Privacy Policy

1. Who this policy applies to

• Customers who join a merchant’s loyalty program through the website or the customer app.
• Merchants (businesses) who run loyalty programs on Looopin, and their staff members who use the business or staff app.
• Visitors to our website, including people who apply for jobs through our careers page.

2. Data we collect from customers

• Account and contact data: name, phone number, email address (if provided), and an internal user/customer ID.
• Birthday (optional): only if you choose to add it in the app, so merchants can send you a birthday reward. It can be set once and is never required.
• Loyalty activity: the merchants you joined, points and stamps earned and redeemed, rewards, visits and purchase records created when staff scan your card, scratch-card results and offers you receive.
• App interactions: basic events such as opening an offer or seeing a nearby-branch alert (merchant and time only — no location), and your notification preferences.
• Device and notification data: push notification token (when push notifications are enabled), app version, device type and operating system, and technical logs needed for security and crash diagnostics.
• Consent records: the time and version of the consent you give when joining a program.

3. Location data (customer app)

The customer app can access your precise and approximate location only if you grant permission. It is used for two optional features: (a) showing how far you are from the branches of merchants you already joined, and (b) nearby-branch alerts — when you enable them, the app registers geofences for those branches on your device and shows a local notification when you are near one, including when the app is closed or not in use (background location).

Your location coordinates are processed on your device only. They are not sent to our servers, not stored by us, and not shared with merchants or third parties. The app only downloads the list of branch locations from our servers. You can turn alerts off in the app (Settings > Proximity alerts) or revoke location permission in your device settings at any time; the rest of the app keeps working.

4. Data we collect from merchants and staff

• Account data: name, email, phone number, business name and details, branch addresses and map coordinates entered by the merchant, role and permissions.
• Operational data: loyalty program settings, campaigns, transactions recorded by staff, and audit logs (who did what and when).
• Camera: the business and staff apps use the camera only to scan customer QR codes. Images are processed in real time on the device to read the code and are not stored or uploaded.

5. Website visitors and job applicants

Our website uses strictly necessary cookies for login sessions and language preference. We do not use advertising cookies. If you apply for a job, we collect the details you submit (such as name, contact details and CV) only to evaluate your application.

6. How we use data

• To provide the Services: create accounts, sign you in (including one-time codes), run loyalty programs, record points, stamps and rewards, and show your history.
• To send service messages and, where you or the merchant enabled them, notifications about rewards, offers and reminders.
• To keep the Services secure: prevent fraud and abuse, enforce idempotent point operations, and investigate incidents.
• To fix bugs and improve reliability using crash and error reports.
• To comply with legal obligations and respond to lawful requests.

7. Legal bases

• Performance of a contract — to provide the Services you or the merchant signed up for.
• Consent — for optional features such as location-based alerts, push notifications, birthday rewards and marketing messages. You can withdraw consent at any time.
• Legitimate interests — security, fraud prevention, service improvement and diagnostics.
• Legal obligation — where the law requires us to keep or disclose data.

8. Merchants as controllers of their customers’ data

When you join a merchant’s loyalty program, that merchant decides how your program data is used and is the controller of that data; Looopin processes it on the merchant’s behalf. Merchants can see the data of their own program members (for example name, phone, points, visits and birthday if you added it). They cannot see your location. For requests about a specific merchant’s use of your data you may contact the merchant or us, and we will help.

9. Sharing and service providers

We do not sell personal data, and we do not share it for advertising. We share data only with the merchant whose program you joined and with service providers that process it on our behalf under contract:

• Supabase — database, authentication and file storage hosting.
• Vercel — website and API hosting.
• Resend — sending emails such as sign-in codes and notifications.
• Google Firebase Cloud Messaging and Apple Push Notification service — delivering push notifications, when enabled.
• Sentry — crash and error reporting, when enabled (configured to minimise personal data).
• Meta (WhatsApp Business Platform) — only if a merchant enables WhatsApp messages to its customers.
• Authorities or other parties when required by law, or to protect rights and safety, and a successor in case of a merger or acquisition (with notice to you).

10. No selling, no advertising tracking

Looopin does not sell personal data, does not show third-party ads, does not use the advertising ID, and does not track you across other companies’ apps or websites.

11. Data retention

• Account and loyalty data: kept while your account or membership is active. After a deletion request it is deleted or anonymised within 30 days.
• Transaction and audit records: may be kept in anonymised or minimal form for up to 24 months where needed for fraud prevention, accounting or legal obligations.
• Push tokens: removed when you sign out, delete your account, or the token expires.
• Error logs: kept up to 90 days. Job applications: up to 12 months unless you ask us to delete them sooner.
• Location: never stored on our servers.

12. Security

All data is encrypted in transit (HTTPS/TLS) and stored with encryption at rest by our hosting providers. We use role-based access controls and row-level security so each merchant can access only its own data, keep administrative access limited, never embed privileged server keys in the mobile apps, and keep audit logs. No method is 100% secure, but we work to protect your data and will notify you as required by law in case of a breach.

13. Your rights and account deletion

Depending on your location you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent. To exercise these rights, contact us at privacy@looopin.net.

You can delete your account at any time in the app (Settings > Delete account) or on the web at https://app.looopin.net/en/delete-account, or by emailing privacy@looopin.net. Deletion requests are processed within 30 days. You may also lodge a complaint with your local data protection authority.

14. Children

The Services are not directed at children and are intended for users aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has provided us data, contact us and we will delete it.

15. International transfers

Our service providers may process data in countries other than yours, including the European Union and the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.

16. Changes to this policy

We may update this policy. We will post the new version on this page with a new effective date and, for significant changes, notify you in the app or by email.

17. Contact

Looopin — Email: privacy@looopin.net — Website: https://app.looopin.net