Privacy Policy

This Privacy Policy governs how Loyarax ("we", "us", "our") collects, uses and discloses information in connection with our loyalty, SMS and email marketing platform. By using our services you agree to this policy. The English version is the legally binding one.

1. Introduction

Loyarax operates a platform that lets retail businesses ("Merchants") manage customer loyalty programmes, send SMS and email communications and run marketing campaigns. We process data on behalf of Merchants and for our own operations. This policy describes what we collect, how we use it and what rights you have.

2. Data we collect

2.1 End-user (customer) data

When a Merchant uses our platform, data about their customers ("end users") may be collected and stored. This data includes:

• Name
• Phone number
• Email address
• Gender
• Date of birth
• Loyalty points, transaction history and campaign engagement data

2.2 Merchant (store owner) data

From Merchants we collect and store:

• Full name
• Phone number
• Email address
• Brand or business name
• Description of the services the store offers
• Campaigns created (content, targeting, schedules)
• Account credentials, billing information and usage logs

3. How we use data

We use the data described above to:

• Provide, operate and improve the platform
• Deliver SMS and email messages on behalf of Merchants
• Manage loyalty programmes and points
• Process transactions and provide customer support
• Comply with legal obligations and enforce our Terms of Service
• Send service communications such as account updates and security alerts
• Analyse usage to improve our services, in aggregated or anonymised form where possible

4. SMS and email communications

Our platform facilitates SMS and email delivery. By using it you acknowledge that:

• Delivery depends on third-party carriers and providers; we do not guarantee delivery
• Merchants are responsible for ensuring every message complies with applicable telecom and marketing laws (for example TCPA, GDPR, ePrivacy, CAN-SPAM)
• We may retain message logs, metadata and delivery status for operational and compliance purposes
• We may suspend or terminate accounts that send spam or violate applicable laws

4A. Website builder

If you use our website builder we collect what you submit: business or personal details (name, e-mail, phone, address, opening hours, social links), texts, menus, résumé details, your logo, photos and photos of menus, and the e-mail address to which we send your preview link.

• Purpose: to generate, preview and, where offered, publish your website, to answer your requests, and to prevent abuse.
• AI processing: to generate your website we send this content, including images, to an artificial-intelligence provider (currently Anthropic) that processes it on our behalf through its API. Do not submit content you are not willing to have processed this way.
• Your content, your responsibility: you confirm that you may use every text and image you submit, and that any personal data of third parties it contains (for example people in photos, staff or references in a résumé) is submitted lawfully. You are solely responsible for the content of your website. We may refuse or remove content at our discretion.
• Images: we resize uploaded images and remove location metadata. Menu photos are used only to read the menu and are not published.
• Preview links: anyone who has your preview link can view the preview. Share it only with people you trust.
• Retention: we keep projects and uploaded files while needed to provide the service and for a reasonable period afterwards. You can ask us to delete a project at any time.
• Payments: when you publish, payment is handled by Stripe. Your card details go to Stripe only; we receive and keep a customer and subscription reference, the plan, the status and renewal date, and invoices are issued through Stripe.
• Domain registration: if your plan includes a domain, we pass the owner details you enter (name, organisation, e-mail, phone, postal address) to our domain registrar and the registry so the domain can be registered. Registries may publish some of these details in public WHOIS data unless privacy rules or a privacy service apply. We store these details encrypted and use them only for the registration and its renewals. Your website is delivered through our hosting and DNS providers.

5. Sharing and disclosure

We do not sell personal data. We may share data with:

• Service providers (hosting, SMS and email gateways, payment processors@if (config('builder.enabled')), AI providers used to generate websites@endif) who help us run the platform under contractual obligations
• Authorities when required by law or court order, or to protect our rights and safety
• Successors in the event of a merger, acquisition or sale of assets

6. Retention

We keep data for as long as needed to provide the service, comply with legal obligations and resolve disputes. End-user data is retained according to the Merchant's account settings and our retention policies. After account termination we may keep certain data for backup, legal or audit purposes for a period we consider reasonable. We are not obliged to delete data on request where we have a legitimate basis to keep it.

7. Security

We apply technical and organisational measures to protect data. No method of transmission or storage is completely secure, and you use the service at your own risk. We are not liable for unauthorised access, breaches or loss of data caused by circumstances beyond our reasonable control.

8. Your rights

Depending on where you live you may have the right to access, correct, delete or restrict the processing of your data. To exercise these rights write to hello@loyarax.com. To request account deletion you can use our account deletion form. If your data is held by a Merchant, contact that Merchant first: they are the data controller for that relationship. We answer valid requests within a reasonable time as permitted by law and may charge a fee for excessive or repetitive requests.

9. Cookies and tracking

We use cookies and similar technologies on our website for functionality and analytics, and for remembering your language. By using the site you consent to this. You can disable cookies in your browser, but some features may stop working.

10. International transfers

Data may be processed and stored outside your country. By using our services you consent to such transfers. Where the law requires, we rely on appropriate safeguards such as standard contractual clauses.

11. Children

Our services are not intended for anyone under 16. We do not knowingly collect data from children. If you believe we have, contact us and we will take steps to delete it.

12. Changes to this policy

We may update this policy at any time. Changes are posted on this page with a new "Last updated" date. Continued use after a change means you accept it. Material changes may be communicated by email or in-app notice at our discretion.

13. Contact

Privacy questions or requests: hello@loyarax.com