Privacy Policy

This Privacy Policy explains how LoyBiz ("LoyBiz," "we," "us," or "our") collects, uses, and protects information when you use our loyalty rewards platform, including our mobile application (used by business owners) and our web portal (used by their customers), together referred to as the "Service."

By using LoyBiz, you agree to the collection and use of information as described in this Privacy Policy.

1. Who This Policy Applies To

LoyBiz serves two types of users:

• Business Users — small business owners who use the LoyBiz app to manage a loyalty/punch card program.
• Clients — customers of those businesses who enroll in a loyalty program through the LoyBiz web portal.

This Privacy Policy applies to both.

Data Controller vs. Data Processor: In data protection terms, the Business User is considered the "Data Controller" of their specific customers' loyalty data, and LoyBiz operates as the "Data Processor" or "Service Provider." We process this information solely on behalf of the Business User to facilitate their loyalty program.

2. Information We Collect

2.1 Information You Provide Directly

Business Users

• Email address
• Password (stored securely, never in plain text)
• Business name
• Business category
• Business logo (optional)
• Loyalty program settings (reward goals and reward names)

Clients

• Name
• Email address (required)
• Phone number (required)

Clients sign in using a one-time passcode (OTP) sent to their email address rather than a stored password.

2.2 Information Generated Through Use of the Service

We collect information created as you use the Service, including:

• Loyalty Data: Punch and redemption history, loyalty program enrollment, and reward progress.
• Account Activity: Login timestamps and basic account activity used for security, troubleshooting, and improving the Service.
• Device and Technical Data: Standard server log information automatically collected by our hosting and backend providers, including IP addresses, browser types, and operating system data used strictly for security, performance monitoring, and debugging.
• QR Identifiers: A unique QR code identifier associated with each Client account, used to identify the Client when participating in a Business's loyalty program. The QR code contains only a unique token and does not directly contain a Client's personal information.

2.3 Information We Do Not Collect

We do not collect:

• Precise device location
• Payment card information
• Government-issued identification

We do not sell personal information to advertisers or data brokers.

3. How We Use Information

We use the information we collect to:

• Create and manage Business User and Client accounts.
• Authenticate Business Users through email and password, and authenticate Clients through one-time passcodes (OTP) sent by email.
• Operate the loyalty program, including tracking punches, rewards, and redemptions.
• Generate business-specific customer insights and aggregated analytics for Business Users based on their own loyalty programs.
• Send transactional notifications by email, such as welcome emails, punch confirmations, reward availability notifications, and security or account-related communications. (These are considered part of the Service and are not promotional marketing emails.)
• Respond to support requests.
• Detect fraud, misuse, or unauthorized access.
• Maintain, improve, and secure the Service.

Note on Notifications: LoyBiz currently sends notifications by email only. We do not send SMS or promotional text messages.

Note on Phone Numbers: Phone numbers are collected as part of Client account setup and are used for account identification and security. We do not currently use phone numbers to send SMS or promotional messages, and we do not use them for marketing.

4. How Information Is Shared

We do not sell personal information. We share information only in the following circumstances:

Between Businesses and Their Clients

When a Client enrolls in a Business's loyalty program, that Business can access only the information necessary to operate its own loyalty program, including:

• Client name
• Contact information provided during enrollment
• Loyalty progress
• Punch history
• Reward redemption history

Privacy Limitations: Businesses cannot view a Client's activity with unrelated businesses on LoyBiz. Furthermore, a Business's search functionality is strictly limited; they can only search for and view the profiles of Clients who have actively enrolled in their specific loyalty program.

Businesses are responsible for the personal information they collect from their customers through LoyBiz. LoyBiz processes that information solely to provide the Service.

Service Providers

We use trusted third-party providers to operate the Service, including:

• Supabase (database and authentication)
• Railway (application hosting)
• Vercel (application hosting)
• Resend (transactional email delivery)

These providers process information only on our behalf and are not permitted to use it for their own purposes.

Legal Requirements

We may disclose information when required by law or when we reasonably believe disclosure is necessary to:

• Comply with legal obligations
• Protect the rights, safety, or security of our users
• Prevent fraud, abuse, or illegal activity

Business Transfers

If LoyBiz is involved in a merger, acquisition, financing, or sale of assets, user information may be transferred as part of that transaction. We will notify users of any material changes affecting their information.

5. Cookies and Similar Technologies

The LoyBiz web portal uses cookies and similar technologies that are necessary to:

• Authenticate users
• Maintain secure login sessions
• Remember login preferences
• Operate the Service securely

We do not use third-party advertising or behavioral analytics services.

6. Device Permissions

The LoyBiz mobile app may request access to your device's camera solely to scan customer QR codes during loyalty transactions. If you choose to upload a business logo, the app may also request access to your device's photo library or photo picker. These permissions are optional but are required for the related features to function.

7. Data Retention

We retain account information for as long as an account remains active.

If a Business User or Client deletes their account:

• Personal information such as name, email address, and phone number will be deleted or anonymized from our active systems.
• Certain transactional records, including punch and redemption events, may be retained where necessary to maintain the integrity of business records, prevent fraud, comply with legal obligations, or generate aggregated analytics. Where possible, these records will be retained only in de-identified or anonymized form.

You may request account deletion at any time through the app or by contacting us using the information below.

8. Your Privacy Rights

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Request deletion of your personal information (Clients should note that requests to delete loyalty data may require coordination with the Business Controller)
• Request a portable copy of the personal information you have provided, where applicable
• Object to or restrict certain processing of your information, where applicable

To exercise these rights, contact us using the information provided below. California residents may have additional rights under applicable California privacy laws.

9. Data Security

We use reasonable administrative, technical, and organizational safeguards to protect your information, including encrypted connections (HTTPS/TLS), secure credential storage, and access controls designed to limit unauthorized access. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children's Privacy

The Service is not directed to children under the age of 13 (or the applicable minimum age in your jurisdiction), and we do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child without appropriate authorization, we will delete that information as required by law.

11. International Users

LoyBiz is operated from the United States. If you access the Service from another country, your information may be transferred to, stored, and processed in the United States, where privacy laws may differ from those in your jurisdiction.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify users through the Service.

13. Contact Us

If you have questions about this Privacy Policy or how we handle your information, please contact us:

• Email: loybiz.dev@gmail.com
• Website: www.loybiz.com