1. Who we are
Loylet is operated by [your full name exactly as on your ID], based in Palestine. Contact: info@yourdomain.com.
2. Our roles
For merchants who sign up, we are the controller of their account data.
For the merchants’ customers (people who join a loyalty card), each merchant is the controller of the data shared with it, and we process that data on the merchant’s behalf.
If you join loyalty programs at several businesses on Loylet, we keep one Loylet customer profile linked to your mobile number so your cards work together. We are the controller of that profile. Each merchant only sees the details you gave to that merchant and your activity with it — never your cards or activity at other businesses.
3. Data we collect from merchants
Account data: name, business name, email and a securely hashed password.
Business data: logo, brand colours, card settings, branches, phone or WhatsApp number.
Billing data: subscription status and plan. Card payments are handled by Paddle; we never see or store full card numbers.
Technical data: log entries such as IP address and browser type, used for security.
4. Data we process about merchants’ customers
Name and mobile number; optional date of birth and email.
Loyalty activity: visits, stamps, points, rewards and redemption history.
Wallet data: the pass serial number and, if the card is added to Apple Wallet or Google Wallet, the device identifiers and push tokens needed to update the card.
Consent records: what you agreed to, the version of the wording, the date and time, and the IP address and browser used.
5. How we use data
To run the service: create and update loyalty cards, show balances, send the notifications a merchant chooses to send, provide support, keep the platform secure and meet legal obligations.
Offers from the merchant: when you join a merchant’s program you agree to receive that merchant’s offers and updates.
Offers from the Loylet network: only if you tick the separate, optional box, we may send you offers from other businesses that use Loylet. We send these ourselves — we do not give your phone number or other contact details to those businesses. You can withdraw this consent at any time by contacting info@yourdomain.com.
We do not sell personal data.
6. Who we share it with
Each merchant sees only its own customers, and only the details shared with it.
We use service providers to run the platform: Apple (Apple Wallet and push notifications), Google (Google Wallet), Paddle (billing) and our hosting provider. We may disclose data when required by law.
7. How long we keep it
We keep merchant data while the account is active. When an account is closed, its data — including its customers’ data — is deleted within 90 days, except where we must keep billing records by law.
A merchant can delete a customer’s data at any time, and customers can ask the merchant or us to delete theirs.
Your Loylet customer profile is kept while you hold at least one card. When your last card is deleted, the profile and its consent records are deleted within 90 days.
8. Security
Passwords are hashed, traffic is encrypted with HTTPS, and access to data is restricted by account and role.
9. Your rights
You can ask to access, correct or delete your personal data by contacting the merchant or info@yourdomain.com.
Customers can remove the card from their wallet at any time, and can turn off notifications for it in the wallet settings.
10. Cookies
We only use essential cookies. See our Cookie Notice.
11. International transfers
Our service providers may process data outside Palestine and Jordan. We choose providers with appropriate security safeguards.
12. Children
The service is not directed at children under 13.
13. Changes
We may update this policy and will show the date of the latest version at the top of this page.
14. Contact
Privacy questions: info@yourdomain.com.