1. Who is responsible for your data?
LoyaltyClub provides digital loyalty software. A participating business decides its loyalty rules and is responsible for its customer relationship, rewards, store visits and the customer information it enters or receives. For those records, the business is generally the primary decision-maker and LoyaltyClub processes information to provide the service. The operator of loyaltyclub.in is responsible for the platform account, site security and platform administration. The exact legal identities and contact details of these parties must be published before the service is offered commercially.
2. Information we process
- Account information: name, email address, phone number, password hash, account role and authentication/security state. We do not store your readable password.
- Loyalty activity: business and branch, loyalty program, stamp count, visit time, reward and voucher status, redemption, referral and in-app notification events.
- QR and fraud-prevention records: short-lived QR session and nonce identifiers, scan outcome, time, staff and branch context, idempotency key, and where available or needed for security, IP address and a hashed device identifier. A QR scan is not a payment confirmation.
- Merchant workspace information: business profile, branches, staff membership/permissions, programs, rewards and audit history.
- Payment records: when a configured payment provider is used, plan, amount, currency, provider reference and payment status. Payment credentials are collected and handled by the payment provider; LoyaltyClub is designed not to store full card, bank or UPI credentials.
- Support and preferences: messages you submit through supported contact channels, notification preferences and consent/opt-out state.
Do not include sensitive personal information in a business profile, reward description, internal note or support message unless it is necessary and lawful.
3. Why we use information
We use information to create accounts, show loyalty cards, validate eligible stamps, issue and redeem vouchers, operate merchant workspaces, provide support, secure the service, detect abuse, maintain audit records, and meet legal or accounting requirements. Review-related events record only that a prompt appeared or a review link was clicked; LoyaltyClub does not claim that a review was submitted and does not require a positive review for a reward.
4. When information is shared
A customer’s loyalty activity is visible to the business that issued the relevant card or voucher and to its authorized staff according to their permissions. We use hosting, database, email, notification and payment providers as needed to operate configured features. A payment provider receives information necessary to create and confirm a checkout. Push and email delivery may remain unavailable until the operator configures those services. We do not sell personal information. We may disclose information when required by law, to protect people and the service, or as part of a business transfer subject to appropriate safeguards.
5. Security and retention
We use access controls, encrypted transport, protected authentication sessions, hashed passwords, short-lived signed QR sessions, replay checks, database transactions and audit records. No online service can promise absolute security. Please use a unique password and protect your device and authenticator.
We retain account and loyalty information while it is needed to provide the service. Security, payment, redemption and audit records may be retained longer to prevent fraud, resolve disputes, preserve transaction history or meet legal obligations. Immutable audit records are not silently removed. Retention periods and deletion procedures should be finalized by the operator for each applicable jurisdiction before commercial launch.
6. Your choices and rights
You can manage supported notification preferences in the app. You may ask a participating business about the loyalty information it controls or request correction of inaccurate account details through the support channel published by the operator. Rights such as access, correction, deletion, restriction or objection depend on applicable law and the role of the relevant business. Some records may need to be retained for security, financial or legal reasons. We will verify identity before acting on a sensitive request.
LoyaltyClub does not currently use the camera for continuous tracking. Camera access is requested only to scan a QR within the app. Location is not required for the core loyalty flow. When you tap Use current location, your device asks for permission. Customers can use an approximate location to sort participating shops; it is not saved to the account profile. Merchants can explicitly publish a shop entrance pin and address. Map tiles are provided by the configured map provider (currently OpenStreetMap), which receives normal map requests. Optional automatic address lookup uses a separately configured provider; if unavailable, enter the address manually. No background location tracking is used.
7. Children
LoyaltyClub is a general local-business loyalty service and is not designed for children under 18. A participating business must not knowingly use the service to collect children’s information contrary to applicable law.
8. Changes to this notice
We may update this notice when the service, providers or legal requirements change. We will update the date above and provide additional notice when required. Continued use after an effective change is subject to applicable law.
9. Contact and complaints
For a loyalty card, visit, reward or voucher, contact the business that issued it. For platform account or privacy questions, use the current contact details published by the operator of loyaltyclub.in. Those contact details and any legally required grievance officer must be verified and published by the operator before commercial launch.
10. Optional AI review drafts
If you choose AI drafting and consent, your visit details and the business name are sent to Google Gemini to help rewrite your own experience. Do not include personal or sensitive information. You can edit the draft and decide whether to copy and post it on Google. LoyaltyClub does not store your visit description or generated text in drafting request history; it records the customer, shop, model, time and request status to enforce usage limits. Google processes submitted content under the terms and privacy practices of the configured Gemini service. AI drafting is optional and does not affect rewards.