Privacy Policy

1. Who We Are

LoyaltyRewards ("we", "us", "our") is a Software-as-a-Service (SaaS) platform that provides digital loyalty programmes, QR-based stamp cards, marketing campaign tools, and booking management to businesses ("Merchants") across India and internationally. Merchants can also use WhatsApp Commerce (catalogue, orders, payments and messages on their own WhatsApp Business number), Sales Leads & Chat Reports, WhatsApp Calling, Social Autopilot (posts on Facebook, Instagram, YouTube and LinkedIn) and the Growth Engine (ads on the Merchant's own Meta ad account and the leads they bring).

When a customer of a Merchant ("Guest" or "End User") scans a QR code and joins a loyalty programme, they interact with our platform. This Privacy Policy covers both Merchants who subscribe to our service and the Guests who use loyalty features.

This platform is operated under Indian law and our services are primarily offered within the Republic of India.

2. What Data We Collect

2.1 Data collected from Guests (loyalty card users)

• Mobile phone number — required to identify you uniquely across visits (stored in international E.164 format, e.g. +91XXXXXXXXXX)
• Name — optional, provided by you during sign-up
• Email address — optional, provided by you
• Visit & stamp history — timestamps and locations of each loyalty stamp you earn
• Reward vouchers — records of rewards issued and redeemed
• Marketing consent — whether you agreed to receive promotional messages
• OTP verification records — hashed one-time codes used to verify your phone number (code itself is never stored in readable form)
• Opt-out status — if you opt out of marketing messages, we record this to honour your preference
• Anonymous feedback — star ratings and written feedback you submit (not linked to your identity unless you choose)

2.2 Data collected from Merchants (business owners)

• Business name, address, type and contact details
• Owner and staff names, email addresses and hashed passwords
• Subscription and billing records — plan, billing cycle, Razorpay order/subscription IDs, invoice numbers (we never store full card numbers)
• Business settings — loyalty rules, reward descriptions, QR code configurations, menu and offer items
• Audit logs — staff actions such as stamps issued, redemptions, voids (for your own accountability)

2.3 Data we process for Merchants about their customers and leads

When a Merchant uses WhatsApp Commerce, Sales Leads, WhatsApp Calling or the Growth Engine, we store and process, on the Merchant's behalf:

• WhatsApp conversations on the Merchant's number — phone number, WhatsApp profile name, messages, media and their delivery status
• Lead details — name, phone, email, company, requirement, service of interest, stage, follow-up dates, notes, quotation amounts and the staff member handling the lead
• Visiting cards photographed by the Merchant, and the details read from them
• Call records — caller number, time, duration, answering staff member (call audio is not recorded or stored by us)
• Orders — items, amounts, payment status and, for deliveries, the delivery address and location pin
• Ad information — when a person messages a Merchant from a Facebook or Instagram ad, the ad's ID, headline and a click reference sent by WhatsApp; when a person fills a Merchant's Meta lead form, the answers they gave (for example name, phone, city) and whether they ticked "you can message me on WhatsApp"

2.4 Data from Merchants' connected accounts

• Meta — WhatsApp Business account and phone number IDs, Facebook Page and Instagram account IDs and names, Meta ad account ID, name, currency, status and whether a payment method exists (we never see card numbers), and the results of ads run from the Platform (spend, reach, clicks, conversations, leads)
• YouTube and LinkedIn — the channel or profile name and ID the Merchant connects
• Google Drive — the names and files of the shared folder the Merchant links for posting
• Access tokens for all connected accounts are stored encrypted and are never shown to anyone

2.5 Technical data (both user types)

• Agreement records — when a Merchant signs up, pays, sets up Autopay or approves an ad budget, we record the date and time, the user, what was bought, the amount, the IP address, the browser and the version of the Terms of Service and Privacy Policy accepted, as proof of the agreement
• IP address — hashed and used only for security rate-limiting; not stored in plain text for longer than needed
• Browser user-agent — used to display QR scan analytics
• Session identifiers — temporary, stored in browser cookies, expire after 30 days
• Error logs — PHP/server errors for debugging (contain no personal data beyond technical context)

