Privacy Policy

RewardLoop

Last Updated: 26/07/2026

Introduction

RewardLoop LTD ("RewardLoop", "we", "us", "our") provides a loyalty app, browser-based customer onboarding, merchant/admin tools, wallet-pass support and the RewardLoop website. This Privacy Policy explains what personal data we collect, how we use it and the choices available to customers, merchants and website visitors.

If you have any questions about privacy or data access, contact us at admin@rewardloop.co.uk.

Who This Policy Covers

• Customers: people who create or access a RewardLoop account through the app or a supported browser journey, collect loyalty progress, receive rewards, request or use wallet passes or submit suggestions.
• Merchants and staff: store owners, operators and staff who create merchant access, complete setup, manage launch details or use the admin tools.
• Website visitors: people who visit rewardloop.co.uk, start signup, book a demo, use a landing page or contact us.

Information We Collect

• Account and authentication data: email address, email-verification status, authentication-provider identity and login details needed to create and secure customer or merchant access. Authentication credentials are handled through our authentication provider.
• Customer profile data: preferred name, optional phone number, postcode, date of birth, gender, profile photo where provided, device information, operating system, app version and notification preferences.
• Loyalty activity: selected stores, QR or wallet-pass activity, purchases, collection amount, promotional starting progress applied, spend or visit count where configured, reward progress, reward redemptions, timestamps, branch/location context and whether a customer has opted into store notifications.
• Suggestions: suggestion text and timestamp submitted for a store. Suggestions are intended to be anonymous to the store, but customers should not include personal information in free-text suggestions.
• Merchant setup and poster data: work email, business name, business type, address, location, postcode, branch count, branch names, reward offer, optional Welcome Head Start configuration, plan selection, setup progress, poster-service choice and purchase status, logo and brand material, generated or human-designed poster files, revision requests and feedback, approval state and print or delivery details where ordered.
• Billing data: billing contact email, billing acknowledgements, payment method status, card brand and last four digits where available, Stripe customer/subscription/invoice references, Go Live status, trial start and end dates, first charge date, cancellation state and payment status. RewardLoop does not store full card numbers.
• Website and attribution data: pages viewed, referral source, UTM parameters, `gclid`, `fbclid`, landing page, first seen and last seen timestamps, anonymous visitor ID, Start Free, contact and demo interaction events.
• Support and communications: information you send when emailing us, booking a demo, submitting a contact request, requesting a custom announcement or asking for support. Contact requests may include your name, email, business name, optional phone number, enquiry type, message content, page/source metadata and UTM data.
• Diagnostics: crash reports, device details and technical logs used to keep the app and website stable.

How We Use Information

• To provide RewardLoop: create accounts through the app or browser, authenticate users, confirm email verification where required, run loyalty progress, process reward redemptions, issue requested wallet passes and show customers their selected stores. The same RewardLoop account may be used later to sign in to the native app.
• To support merchants: complete setup, generate and refresh automatic poster files, deliver requested human design work, process poster revisions and approvals, fulfil eligible Print & Deliver orders, manage Go Live, provide Data Hub visibility and help stores understand loyalty activity.
• To respond to enquiries: reply to contact requests, pre-sales questions, support questions and demo-related messages.
• To process billing: start and administer free trials at Go Live, manage payment methods, subscriptions and cancellations, process add-ons, handle invoices and failed payments and maintain payment records.
• To send notifications: support merchant-requested custom announcements with guided scheduling and send automatic close-to-reward or reward-ready reminders where available and permitted.
• To improve the service: analyse signup journeys, diagnose errors, improve reliability, understand marketing attribution and make product decisions.
• To comply with obligations: keep records needed for tax, accounting, dispute handling, security and legal compliance.

Lawful Bases

Depending on the activity, we rely on contract performance, legitimate interests, consent where required and legal obligations. For example, account and loyalty operations are usually needed to provide the service, billing records may be needed for legal obligations, product analytics may support our legitimate interests and non-essential marketing or tracking technologies may require consent.

What Merchants Can See

Participating merchants can see loyalty activity connected to their own store or branch, including customer activity, transactions, reward redemptions, customer detail where available, notification status and suggestions. RewardLoop is designed so merchants access data relevant to their own store activity rather than unrelated stores.

Cookies and Similar Technologies

RewardLoop uses cookies and local storage to operate the website, preserve campaign attribution and understand how people move from the website into signup or demo journeys. These may include `rewardloop_attribution` and `rewardloop_anonymous_id`, stored for up to 90 days. Attribution may include UTM parameters, `gclid`, `fbclid`, landing page, referrer and first/last seen timestamps.

Where required, we will ask for consent before using non-essential analytics, advertising or similar technologies. Browser settings may also allow you to block or delete cookies.

Who We Share Information With

• Cloud and app providers: Firebase, Google Cloud and related services used for authentication, databases, storage, hosting, messaging, diagnostics and security.
• Payment providers: Stripe and related payment infrastructure used for subscriptions, invoices and payment method handling.
• App, wallet and platform providers: Apple, Google and wallet providers receive the account identifier and pass data needed to generate, issue, save, display and operate a requested wallet pass, and may also process data for app distribution, notifications and device-level features. Their own privacy terms apply to their processing.
• Operational providers: booking, support, analytics and professional service providers where they help us deliver RewardLoop. We share relevant design and fulfilment details with print or delivery providers only when a merchant orders eligible Print & Deliver, and physical production begins only after the human-designed poster is approved. The automatic Generated Poster is not sent for RewardLoop printing.
• Legal or regulatory recipients: where required to comply with law, protect rights, investigate abuse or respond to lawful requests.

We do not sell personal data.

International Transfers

Some providers may process data outside the United Kingdom. Where this happens, we use appropriate safeguards required by applicable data protection law, such as approved contractual terms or provider transfer mechanisms.

Retention

We keep personal data only for as long as needed for the purposes described in this policy. Account, loyalty, merchant setup and poster-order data may be kept while the account or store relationship remains active, including where files remain available for download, refresh, revision or fulfilment. Loyalty records are generally retained for up to three years unless deletion is requested or a longer period is required for billing, legal, dispute or security reasons. Billing and accounting records may be kept for longer where required by law. Website attribution cookies are stored for up to 90 days.

Security

We use technical and organisational measures intended to protect personal data, including access controls, encrypted connections and security features provided by Google Cloud Platform and Firebase. No online service can be guaranteed to be completely secure, so we keep our controls under review.

Your Rights and Choices

Depending on your relationship with RewardLoop and the applicable law, you may have rights to access, correct, delete, restrict, object to or receive a copy of your personal data. You may also withdraw consent where processing is based on consent. To make a request, email admin@rewardloop.co.uk.

You can manage store notification preferences where the app provides that control. You can also delete your account or ask us for help with deletion by emailing us.

If you are unhappy with how we handle your data, you can contact us first. You may also have the right to complain to the UK Information Commissioner's Office.

Children

RewardLoop accounts and customer onboarding are not available to children under 13. If we learn that a child under 13 has provided personal data through a RewardLoop account, we will take reasonable steps to delete it.

Changes to This Privacy Policy

We may update this Privacy Policy when our product, providers or legal obligations change. We will post the updated version on the Website and update the date above. For material changes, we may also provide additional notice where appropriate.