Loylpay
Log in

Draft for legal review. This page is a first draft and is not yet in force. Highlighted items are still to be filled in or decided.

Privacy Policy

Last updated: [date it takes effect]

Loylpay is a loyalty service for independent cafés and local businesses. This policy explains what personal information we collect, why, who sees it and what you can do about it. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. "Loylpay", "we" and "us" means [legal entity name], ABN [ABN], of [registered address].

At a glance

  • We never see your cardYou pay the café as normal. Card details never reach us.
  • We don't sell your dataNot to advertisers, not to anyone.
  • Businesses see only their ownA café sees your visits there, nothing from elsewhere.
  • Kept in AustraliaYour account and orders are stored in Sydney.
  • No ad trackingNo advertising cookies or analytics trackers.
  • You stay in controlSee, fix or delete your information by asking us.

Each section starts with a short summary in plain English to help you understand it. The summaries are not part of the agreement: the full text next to them is what applies.

1What we collect

In short

Your name and email, a phone number and photo if you choose, where and when you tap in, and the orders matched to you. Never your card details.

When you create a customer account

  • Your first and last name and email address.
  • A password. It is held by our sign-in provider (Amazon Cognito); we never store it ourselves.
  • If you choose to add them: a mobile number and a profile photo. Staff at the businesses you visit see your photo so they can recognise you.

When you use Loylpay at a business

  • Your check-ins: which business and counter you tapped at, and when.
  • The order we match to your check-in, read from the business's Square account: the items, the amounts, any reward taken off and the time. We never receive your card number or other payment card details.
  • Your points or stamps at each business, the rewards you use and your order history.
  • Things you tell us in the app, such as marking an order as "Not my order".

Staff and business owners

  • Staff: your name, email address, the business and sites you work at, your role and, if you turn on check-in alerts, the notification address your browser gives us.
  • Business owners: your business and site details, your loyalty programme settings and the connection to your Square account. We keep the access key Square gives us; we do not see your Square password.

Technical information

  • Our servers record basic request details, such as your IP address, browser type and the time, to keep the service secure and fix problems.
  • The app keeps a few items in your browser's storage to keep you signed in and remember your settings. We do not use advertising cookies or analytics trackers, and this website sets no cookies at all.

2How we use it

In short

To check you in, match your order, count your points and let the café recognise you. We send only the emails the service needs.

  • To run your account, check you in and match your visit to your order.
  • To add up your points or stamps and let you use your rewards.
  • To show the business you visit who has checked in, so staff can greet you and apply your reward.
  • To send you emails the service needs, such as sign-up codes and password resets. [Decide: will Loylpay or businesses send marketing messages? If so, say how people opt in and out.]
  • To keep the service secure, prevent misuse and meet our legal obligations.

We do not sell personal information.

3Who sees it

In short

The café you visit sees your visits there, and nothing from anywhere else. A few trusted providers help us run Loylpay.

  • The businesses you visit. When you check in, that business's staff see your name, photo (if you added one), your usual order, your points or stamps and your past orders at that business. A business only sees what happened at its own sites. It does not see what you bought anywhere else.
  • Our service providers, who handle information for us and only on our instructions: Amazon Web Services (hosting, database, sign-in and email, in Sydney, Australia), Cloudflare (delivers this website and the app over its worldwide network) and Square (where the business's orders come from).
  • Others only where the law requires or allows it.

Your account and order records are stored in Australia. Cloudflare may process connection details, such as your IP address, in other countries to deliver pages quickly and safely. [Legal review: confirm overseas disclosure wording for Cloudflare and any other provider.]

4How long we keep it

In short

[Plain summary to follow once the retention period is decided.]

We keep your information while your account is open. [Decide the retention period after an account is closed, and for order records the business needs for its own records.]

5Your choices and rights

In short

Change your details in the app, or email us to get a copy, fix something or close your account. We reply within 30 days.

  • You can change your name, mobile number and photo in the app under Account.
  • You can ask us for a copy of your information, ask us to correct it, or ask us to close your account, by emailing hello@loylpay.com. We will reply within 30 days.

6Keeping it safe

In short

Your information is encrypted on its way to us, and only the people who need it can see it.

Information is encrypted in transit, access is limited to people and systems that need it, and staff can only look up customers of their own business.

7Age

In short

Loylpay is for people aged 16 and over.

You must be at least 16 to create a Loylpay account. If we learn that someone younger has an account, we will close it and delete their information. If you think this has happened, email hello@loylpay.com.

8Questions and complaints

In short

Email us first. If we can't fix it, you can go to the Australian privacy regulator.

Email hello@loylpay.com. If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

9Changes to this policy

In short

If we change something that matters, we'll tell you before it applies.

We will post any changes on this page and update the date at the top. If a change matters, we will tell you in the app or by email before it applies.