3. How We Use Your Data

3.1 For Guests

• Identify you across visits to the same or different Merchant businesses on our platform
• Record your stamps, calculate your progress and issue reward vouchers automatically
• Send transactional messages (OTP codes, reward notifications) — these do not require marketing consent
• Send promotional campaign messages (special offers, win-back messages) — only if you have opted in
• Allow you to opt out of marketing messages at any time via the opt-out link in every message
• Display your stamp card and booking history in the Guest web app

3.2 For Merchants

• Provide the full loyalty, campaign, booking and analytics dashboard
• Process subscription payments via Razorpay
• Send billing confirmations, trial expiry reminders and account notices
• Maintain audit trails for staff actions as required by the merchant
• Provide aggregated analytics (visit counts, redemption rates) — these are never shared with other merchants
• Show the Merchant which ad each enquiry came from, send the Merchant's automatic first reply, give leads to the Merchant's staff in turn and alert the Merchant about new enquiries
• Create, start, pause and report on ads on the Merchant's own Meta ad account, only as approved by the Merchant
• Publish the posts the Merchant schedules on the pages and channels the Merchant connected
• Generate texts, plans, posters and summaries with AI from the Merchant's own business details

3.3 Who is responsible for which data

• For the data of a Merchant's customers, leads and callers (Section 2.3), the Merchant is the Data Fiduciary: the Merchant decides why the data is collected and how it is used, and must give any notice and obtain any consent required by law. We act as the Merchant's Data Processor and use this data only to provide the Platform to that Merchant.
• For Merchants' own account and billing data, and for Guests' loyalty profiles, we are the Data Fiduciary.
• If you are a customer or lead of a Merchant and want to know how your data is used, contact that Merchant first. We will help the Merchant answer your request.

3.4 Legal bases under India DPDP Act 2023

• Consent — for marketing messages and optional profile data
• Contract performance — for core loyalty features (stamps, rewards) and merchant subscriptions
• Legitimate interests — for security, fraud prevention and platform integrity
• Legal obligation — to comply with Indian tax law (GST invoices) and IT Act requirements

4. WhatsApp & SMS Messaging

4.1 How messaging works

When you scan a Merchant's QR code and join their loyalty programme, you will see a checkbox: "I agree to receive loyalty updates and promotional offers from [Business Name] via WhatsApp/SMS." This box is not pre-ticked — it is your free choice.

4.2 Types of messages we send

• Transactional (no consent required): OTP verification codes, reward issuance notifications, booking confirmations, booking reminders
• Promotional (consent required): Special offers, win-back campaigns, new item announcements — sent only to opted-in members, at most once every 3 days per business

4.3 Opting out

Every promotional message contains an opt-out link. Clicking it permanently removes you from that Merchant's marketing list. You can also contact the Merchant directly or email us (see Section 12) to opt out. Opt-out requests are honoured within 24 hours.

4.4 WhatsApp Business Policy

Where WhatsApp is used as the messaging channel, all messages comply with WhatsApp Business Messaging Policy. We use the official Meta WhatsApp Business Cloud API. Message templates are not used for unsolicited contact.

4.5 Facebook & Instagram posting (merchants)

A Merchant can connect their business's Facebook Page and the Instagram professional account linked to it, so the Merchant can publish posts from LoyaltyRewards now or at a scheduled time. When connected we store the Page's ID and name, the Instagram account's ID and username, and an access token for the Page (encrypted, never shown to anyone), plus the photos, videos and captions the Merchant schedules. We use these only to publish the posts the Merchant creates and to show their status. We do not read the Merchant's messages, followers or personal Facebook profile, and we never post anything the Merchant did not create or approve. Disconnecting in Social Posts deletes the stored token immediately; the Merchant can also remove our app any time in Facebook → Settings → Business integrations. To delete the remaining data, see data deletion.

