LoyaFlow Platform Privacy Notice
This notice explains how Abdelfattah el Alouani, sole proprietor, Wülflingerstrasse 165, 8408 Winterthur, Switzerland ("LoyaFlow", "we") processes personal data as controller. Contact: privacy@loyaflow.com.
Are you a customer of a shop that uses LoyaFlow? Then, for your loyalty card data, the shop (merchant) is the controller and LoyaFlow only processes your data on the shop's behalf (as processor). Please read the shop's own privacy policy, shown when you joined its program, and see Section 9 below for the shortcuts we give you ( unsubscribe, export, deletion). This notice covers everything else: merchant accounts and website visitors.
1. Who this notice covers
- Merchants — the businesses that register and use the LoyaFlow dashboard (their owners and staff users).
- Website visitors — people browsing our public pages.
- End customers — only for the narrow items described in Section 9 (where we act on our own responsibility); everything else about end customers is processed for the merchant under the DPA.
2. Representatives
- EU representative (Art. 27 GDPR): Fatima Ezzahra el Alouani, 12 Quai de la Brunette, Bât. A, Appt 3, 82100 Castelsarrasin, France — privacy@loyaflow.com.
- UK representative (Art. 27 UK GDPR):
[UK REPRESENTATIVE — pending appointment].
We are established in Switzerland; no Swiss representative is required.
3. What we process, why, and on what legal basis
| Data | Purpose | Legal basis |
|---|---|---|
| Account data (name, email, password hash, preferred language, company details, role) | Providing the dashboard, authentication, staff management | Contract (Art. 6(1)(b)) |
| Email verification & auth events (verification links, login timestamps) | Account security, abuse prevention | Contract; legitimate interest (security) |
| Product usage events (which dashboard features you use and when, e.g. opening the designer or the scanner) | Improving the service and helping you set it up | Legitimate interest (product improvement) |
| Billing & subscription data (plan, subscription status, invoices metadata, billing country, tax status) | Subscription management, entitlements, tax compliance | Contract; legal obligation |
| Checkout & payment data — processed by Paddle as Merchant of Record (independent controller): payment method, card data, billing address | Payment processing, tax calculation and remittance, fraud prevention | See Paddle's privacy policy (paddle.com/legal/privacy); we receive only the outcome (subscription/invoice status), never card numbers |
| Support data (tickets, messages, related account context) | Handling your requests | Contract; legitimate interest |
| Product feedback (in-app ratings, cancellation reasons, how you heard about us, optional comments — tied to your account) | Improving the Service, understanding cancellations and acquisition channels; never used for marketing without separate consent | Legitimate interest (product improvement) |
| Transactional emails (verification, billing notices, service notices) | Operating the Service | Contract |
| Technical logs (IP address, user agent, request metadata) | Security, debugging, abuse and rate limiting | Legitimate interest (security & operation) |
| Legal acceptances (which document version you accepted, when) | Evidence of contract and consent | Legal obligation; legitimate interest |
We do not sell personal data, do not use it for third-party advertising, and do not take automated decisions with legal effect on you.
4. Cookies
The platform uses only essential cookies (session/authentication, security, preferences such as language). We use no advertising or third-party analytics cookies; any usage analytics are cookieless and aggregate. Because of this, no cookie consent banner is shown. Details: see the Cookie Notice.
5. Recipients (processors and providers)
We use these providers to run the Service (data localised in the EU where noted):
| Provider | Role | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication, storage | EU — AWS eu-central-1 (Frankfurt) |
| Google Cloud | Application hosting, secrets, logging | EU — europe-west1 (Belgium) |
| Cloudflare, Inc. | DNS, CDN, security edge | Global edge |
| Resend, Inc. | Transactional email delivery | USA |
| Paddle | Merchant of Record for subscriptions (independent controller) | UK/USA |
Public authorities only where legally required.
6. International transfers
Our primary infrastructure is in Switzerland/EEA. Switzerland, the EEA and the UK recognise each other as adequate — no additional safeguards needed. Providers in the USA (e.g. Resend, Cloudflare, Paddle entities) are covered by the EU–U.S. Data Privacy Framework (with Swiss and UK extensions) and/or Standard Contractual Clauses.
7. Retention
- Account data: for the life of the account; on closure, End Customer personal data is deleted after a 30-day wind-down window (security/reactivation/export), and the remaining merchant account and configuration data is deleted after 90 days (reactivation window), except data we must keep longer.
- Billing records: kept as required by commercial and tax law (Swiss law: up to 10 years).
- Support tickets: life of the account + 30 days.
- Technical logs: short rotation (weeks, not years).
- Legal acceptances: as long as needed to evidence the contract.
8. Your rights
Under the GDPR/FADP/UK GDPR you can request access, rectification, erasure, portability, restriction and object to legitimate-interest processing; where processing is based on consent, you may withdraw it at any time. Write to privacy@loyaflow.com. You may complain to a supervisory authority — in Switzerland the FDPIC, in the EU your national authority, in the UK the ICO.
9. End customers — what LoyaFlow does on its own responsibility
For loyalty-card data the controller is your merchant (see the note at the top). On our own responsibility we only:
- operate the public request shortcuts on the pass page: unsubscribe from marketing (immediate), export and deletion requests (queued to your merchant for fulfilment);
- keep minimal technical logs of public pass pages for security (short retention);
- forward wallet push tokens to Apple with an empty payload (no personal content leaves the platform through push notifications).
Everything else — what data your program stores, for how long, marketing — is your merchant's decision, described in their privacy policy.
10. Business-to-business prospecting
LoyaFlow, as controller, occasionally emails businesses that do not yet use the Service to invite them to try it. We process the business's trading name, website, publicly listed professional contact address, city and sector, sourced from the business's own website and, to locate it, open directories such as OpenStreetMap — never a purchased list. This supports a single invitation: one email and, if there is no reply, one reminder, never more. Legal basis: legitimate interest (Art. 6(1)(f) GDPR); as B2B communication, you have a right to object rather than a consent requirement. We retain this data 12 months from the last contact; after an objection or unsubscribe we keep only a one-way cryptographic hash of the email address, solely to honour it. Recipients: our email delivery provider only, no other third party. Rights: object via the message link, or request access or erasure at privacy@loyaflow.com. You may also complain to the CNIL or your own supervisory authority.
11. Security
Security measures are summarised in the DPA's TOM annex and include encryption in transit and at rest, strict tenant isolation at database level, managed secret storage, least-privilege access, monitoring, and a breach-response procedure. If a breach is likely to result in a high risk to you, we will inform you and the competent authority as required by law.
12. Changes
We may update this notice; material changes are announced in the dashboard with a versioned acceptance (you will see which version you accepted and when). The current version is always available at the platform's legal pages.
Version 1.3 · Effective date: 22 September 2026 · Binding language: English · Contact: privacy@loyaflow.com