Privacy Policy
Effective Date: September 17, 2026
This website and the Loyardy platform are operated by Mariia Putkova ('we', 'us'). You can contact us at .
1. Website Analytics
We use Cloudflare Web Analytics to understand aggregate traffic (page views, referrers, device types, countries). Cloudflare's analytics are cookieless and do not use personal identifiers. We do not use tracking cookies or fingerprinting on this site.
Purpose: To measure site performance and improve content and usability.
Legal basis (EU visitors): Our legitimate interests in operating and improving the website, and the strictly necessary cookie described below. Since we do not place non-essential cookies or use advertising identifiers, prior consent is not required.
2. Loyardy App and Platform
The following applies to all users of the Loyardy mobile app and business dashboard: businesses, their staff members, and customers.
Business accounts
When a business registers, we collect: first name, last name, email address, business name, business description, category, locale preference, and address (country, city, street, postal code). We also store subscription plan and status. Businesses may set brand colours for their loyalty cards.
Staff accounts
Business owners may invite staff members by email. We store the staff member's first name, last name, email address, job title, locale preference, and their association with the relevant business account.
Customer accounts
When a customer registers, we collect their first name, last name, email address, locale preference, and optionally date of birth. We store their loyalty card collection, stamp history, reward history, and redemption records. This data is necessary to operate the loyalty programme.
Stamp and reward activity
Each time a stamp is issued or a reward is redeemed, we record the event including the business, card, timestamp, and customer. This forms the customer's immutable loyalty history and is essential to the integrity of the platform.
Notifications
We may send you in-app notifications about changes relevant to your account. We may also send push notifications via Firebase Cloud Messaging (FCM) for reminders and time-sensitive updates. Push notifications require your permission; if you decline, we will not send them. To deliver push notifications, we store a device token on your account.
Location data
To help customers find nearby participating businesses, we request access to your device's location. If granted, your coordinates are used only for the duration of the search, sent to Nominatim (OpenStreetMap) to identify nearby businesses, and are not stored on our servers. If declined, we instead show businesses across your country, determined from your phone's region setting. When a Business sets up its profile, we similarly request location access to set its address; if declined, the Business can select its location manually from a list. Business location is stored as part of the business profile, since it is required to show the business to customers.
Business analytics
We process aggregated visit and retention data to provide business owners with analytics dashboards. FREE plan users see 30-day visit counts. PRO plan users see 90-day history plus full analytics: visit frequency, redemption rates, and customer engagement. PREMIUM plan users see full analytics across all businesses and cards with 365-day history. This processing uses data already collected through normal platform operation.
App usage analytics
We use Firebase Analytics (Google) to improve the app's functionality and stability. This data is linked to your account identifier but is not shared with advertising networks or used for tracking outside the app.
Subscription payments
PRO and PREMIUM plan subscriptions are purchased via Apple App Store or Google Play Store. Payment processing is handled entirely by Apple or Google under their own privacy policies; we do not store your payment card details. Subscription lifecycle events are managed via RevenueCat. We retain records of subscription plan, status, and expiry for billing and legal compliance purposes.
Purpose: To provide, operate, and improve the Loyardy loyalty platform.
Legal basis (EU/UK): Performance of a contract (operating your account and loyalty programme, including in-app notifications); our legitimate interests (platform security, fraud prevention, analytics); and your consent (precise location access, and push notifications).
We retain account and activity data for as long as your account is active. If you delete your account, your account record, authentication credentials, and all associated activity data are permanently and immediately deleted.
Learn how to delete your account
We do not sell your personal data to third parties. We share data only with the sub-processors listed below, solely to operate the platform.
We do not otherwise proactively contact you by email. If you have a question or an issue, you can reach us at the support address above. The one exception is where the law requires us to contact you directly, for example to notify you of a data breach affecting your personal data under GDPR Article 34.
3. Sub-processors
We use the following third-party processors to operate the platform: Amazon Web Services (AWS) for cloud infrastructure, with data stored in the EU (Frankfurt) region; Nominatim (OpenStreetMap Foundation) for location search and geocoding; Google (Firebase) for push notification delivery and app usage analytics; RevenueCat for subscription management; and Apple and Google for in-app payment processing. Each processor is bound by appropriate data processing agreements and operates under GDPR-compliant terms.
4. Cookies
We set one cookie, i18n_redirected, to remember your language preference. It is strictly necessary, does not track you across sites, and does not require consent under the ePrivacy Directive. We use no other cookies. If that changes, we will ask for your consent and update this policy.
5. Your Rights under GDPR
If you are located in the European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):
Right of access (Art. 15); right to rectification (Art. 16); right to erasure (Art. 17); right to restriction of processing (Art. 18); right to data portability (Art. 20); right to object to processing (Art. 21).
To exercise any of these rights, contact us at .
You also have the right to lodge a complaint with a data protection supervisory authority. In Poland, this is the Urząd Ochrony Danych Osobowych (UODO): uodo.gov.pl. If you are resident in another EU country, you may contact your local supervisory authority.
6. Data Controller
The data controller for this website and the Loyardy platform is Mariia Putkova, operating as a sole trader (jednoosobowa działalność gospodarcza) registered in Poland. Registered address: Edwarda Stachury 1/13, 80-280 Gdańsk, Poland. NIP: 5842875463. If our legal entity changes in the future, we will update this page.
7. Updates
We may update this Privacy Policy. We will revise the effective date above when we do and publish the update on this page. Continued use of the platform after that date constitutes acceptance of the updated policy.