4.6 YouTube

We use YouTube API Services in two ways. (a) Our internal tool "AppSage Posting" uploads our own company's short videos to our own YouTube channel, using only the upload permission; its sign-in key stays on our own computer. (b) A Merchant can connect their own YouTube channel with one click, so that the videos the Merchant schedules in Social Autopilot are uploaded to that channel. For this we ask for permission to upload videos (youtube.upload) and to read the channel's name and ID (youtube.readonly) so the Merchant can see which channel is connected. We store only the channel name and ID and an encrypted access token, and the videos and titles the Merchant scheduled. We do not read, collect or share any other YouTube data, such as viewers, comments or analytics. The Merchant can disconnect in the Platform at any time, which deletes the stored token. By watching or interacting with videos on YouTube you are bound by the YouTube Terms of Service, and Google's handling of data is described in the Google Privacy Policy. The access can be revoked at any time on the Google security settings page; we then delete the stored key within 7 days. Questions: write to the contact in section 12.

4.7 Facebook & Instagram ads and lead forms (Growth Engine)

A Merchant can connect their own Meta ad account and Facebook Page. With the Merchant's approval of each ad and budget, the Platform creates, starts, pauses and stops ads on that account and reads their results (spend, reach, clicks, conversations and lead counts). Ad spend is charged by Meta directly to the Merchant's own payment method; we never see or store card details. When a person fills the Merchant's Meta lead form, Meta sends us a notification and we read that form entry with the Page's permission (leads_retrieval) to save it as the Merchant's lead. When a person taps a Click-to-WhatsApp ad and messages the Merchant, WhatsApp tells us which ad it was, so the Merchant can see which ads work.

• We do not upload Merchants' customer lists or leads to Meta or any other platform for targeting (no "custom audiences")
• We do not use one Merchant's leads for another Merchant, or for our own marketing
• We do not add a lead to a Merchant's promotional broadcasts; that still needs the person's own opt-in
• A WhatsApp message to a person who filled a lead form is sent only if they ticked the box allowing it
• The Merchant can disconnect the ad account at any time; this deletes the stored access tokens

4.8 LinkedIn and Google Drive

A Merchant can connect LinkedIn (permissions: sign-in, basic profile and posting on the Merchant's behalf) to publish the Merchant's scheduled posts, and can link a shared Google Drive folder from which the Merchant's photos and videos are scheduled. We store only what is needed to publish (the profile ID and name, an encrypted access token, and the files the Merchant chose), and we delete the token when the Merchant disconnects.

5. Who We Share Data With

We do not sell, rent or trade your personal data. We share data only as described below:

5.1 The Merchant (business you visit)

When you join a Merchant's loyalty programme, that Merchant can see your name, phone number, visit history and reward status — because this is the core service they have subscribed to provide you. The Merchant is a separate Data Fiduciary under the DPDP Act for the data they access.

5.2 Service providers (Data Processors)

We use the following sub-processors, each bound by data processing agreements:

• Razorpay Software Pvt. Ltd. — payment processing and Autopay mandates (India)
• Meta Platforms Ireland Ltd. — WhatsApp Business Cloud API for message delivery, and Facebook / Instagram APIs for posts Merchants publish
• Anthropic, Google (Gemini) and Cloudflare (Workers AI) — optional AI writing and images for Merchants' marketing posts; only the Merchant's own post idea and shop name are sent, never customer data
• Meta Platforms — also the Marketing API and lead forms for ads Merchants run from the Platform
• Google LLC — YouTube uploads and Google Drive folders that Merchants connect
• LinkedIn Corporation — posts that Merchants publish on LinkedIn
• Delivery partners (Shiprocket, Borzo, Porter) — the delivery name, phone and address of an order, when the Merchant books a delivery on their own partner account
• Cheaphosting.co.in (web hosting) — server infrastructure in India
• SMS gateway providers — for OTP and SMS delivery (varies by configuration)

5.3 Legal disclosures

We may disclose data if required by a valid court order, law enforcement request under the IT Act 2000, or other applicable Indian law. We will notify affected users where legally permitted to do so.

