Privacy Policy

1. Who we are

Lolty is a digital loyalty card platform for independent businesses. Our service lets businesses create branded loyalty cards that customers save to Apple Wallet or Google Wallet.

During the current pilot phase, Lolty is operated by Matias Abal Hevia, a private individual based in Spain, rather than a registered company. We are in the process of incorporating a company (Lolty OÜ, Estonia). If and when that incorporation completes, these terms and this policy will transfer to that entity, and we will notify all registered users by email before the change takes effect.

2. Data we collect

We collect only what is necessary to provide the service:

For customers:

Name and email address (required to create and manage your loyalty card)
Phone number (optional — used as a fallback delivery channel for stamp/reward notifications if wallet push notifications fail)
Postcode (optional — used to help the business understand where its customers are coming from, in aggregate)
Birthday month and day (optional — used for birthday-related recognition, where enabled by the business)
Stamp and visit history linked to your card, including any transaction amount a staff member chooses to log for the business's own revenue analytics (see Section 3)
An internal engagement/return-likelihood indicator calculated from your visit history, viewable by staff at the business you're a member of
Notes: staff at the business you're a member of may record short freeform notes about your visits (for example, a usual order or preference). Please don't include sensitive personal information in these notes, and businesses using Lolty agree not to record sensitive personal data of this kind.

The business (as data controller) is responsible for ensuring that staff notes and any other free-text fields do not contain sensitive personal data about its customers (for example, health information, religious beliefs, or other special-category data under GDPR Article 9). Lolty does not review or moderate the content entered in these fields.

For businesses:

Business name, category, email, and login credentials
Logo, brand colours, and card configuration
Business address, phone number, and public contact email (shown on the card/pass, where provided)
Business location coordinates (used for map display and analytics)
Social media links (where provided)
Business opening hours and staff accounts

Usage data: anonymised analytics to help us improve the product (e.g., page views, feature usage). No personally identifiable data is used for this analytics.

We do not collect or store payment card numbers, bank details, or process any payments through Lolty. A business may optionally log a transaction amount alongside a visit for their own revenue analytics — this is a plain number entered by staff, not connected to any card or payment processor.

3. How we use your data

To create and deliver your digital loyalty card
To send stamp and reward notifications via Apple Wallet, Google Wallet, or SMS fallback
To provide the business with visit analytics (aggregated and anonymised where possible)
Based on your visit history, we calculate an internal indicator of how likely you are to return to a business, which may be shown to that business's staff on their own dashboard (alongside your name, visit count, and time since your last visit) to help them decide who to follow up with. We do not automatically send you any message based on this indicator — any outreach to you is a manual decision made by the business, not an automated process.
To contact you about your account or important service updates

We never use your data for advertising or sell it to third parties.

4. Data storage and security

All data is stored securely on servers located within the European Union. Our database is hosted in Ireland (Supabase, eu-west-1) and our application servers are hosted in Amsterdam, Netherlands (Railway, EU West). We use industry-standard encryption in transit (HTTPS/TLS) and at rest. Access to personal data is restricted to authorised team members only.

5. Your rights (GDPR)

If you are in the European Economic Area, you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Delete your data ("right to be forgotten")
Restrict or object to processing
Data portability receive your data in a structured format

To exercise any of these rights, email us at contact@lolty.cards. We will respond within 30 days.

6. Data retention

We retain your data for as long as your account is active. If you close your account or request deletion, we will action your request as soon as reasonably possible, and no later than 30 days, except where retention is required by law.

7. Third-party services and subprocessors

We use the following third-party providers to deliver the service. Each processes data only as needed for its function:

Supabase (database and authentication) — hosted in Ireland (EU)
Railway (application hosting) — hosted in Amsterdam, Netherlands (EU)
Resend (transactional email delivery)
Cloudflare (landing page hosting and domain services)
Apple Wallet / Google Wallet — used to deliver your loyalty card. These are subject to Apple's and Google's own privacy policies. We share only the minimum data required (card content) to enable this functionality.

8. Cookies

This landing page uses Cookiebot, a consent management platform, to manage cookie consent in compliance with GDPR and applicable Spanish and Swiss data protection law. Cookiebot may set cookies to remember your consent preferences. No cookies are used for advertising or cross-site tracking. You can view or change your cookie preferences at any time via the "Manage Cookies" link in the footer.

The Lolty app uses only essential cookies required to keep you logged in.

9. Changes to this policy

If we make material changes to this policy, we will notify you by email before the changes take effect. The date at the top of this page reflects the most recent update.

10. Contact

Questions about this policy? Write to us at contact@lolty.cards