send the emails you create in Loyaltygo to the customers who agreed to receive them. It is not used for anything else: it is not sold, not passed on to anyone, and not used for advertising or to train artificial intelligence models, and no person looks at it unless you ask for it in order to give you support or the law requires it.
The permission is stored encrypted. When you disconnect your email, or delete your account, it is deleted and, in Google, revoked. You can also withdraw it whenever you want from your Google account or your Microsoft account.
Loyaltygo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Your domain: if you choose to send from an address on your own domain, we register it with our sending provider (Resend) solely for sending, with the technical records that you add to your domain. When you disconnect it, it is removed.

3. If you are a customer of a business

The business that gave you the card is the controller of your data. Loyaltygo processes it on behalf of that business and does not use it for its own purposes, sell it or pass it on to anyone beyond the providers listed in section 6.

What data is processed

The data you provide when obtaining the card: name, email address and, if you wish, phone number and the day and month of your birthday (without the year). Your birthday is used solely to send you greetings on that day, and leaving it blank does not affect your card.
Your card activity: stamps or points collected, redemptions and the date of each transaction.
Technical data needed for the card to update on your phone, and the IP address and date on which you gave your consent to receive communications, if you gave it.

For what purpose and on what legal basis

Issuing your card, recording your stamps and allowing you to redeem the reward — the relationship you have with the business by requesting the card.
If the business turns it on, notifying you on your card when you have not visited for a while, with a few days to come back for an extra stamp or some extra points. Only the date of your last visit is used, within the relationship you have with the business. It is a notification on your own card, not an email: you can silence it by turning off the card’s notifications in your Wallet.
If the business turns it on, writing to you only once by email, a few hours after you obtain the card, to ask how it went and ask for your review on Google — the legitimate interest of the business in knowing its customers’ opinion, within the relationship you have with it (Article 6(1)(f) of the GDPR and Article 21(2) of the LSSI). We tell you about it in the form, where you can tick that you prefer not to be written to, and the email includes its unsubscribe link. It is only recorded if you press the button in the email.
Sending you the business’s commercial communications — only with your consent. The box is not pre-ticked: you are only subscribed if you tick it yourself, and we keep the date and the IP address from which you ticked it as proof of that consent. You can withdraw it whenever you want from the unsubscribe link in any email, without this affecting your card.

How long

For as long as the business keeps its account and your card active. If the business deletes your record or closes its account, your data is deleted.

4. If Loyaltygo has contacted your business

To make the service known, Loyaltygo contacts businesses, mainly in hospitality and local retail, and companies that work with them (roasters, distributors, brands, software and industry associations) to propose a collaboration, using contact details that are public or professional. In this case Loyaltygo is the controller.

What data is processed

The business’s public data: name, type of business, address, phone number, website, and rating and number of reviews on Google Maps.
The professional contact details that the business itself publishes on its website or in its profiles (email, Instagram, LinkedIn) and, if listed, the name and position of the contact person.
For the professionals of the companies to which a collaboration is proposed: their name, position, LinkedIn profile and, if it appears on that profile, where they studied.
The contact history: when and through which channel they were written to, and whether they replied.

Where it comes from

From Google Maps, the business’s own website, its public social media profiles and professional databases of prospecting providers. The first message states where the data was obtained.

For what purpose and on what legal basis

Presenting Loyaltygo’s service to the business, or proposing a collaboration to the company — legitimate interest in making it known to companies that may find it useful. Commercial emails are sent only to business addresses, never to personal addresses, and every message allows you to ask not to be written to again.

How long

If there is no reply, the data is deleted after twelve months. If you ask us not to contact you, it is deleted and only the minimum data (the email, the phone number or the profile) is kept on a suppression list, so that you are never contacted again.

Providers involved

Apify — Collection of the businesses’ public data on Google Maps, on their website and on their public profiles. Location: European Union and United States (standard contractual clauses).
Bouncer — Checking that business email addresses exist before writing to them. Location: European Union (Poland and Germany).
Lemlist — Sending of the introductory emails and LinkedIn messages, and recording of the replies. Location: European Union (standard contractual clauses if any data leaves the EEA).
Google — Email inboxes from which the messages are sent (Google Workspace). Location: European Union and United States (standard contractual clauses).
Meta (Instagram) — Reading and replying, from the Loyaltygo dashboard, to the direct messages of Loyaltygo’s Instagram account, in order to know who was written to and who replied. If the sender unsends a message, it is also deleted from the dashboard. Location: European Union (Meta Platforms Ireland) and United States (standard contractual clauses).
Anthropic — Drafting of the messages from the business’s public data and suggestion of a reply when the business responds (with the text of its reply). Location: United States (standard contractual clauses).

5. Minors

The service is not aimed at children under fourteen. If it is detected that data of a minor under that age has been registered without the consent of the person holding parental authority or guardianship, it will be deleted.

6. Who else may access the data

To provide the service, the following providers are used, which process the data on behalf of Loyaltygo and under contract:

Supabase — Database and login accounts of the businesses. Location: European Union (Frankfurt).
Vercel — Hosting of the application, storage of the card images and aggregate counting of visits to the public website, without cookies. Location: European Union (Frankfurt), with the provider’s global content delivery network.
Resend — Sending of the service emails and of each business’s campaigns. Location: European Union and United States (standard contractual clauses).
Paddle — Collection of the business’s subscription payments; acts as merchant of record. Location: United Kingdom and European Union (United Kingdom adequacy decision).
Apple — Delivery and updating of the card in Apple Wallet. Location: United States (standard contractual clauses).
Google — Sign-in with Google for the business owner, if they choose to use it, and delivery and updating of the card in Google Wallet. Location: United States (standard contractual clauses).
Sentry — Logging of application errors, with personal data filtered out before it is sent. Location: European Union (Frankfurt).
Cloudflare — Domain management and protection against attacks; data only passes through in transit. Location: Global network, with an entry node in the European Union.
GitHub — Storage of the daily database backups, always encrypted. Location: United States (standard contractual clauses).

Where any of them processes data outside the European Economic Area, the transfer is covered by an adequacy decision of the European Commission or by standard contractual clauses. In addition, the data may be disclosed to public authorities when required by law.

7. Security

Data travels encrypted, passwords are stored encrypted, access to each business’s dashboard is restricted to its owner and to the team with the PIN, and encrypted backups are made. Error logs are cleaned of personal data before being stored.

8. Your rights

You can request access to your data, its rectification or erasure, the restriction of or objection to its processing and its portability, as well as withdraw any consent you have given, without the withdrawal affecting the lawfulness of the prior processing.

Owner of a business: write to soporte@loyaltygo.io. From Settings you can also download your data and delete your account yourself.
Customer of a business: contact the business that gave you the card, which is the controller. If you are unable to reach it, write to soporte@loyaltygo.io and your request will be passed on. To stop receiving commercial emails, the unsubscribe link they include is enough.
Business contacted by Loyaltygo: simply reply to any of the messages asking us not to write to you again, or write to soporte@loyaltygo.io.

If you believe your data has not been processed correctly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Changes

This policy may be updated if the service or the regulations change. The date at the end shows the latest version.