LoyaltyDog Privacy Policy
Version 12.4 | Effective 14 October 2026
This policy explains how we use data about merchants, staff, prospects, visitors and loyalty members, and who is responsible for each use.
1. Who we are
LoyaltyDog Ltd is registered in Israel, company number 515589067, at 8 Habanim Street, Zichron Yaakov 3094007, Israel.
Privacy contact: [email protected]
2. Our two roles
Whose data | Our role | Who to contact |
|---|---|---|
Merchants, their staff, prospects, partner contacts and website visitors | Controller: we decide how the data is used | Us |
Members of a merchant’s loyalty programme | Processor: the merchant decides, and we follow its instructions | The merchant |
Members for the limited purposes in section 5 | Controller | Us |
For a shop’s, café’s or restaurant’s loyalty programme, contact that business first. Contact us about our own processing, described below.
3. Merchants, staff, prospects and website visitors
3.1 What we collect
Name, job title, business email and phone number;
Account and login details, with passwords stored as hashes;
Business name and sites;
Subscription, invoice and payment records;
Support messages and call notes;
Website and dashboard activity, IP address, device/browser details, security logs, statistics and error reports; and
Enquiries and marketing preferences.
3.2 Where it comes from
From you, your business, your website/dashboard activity and public business sources. Partners provide account, billing, support and setup information. Customer data exchanged through connected integrations is described in section 4.
3.3 Why we use it
Purpose | Legal basis |
|---|---|
Setting up and running your account, support, billing and service messages | Contract if you are personally our customer; otherwise legitimate interests in serving your business |
Keeping records the law requires, such as tax records | Legal obligation |
Securing our platform and preventing misuse | Legitimate interests |
Improving our Service | Legitimate interests |
Marketing our services to business contacts | Legitimate interests, or consent where required; opt-out available |
Complying with the law and dealing with legal claims | Legal obligation; legitimate interests |
Website statistics using cookies, such as Google Analytics | Consent through cookie settings; withdraw at any time |
Cookieless website statistics (Cloudflare Web Analytics) | Legitimate interests in understanding website use |
Finding and fixing errors in our dashboard | Legitimate interests in keeping the Service working |
Account details are needed to provide the Service; marketing is optional. Where we rely on legitimate interests, we balance them against your rights. Ask us for details.
4. Loyalty members of our merchants
4.1 The merchant is responsible
The merchant decides the programme’s purposes, data, messages and retention. We follow its instructions under the DPA in Schedule 1 of our Merchant Terms, except for our limited controller purposes in section 5.
4.2 What we handle for merchants
Identity and contact details; purchases; points, stamps, rewards, tiers and preferences; consent, opt-out and message-delivery records; wallet and device tokens. Purchase records may include time, amount, site and items. Date of birth and location are used only for enabled features. Data comes from the merchant, customers, connected systems and programme activity.
4.3 What we do not do
Sell member data or share it for cross-context behavioural advertising;
Use it for our own marketing;
Use it to create, train, fine-tune or improve AI or machine learning models; or
Use one merchant’s identifiable member data for another merchant’s programme.
4.4 Your requests
Contact the merchant for access, correction, deletion or marketing choices. We forward requests about its processing and help identify the merchant if needed. Contact [email protected] for our own processing.
4.5 Apple Wallet and Google Wallet
Apple and Google independently control data used for their own wallet services under their terms and privacy notices.
5. When we decide how member data is used
We control the following limited uses of member data. We may use identity, contact, device, transaction and security records only as necessary for these purposes.
Purpose | Legal basis |
|---|---|
Keeping the platform secure and preventing abuse | Legitimate interests |
Detecting fraud across the platform, including patterns involving more than one merchant | Legitimate interests |
Complying with the law and dealing with legal claims | Legal obligation; legitimate interests |
Anonymous or aggregate statistics, unless the merchant’s partner terms prohibit them | Legitimate interests for anonymisation; genuinely anonymous results are not personal data. No re-identification. |
Minimal records to honour withdrawals and prevent erased contacts being reintroduced for marketing | Legitimate interests in respecting choices and preventing unwanted marketing; legal obligation where applicable |
Contact [email protected] to exercise your rights, including objections where applicable. Minimal suppression records use protected contact-matching identifiers, merchant context and opt-out information to prevent future marketing; they do not preserve a customer profile or authorise messages.
6. Who we share data with
Providers supporting hosting, messaging, billing, accounting, CRM, support, analytics, error monitoring and security;
Connected integration partners: account and billing information, and customer or loyalty data needed to carry out the merchant’s requested integration;
Professional advisers, including lawyers, accountants, auditors and insurers;
Authorities where legally required; and
Prospective business buyers or investors, with confidentiality and appropriate safeguards.
We do not sell personal data. Merchant-data sub-processors and their locations are in DPA Annex C. Integration partners’ roles depend on the services and processing involved.
7. International transfers
We store data in the United Kingdom. For people in the EEA, this relies on the European Commission’s adequacy decision for the UK. Our staff access data from Israel, which has adequacy status under UK and EU law. Some providers process data elsewhere, including the United States, as listed in Annex C of our Data Processing Agreement. For those transfers we use safeguards such as the EU Standard Contractual Clauses, the UK Addendum or the UK International Data Transfer Agreement. Email [email protected] for a copy.
8. How long we keep data
Data | How long |
|---|---|
Account and contact data | While your account is active, then 24 months |
Invoices and financial records | Seven years from the end of the tax year to which they relate |
Contracts and acceptance records | Seven years after the agreement ends |
Support messages | 24 months after the ticket closes |
Security logs | As long as needed to keep our platform secure |
Prospects we never do business with | 24 months after last contact |
Marketing opt-outs and protected suppression identifiers | Only while needed to honour choices and prevent renewed marketing, including after profile deletion; reviewed for continued necessity |
Website statistics and error reports | Google Analytics: 14 months. Error reports: 90 days. |
Member data | Under merchant instructions and the DPA’s export/deletion process; limited controller records follow section 5 and this table |
9. Security
We use appropriate security measures, including access controls, encryption and monitoring. DPA Annex B describes merchant-data measures. No system is completely secure. We give required breach notices.
10. Marketing and cookies
Stop our marketing emails using the unsubscribe link or [email protected]. Essential account and security messages continue. For merchant promotions, contact the merchant; we assist it under the DPA. Installing a wallet pass or enabling notifications does not itself establish marketing consent.
Our websites (loyalty.dog and loyaltydog.ai) and our dashboard use cookies and similar technologies. Analytics cookies require agreement. The notices at loyalty.dog/cookie-notice and loyaltydog.ai/cookie-notice explain the technologies and choices, including cookieless statistics. Consent to cookies can be withdrawn through cookie settings.
11. Your rights
Depending on applicable law, you may access, correct or delete data, restrict or object to processing, or obtain a portable copy. You may withdraw consent and object to direct marketing at any time. Email [email protected]. We may verify identity. We normally respond within one month; for complex requests we explain any permitted extension of up to two further months. Any shorter applicable deadline takes priority.
You may complain directly to the UK ICO (ico.org.uk), your EEA supervisory authority, Israel’s Privacy Protection Authority (gov.il), or the relevant regulator where you live. You need not contact us first.
12. Changes to this policy
When we update this policy we change the version number and date. We tell merchants about material changes by email or in their account. Our Merchant Terms of Service, which include our Data Processing Agreement, are published at loyalty.dog.