1. Scope and accountability
This Privacy Policy applies to the Loyalti customer application, business portal, public websites, support services, and related loyalty, messaging, review, and campaign features (together, the “Services”). “Loyalti,” “we,” “us,” and “our” refer to Loyalti, the provider of these Services.
Our initial business launch is focused on Ontario. Quebec business expansion is not part of this launch. This geographic focus does not remove any rights you have under applicable privacy law.
Participating businesses create and administer their own loyalty programs. A business may receive information about activity connected to its cards, locations, campaigns, rewards, and customer feedback. That business is responsible for its own privacy practices and for information it collects outside Loyalti. Loyalti remains responsible for its own handling of personal information.
Our privacy contact receives questions, access and deletion requests, and complaints at the email address in section 12.
2. Personal information we handle
Account and identity information
- Name, email address, account identifier, profile image, authentication provider, and account/session information.
- For business users: business name, role, staff invitations, locations, contact information, and account administration records.
- Date of birth, when provided, to determine eligibility for birthday features. Participating businesses are shown eligibility, not your full birth date, unless we clearly tell you otherwise and have a lawful basis.
Loyalty and transaction information
- Cards joined, stamp balances, welcome-stamp eligibility, rewards earned and redeemed, participating location, timestamps, and redemption method.
- QR and NFC credential identifiers, activation status, scan events, fraud-prevention signals, and records needed to prevent duplicate or unauthorized use.
- Birthday perks, recovery offers, campaign eligibility, messages, and redemption status.
Device, permission, and technical information
- Device type, operating system, app version, language, push token, notification preferences, IP address, diagnostic logs, and security events.
- Cookies, local storage, and similar browser technologies used to maintain sessions, remember preferences, protect accounts, and operate the website. You can control these through your browser, although blocking essential storage may prevent sign-in or other core features.
- Approximate or precise location when you grant location permission, used to show nearby businesses and relevant locations. Loyalti does not use background location unless a future feature clearly asks for separate permission.
- Camera and NFC access when you choose scanning or tapping features. Camera images used for QR scanning are processed for the scan and are not intentionally stored as photographs.
Content and communications
- Support requests, private feedback, ratings, business responses, and communications sent through the Services.
- Business logos, card artwork, descriptions, terms, review links, campaign content, and other material uploaded or created by business users.
- Prompts and source material submitted to optional AI artwork tools, plus generated results and usage records.
We may also create aggregated or de-identified information that does not reasonably identify an individual. We may use that information for analytics, security, and product improvement.
3. How we use personal information
We use personal information for purposes a reasonable person would consider appropriate in the circumstances, including to:
- create and secure accounts, confirm email addresses, recover passwords, and keep cards synchronized across devices;
- issue, validate, display, and redeem stamps, rewards, birthday perks, and recovery offers;
- show businesses and locations, provide maps and directions, and personalize eligible content;
- deliver service messages and, where permitted, promotional messages from businesses whose programs a customer has joined;
- operate business reporting, campaign tools, staff access, support access, and audit records;
- collect private feedback and redirect a customer to a business’s third-party review destination when the customer chooses to continue;
- generate optional card artwork and provide other requested features;
- detect fraud, abuse, account compromise, security incidents, and violations of our Terms;
- debug, maintain, measure, and improve the Services; and
- comply with law, enforce agreements, and establish, exercise, or defend legal claims.
If we want to use personal information for a materially new purpose, we will explain that purpose and seek consent where required.
4. Consent and your choices
Consent may be express or implied depending on the sensitivity of the information and the context. Required account and loyalty processing is explained when you create an account. Optional permissions and promotional communications are presented separately.
- Push notifications: You can decline them or turn them off in device settings. Essential in-app records may still appear when you open Loyalti.
- Location: You can decline or revoke location access. You can still browse, but nearby results and location-aware features may be limited.
- Promotional messages: Messages governed by Canada’s anti-spam law include sender identification and an unsubscribe method. We process valid unsubscribe requests within the period required by law. Withdrawing marketing consent does not stop transactional or security messages.
