loyi.

Privacy policy

Last updated: 11 October 2026

Loyi gives shops digital stamp cards. Clients tap an NFC tag in the shop and collect stamps in their browser, without installing an app. This policy explains what data Loyi uses, why, and what you can do about it. It covers the Loyi website (loyi.be) and the Loyi for business app on iPhone and Android.

Who is responsible

Loyi is run by [company name or your full name], [street, postcode, city], Belgium, [company number (KBO/BCE), if you have one]. Contact: marwan.fikri20@gmail.com.

Loyi is the controller for your Loyi account and for running the service (keeping your cards, preventing fraud). For the loyalty programme of a shop (its cards, the stamps and rewards of its clients and its follow-up messages) the shop is the controller and Loyi processes that data on the shop's behalf, under the data processing agreement every shop accepts.

Clients (people collecting stamps)

Without an account: a random, anonymous ID stored in your browser. We don't know your name, email or phone number.
Your cards: for each shop, your stamps, rewards you earned and used, and when you tapped a tag (date and time). The shop sees this under a short code that only works in that shop, never your name or email.
Messages from shops: a shop can write a short message for a group of its card holders, such as "reward waiting" or "not seen in a month". Your own phone checks whether a message is meant for you, using your card. Neither the shop nor Loyi learns who saw it. Messages are shown only inside Loyi (no email, no push). You can hide one message, or turn off all messages from shops under Account & privacy → Messages from shops.
If you save your cards to an account: your email address, or the email and name Google shares with us when you use "Continue with Google".

Shops (Loyi for business)

Account: email address (or your Google account's email when you use "Continue with Google").
Official details: your shop's official name, address, company number, VAT number if you have one and optionally a phone number. We use them for your invoices (Stripe receives them), the data processing agreement and posting your Loyi tags. Only you and Loyi see them; clients never do.
Shop details you enter: name, brand colours, logo, loyalty cards, rewards and NFC tags.
Activity: stamps given and rewards used by your clients (with anonymous client IDs). Your dashboard, client list and insights are counted from this; each client appears as a code that only works in your shop.
Follow-up messages you write for your card holders. They must not contain personal data or links.
You can download your client list (anonymous codes, dates and counts) as a CSV file. What you do with that file is your own responsibility as controller.
Subscription: whether it is active or in its free trial, when it renews and how you pay. Payments are handled by Stripe; we never see your card or bank details. Stripe also asks for the address where we post your starter kit (two secure tags); we use it only for that.

Why we use it

To provide Loyi: keep your cards and stamps, run a shop's programme and dashboard (contract, GDPR art. 6(1)(b)).
To keep Loyi safe: prevent fake stamps, abuse and fraud (legitimate interest, art. 6(1)(f)).
To show a shop's follow-up messages on its clients' cards: the shop's legitimate interest in keeping in touch with its clients (art. 6(1)(f)). This is direct marketing, so you can object at any time by turning off messages from shops; Loyi then doesn't even load them (art. 21(2)).
To handle subscriptions and invoices, and meet legal obligations such as accounting (art. 6(1)(b) and (c)).

We don't sell data, don't show ads and don't track you across other apps or websites. There are no advertising or analytics cookies.

Service providers

We use these providers to run Loyi. They process data only on our instructions:

Google Firebase (Google Ireland / Google LLC): accounts, the database (stored in Belgium, europe-west1) and hosting. Firebase Authentication can process data in the United States.
Stripe (Ireland / United States): takes payments for subscriptions bought on the website.
Google: Google sign-in.
Cloudflare: runs our small server, which switches a shop's tags on after payment and checks each tap on a secure Loyi tag (the tag's one-time code and your anonymous ID, nothing else).

Transfers outside the EU are covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Browser storage and technical data

The website stores your anonymous ID, your sign-in session and your choices (language, appearance, messages from shops) in your browser (local storage), because Loyi can't work without it. It is not used for tracking, so no cookie banner is needed.

Everything the website and app need, including code and fonts, comes from Loyi's own hosting: we don't load Google Fonts or other outside content. Our hosting provider (Google Firebase) handles your IP address and browser details to deliver the pages and protect them from abuse, in short-lived technical logs. If you choose "Continue with Google", Google's sign-in page opens.

How long we keep data

Your account and cards: until you delete them.
When a shop deletes its account, its cards, tags and all its clients' stamps for that shop are deleted.
Stamp and reward history of a shop (under anonymous IDs): deleted automatically after 2 years, or earlier when the shop deletes its account.
A card that hasn't been used for 2 years is deleted automatically, with its stamps and unused rewards.
Invoices and subscription records: as long as Belgian accounting law requires (up to 7 years).
You can download a copy of your data at any time under Account & privacy → Download my data.

Your rights

You can see, download, correct and delete your data yourself under Account & privacy in Loyi: download a copy, change your email or password, or delete your account. You can also ask us to see, correct, export or delete your data, or object to or restrict its use. Email marwan.fikri20@gmail.com. You can delete your account yourself at any time; see Delete your account. If you think we handle your data wrongly, you can complain to the Belgian Data Protection Authority (dataprotectionauthority.be).

Children

Loyi is not meant for children under 13. Shop accounts are for adults acting for a business.

Changes

If we change this policy, we update the date at the top. For important changes we tell shops by email.