6. How Long We Keep Your Data

Data type	Retention period
Guest loyalty profile (phone, name, stamps)	5 years after last activity, or until deletion requested
Reward vouchers	3 years after issue or redemption
OTP challenge records	7 days (then auto-deleted)
Rate-limit records (hashed IPs)	24 hours
Marketing messages sent (communication_events)	2 years
Merchant account data	Duration of subscription + 3 years for tax records
Billing/payment records	7 years (required by Indian GST law)
Audit logs	3 years
Anonymous feedback	2 years
Server error logs	90 days
Records of agreeing to the Terms and Privacy Policy (date, time, IP address, browser, versions)	8 years after the account is closed, as evidence of the agreement
Merchant's WhatsApp chats, leads, call records and orders	While the Merchant's account is active, then deleted or anonymised within 90 days of closure (invoices kept as required by law)
Ad information and lead-form entries	While the Merchant's account is active, or until the Merchant deletes the lead
Access tokens for connected accounts (Meta, YouTube, LinkedIn)	Until the Merchant disconnects the account (deleted at once)
Ad results (spend, reach, clicks)	3 years, for the Merchant's reports
Files scheduled for posting	Until posted or cancelled; posted files are removed from the Merchant's folder where the feature says so

7. How We Protect Your Data

• Passwords are hashed using bcrypt (PHP password_hash) — never stored in plain text
• OTP codes are hashed before storage — the original code is never stored
• HTTPS / TLS encryption for all data in transit (enforced via HTTP Strict Transport Security)
• IP addresses used for rate-limiting are HMAC'd with a secret before storage
• Database access is restricted to the application server; no public access
• Session cookies are HttpOnly, SameSite=Lax, and Secure (HTTPS-only in production)
• API keys and credentials (Razorpay, WhatsApp) are stored as environment variables or encrypted in the database — never in source code
• Audit logs record every sensitive staff action (stamp issuance, void, redemption)
• Rate limiting protects all login, OTP and payment endpoints from brute-force attacks

Despite these measures, no system is 100% secure. In the event of a data breach affecting your personal data, we will notify affected users and the relevant authority within 72 hours as required by the DPDP Act 2023.

8. Your Rights

Under the Digital Personal Data Protection (DPDP) Act 2023 and general privacy principles, you have the following rights:

8.1 Right to access

You can request a summary of the personal data we hold about you. We will respond within 30 days.

8.2 Right to correction

You can ask us to correct inaccurate data (e.g. wrong name). Contact us or update it directly in the Guest app.

8.3 Right to erasure (deletion)

You can request deletion of your Guest profile. We will delete your personal data within 30 days, subject to legal retention requirements (e.g. billing records under GST law cannot be deleted early). Deletion removes you from all Merchant loyalty programmes permanently.

8.4 Right to withdraw consent

You can withdraw marketing consent at any time by clicking the opt-out link in any message, or by contacting us. Withdrawal does not affect prior lawful processing.

8.5 Right to grievance redressal

Under the DPDP Act 2023, you may raise a complaint with our Grievance Officer (see Section 12). If unsatisfied, you may approach the Data Protection Board of India once established.

8.6 How to exercise your rights

Email us at rakeshappsage@gmail.com with the subject line "Privacy Request" and your registered phone number. We will verify your identity before acting.

9. Cookies & Local Storage

We use only the following:

• Session cookies — to keep you logged in as a Merchant or Guest. These expire when you close the browser or after 30 days. No tracking cookies.
• localStorage / sessionStorage — to remember your theme preference (dark/light mode) and whether you closed the "Start now" bar on our website. No personal data is stored here.
• Service Worker cache — to enable the Guest PWA to load offline. Caches static assets only.

We do not use third-party analytics cookies (Google Analytics, Meta Pixel, etc.). We do not use advertising cookies or cross-site tracking.

10. Children's Privacy

Our platform is not intended for use by children under the age of 18. We do not knowingly collect personal data from anyone under 18 years of age. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

Under the DPDP Act 2023, processing of children's data requires verifiable parental consent. We do not seek or process data of persons under 18.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this page
• For material changes, notify Merchants via their registered email address at least 14 days before the change takes effect
• For Guests, place a notice on the loyalty landing page they see when they next scan a QR code

Continued use of the platform after the effective date constitutes acceptance of the updated policy.

12. Contact & Grievance Officer

For any privacy queries, data requests or complaints, contact our designated Grievance Officer as required under the IT Act 2000 (Rule 5(9)) and DPDP Act 2023:

This Privacy Policy is written in English. In case of any conflict between translated versions, the English version shall prevail. This policy is governed by the laws of the Republic of India. Any disputes shall be subject to the jurisdiction of courts in India.