- Business programs: You may remove a card from your wallet or leave a program. Some historical records may remain where needed for fraud prevention, accounting, dispute resolution, or legal compliance.
You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent needed to provide a feature may mean that feature can no longer be provided.
5. When we disclose information
We do not sell personal information. We may disclose it in the following circumstances:
- Participating businesses: A business receives information reasonably required to operate its program, such as card membership, stamp and redemption activity, offer eligibility, location, and feedback associated with that business. We do not provide a business with a customer’s account password.
- Service providers: Hosting, database, authentication, email, push notification, mapping, analytics, support, security, payment, and AI providers may process information for us under contractual or other appropriate safeguards. Current product infrastructure may include Supabase, Expo, Firebase/Google services, and OpenAI for features that use those services.
- At your direction: We disclose information when you ask us to, such as opening a Google review destination, maps provider, or another external service.
- Legal and safety reasons: We may disclose information when reasonably necessary to comply with law, lawful process, protect users or the public, investigate fraud or security incidents, or enforce our agreements.
- Business transaction: Information may be transferred as part of a financing, reorganization, merger, sale, or similar transaction, subject to confidentiality and applicable law.
Business owners are responsible for giving staff only the access they need and removing access promptly when a staff relationship ends.
6. Processing outside Canada
Some service providers may store or process personal information in the United States or other jurisdictions. Information processed outside Canada may be subject to the laws and lawful access authorities of that jurisdiction. We assess providers and use contractual, organizational, and technical measures appropriate to the sensitivity of the information.
Contact us for more information about our service-provider practices or processing outside Canada.
7. Retention and deletion
We keep personal information only as long as reasonably necessary for the purposes described in this policy, including providing an active account, maintaining accurate stamp and redemption records, preventing abuse, meeting tax or accounting obligations, resolving disputes, and enforcing agreements.
Retention periods vary by record type, sensitivity, legal requirements, and whether the information is needed for an active relationship. When information is no longer required, we delete, anonymize, or securely destroy it. Limited information may remain in backups or audit and security records until those records expire through normal processes.
Deleting an account does not necessarily erase information a participating business collected independently, or records we must retain by law or for legitimate fraud, security, or legal purposes.
8. Safeguards and incidents
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including access controls, role restrictions, server-side validation for stamps and rewards, logging, credential controls, and service-provider review. No online service can guarantee absolute security.
If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and the appropriate privacy regulator as required, and keep required incident records.
You are responsible for protecting your password and devices and for telling us promptly about suspected unauthorized access.
9. Access, correction, complaints, and other rights
Subject to applicable law, you may request access to personal information we hold about you, ask us to correct inaccurate information, withdraw consent, or request deletion. We may need to verify your identity before completing a request. Some exceptions apply, including information protected by privilege, information about another person, or records we are legally required to retain.
You may first raise a concern with our privacy contact. You may also contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator. We will not retaliate against anyone for making a good-faith privacy complaint.
Accessible formats
If you need this policy or privacy support in an alternate format, contact us. We will work with you to provide reasonable access and accommodation. This statement does not limit any accessibility right available under law.
10. Children and young people
The Services are not directed to children under 13. Business accounts are for individuals who have authority to act for a business. A person under the age of majority should use the Services only with authorization from a parent or legal guardian where required. If we learn that personal information was collected from a child without valid authorization, we will take appropriate steps to delete it.
11. Changes to this policy
We may update this policy as the Services, vendors, or legal requirements change. We will post the revised version with a new effective date. If a change is material, we will provide additional notice in the app, by email, or through another appropriate channel and obtain consent where required.
12. Contact us
For privacy questions, requests, complaints, or accessible-format support, contact:
Privacy Contact — Loyalti
Email: loyalticorp@gmail.com
Canada
To request deletion without installing or signing into the app, use our account deletion instructions.
Please do not send passwords, full payment-card numbers, or other unnecessary sensitive information by email.