DOUBLE STAMPS!

Get 2x stamps on all stamp pack purchases

Limited Time Only
Claim Double Stamps

Privacy Policy

At Loytu, we take your privacy seriously. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our platform, and how we work with business users to process their customers’ data.

By using Loytu, you agree to this Privacy Policy and our Terms of Service.

1. Who We Are

Loytu is a B2B platform that allows businesses to manage digital loyalty stamp cards and customer rewards programs.

2. Personal Data We Collect

2.1 Business Users

When you sign up as a business, we collect:

  • Name, email, and contact information
  • Company information
  • Billing and payment details
  • Account usage and activity data

2.2 Customers of Business Users

  • Businesses may enter their customers’ personal data into the platform (e.g., name, email, phone number, loyalty activity, labels).
  • This data is entered and managed by the business user; Loytu acts as a processor under the Data Processing Agreement.

2.3 Analytics and Usage

  • We collect anonymous or pseudonymous data via Google Analytics and Microsoft Clarity to understand platform usage and improve our services.

3. How We Use Personal Data

  • To provide, maintain, and improve the Loytu platform
  • To process payments for subscription or pay-per-stamp features
  • To communicate with business users regarding their accounts or the Services
  • To assist business users in fulfilling their data protection obligations

Note: Loytu does not determine the purposes of customer data processing; business users are responsible as Controllers under applicable Data Protection Laws.

4. Data Processing Agreement (DPA)

  • Loytu provides a DPA that governs processing of customer data.
  • By using Loytu, business users agree to the DPA.
  • The DPA defines our role as a Processor and the business user’s role as Controller, and covers:
    • Subprocessors
    • Security measures
    • Retention and deletion
    • Assistance with data subject requests

5. Subprocessors

  • We engage third-party providers to help deliver the platform. These may process personal data on behalf of business users.
  • Current Subprocessors:
    • Vercel, Inc. — Hosting & deployment
    • Turso (ChiselStrike, Inc.) — Database hosting
    • Supabase, Inc. — Authentication & database services
    • Stripe, Inc. — Payment processing
    • Mailgun Technologies, Inc. — Email delivery
    • Microsoft Clarity — Analytics & session recording
    • Google Analytics — Website analytics
  • See the full list at https://loytu.com/policies/subprocessors.
  • We may update this list; changes are effective when published.

6. Data Retention

  • Personal data entered by business users is retained as long as their account is active.
  • Upon account termination, data will be deleted or returned according to the DPA and applicable law.

7. Data Deletion Policy

Business users and their customers may request deletion of personal data in accordance with applicable law.

  • Business user accounts: If a business user terminates their account, their data will be deleted or returned in line with our Data Deletion Policy.
  • Customer data: Customers of business users must contact the business directly to request deletion. Loytu will assist the business in fulfilling such requests, as described in our Data Processing Agreement.
  • For details on how we delete and retain data, see our Data Deletion Policy.

8. Data Subject Rights

  • Customers of business users may have rights under GDPR, CCPA, or similar laws: access, correction, deletion, restriction, portability, or objection.
  • Business users are responsible for fulfilling these requests.
  • Loytu will provide reasonable assistance to business users to enable compliance.

9. Security

We implement appropriate technical and organizational measures to protect personal data:

  • Encryption in transit and at rest
  • Access controls and authentication
  • Regular backups and disaster recovery
  • Vulnerability management and security testing

10. International Data Transfers

  • Some Subprocessors operate outside the UK/EU.
  • We ensure appropriate safeguards for these transfers (e.g., Standard Contractual Clauses, adequacy decisions).

11. Third-Party Services

  • Third-party platforms (Apple App Store, Google Play Store) may collect information independently when users download apps.
  • Loytu is not responsible for these independent data collection practices.

12. Changes to This Privacy Policy

  • We may update this Privacy Policy from time to time.
  • Changes are effective upon posting at https://loytu.com/policies/privacy.
  • Continued use of the platform constitutes acceptance of any updates.

13. Contact

For questions or concerns regarding this Privacy Policy or data processing:
Email: support@loytu.com