Privacy Policy

1. Data we collect

• Account data: name, email address, username, avatar, and a unique loyalty ID.
• Profile data: optional birthday day/month/year, interests, bio, and privacy preferences.
• Activity data: loyalty stamps, redeemed rewards, liked shops, muted merchants, check-ins, and referrals.
• Location data: approximate or precise device location, only when you grant permission, used for nearby-offer and map features.
• Notification data: push notification tokens and the categories of alerts you have enabled.
• Merchant data: for merchant accounts, business name, address, contact details, branding assets, and team member emails.

2. How we use your data

• To create and manage your loyalty card, stamps, rewards, and Zyperks.
• To show nearby shops, offers, and location-based rewards.
• To send stamp, reward, birthday, offer, and re-engagement notifications you have opted into.
• To operate the leaderboard and, where your privacy settings allow, display your public profile to others.
• To process referrals and award referral bonuses.
• To provide merchant dashboards, analytics, and team management.
• To prevent fraud, abuse, and duplicate accounts.

3. Legal basis (UK & EEA)

We process your data under the UK GDPR on the basis of: performance of the contract (providing the Service); your consent (notifications and location); our legitimate interests (security, analytics, and preventing abuse); and, for merchant data, compliance with legal obligations.

4. Sharing your data

We share data only when necessary: with payment providers (Stripe) to process subscriptions and payouts; with email delivery (Resend) and push delivery (FCM/APNs) providers to send messages on our behalf; with mapping services (Google) to resolve addresses and nearby locations; and when required by law. Merchants can see aggregated, non-personal activity about customers who stamp or redeem at their location. We never sell your personal data.

5. International transfers

Some providers process data outside the UK/EEA. We rely on appropriate safeguards such as standard contractual clauses and only transfer the minimum data needed for the service in question.

6. How long we keep data

We keep account and activity data for as long as your account is active. Reward, redemption, and transaction records are retained for as long as needed to provide the service and for legal/audit requirements. You can request deletion of your account and associated data at any time from Settings, or by contacting us.

7. Your rights

• Access, correct, or download a copy of your data.
• Withdraw consent for notifications or location at any time from your device or in-app Settings.
• Opt out of the public profile and leaderboards via Privacy settings.
• Request deletion of your account and personal data.
• Lodge a complaint with the UK ICO (ico.org.uk) or your local data protection authority.

8. Children

The Service is not directed to children under 13 (or the applicable age in your country). We do not knowingly collect data from children. If you believe a child has provided data, contact us and we will delete it.

9. Security

We use reasonable technical and organisational measures to protect your data, including encryption in transit, restricted access controls, and rotation of one-time redemption tokens. No system is perfectly secure; where a legal obligation applies, we will notify you and the regulator of a personal data breach.

10. Changes to this policy

We may update this Privacy Policy. Material changes will be communicated in-app or by email. Continued use after changes takes effect constitutes acceptance.

11. Contact

For privacy questions or to exercise your rights, email hello@zyloyal.com. Zyloyal is operated from the United Kingdom.