Who is responsible
RegliCard is a service for businesses that run loyalty programs. For a loyalty customer’s information, the shop decides why the information is used and is the data controller in the EU/EEA or the responsible organization in Canada. RegliCard processes that information for the shop as its processor or service provider.
The operator of RegliCard is separately responsible for shop-team accounts, service security, support communications, and product analytics. RegliCard is currently in pre-launch: the operator’s registered name, address, and governing-law details must be added here before paid contracts are offered through the website.
Information we handle
- Shop-team details, including name, email address, role, shop membership, and authentication records.
- Customer details provided to a shop, including name, email address, optional birthday, preferred language, and archive status.
- Loyalty activity, reward history, shop membership, and RegliCard status.
- Wallet delivery and device information needed to issue and update an Apple Wallet pass.
- Trial Request details, including the prospective Shop name and address, Business Type, intended Owner name, email address, phone number, and preferred language.
- Trial Request consent, submission, confirmation-email, and administrator review or closure records.
- Technical information such as authentication sessions, IP-derived rate-limit identifiers, security logs, page routes, browser or device category, country, and performance measurements.
- Messages and other information sent when someone contacts support.
The application’s rate-limit counters store keyed digests rather than raw IP addresses or email addresses. RegliCard does not use customer information for advertising or sell it.
Why we use it
- Provide accounts, shop workspaces, customer enrollment, loyalty tracking, scanning, and Wallet passes.
- Authenticate people, enforce shop permissions, prevent abuse, and protect the service.
- Deliver account, Wallet, and Trial Request receipt emails, respond to support, and operate requested features.
- Review Trial Requests, contact the intended Owner about that request, and decide whether to create a Shop and start a Trial.
- Measure aggregate usage and technical performance so we can maintain and improve RegliCard.
- Meet legal obligations and establish, exercise, or defend legal claims.
EU / EEA
For platform activities, the legal basis depends on the purpose: performing a contract, legitimate interests in operating and securing the service, consent where requested, or compliance with law. Each shop is responsible for choosing and communicating its legal basis for its own loyalty program.
Canada
RegliCard and each shop must identify reasonable purposes and obtain meaningful consent where required. A shop remains accountable when RegliCard handles customer information for it as a service provider.
Who receives information
We disclose information only as needed to operate the service:
- Authorized members of the relevant shop team.
- Supabase for authentication, database, and scheduled backend services.
- Vercel for hosting, security, web analytics, and performance measurement.
- Our email provider for account and Wallet delivery messages.
- Apple when a person chooses to add and use an Apple Wallet pass.
- Professional advisers, authorities, or another party where law requires it or a business transfer makes it necessary.
These providers may process information in countries other than the person’s own. Where required, the responsible party must use appropriate contractual and transfer safeguards. Information processed in another country may be accessible to its courts, law enforcement, or national-security authorities under local law.
Retention and deletion
We keep information while it is needed to provide the service, follow a shop’s documented instructions, meet legal obligations, resolve disputes, and maintain security records. Shop account and customer data are retained while the relevant shop uses RegliCard unless deletion is requested and legally permitted.
Archiving a customer is not deletion. It keeps the shop’s loyalty history, deactivates the RegliCard, and expires the private claim link. A Wallet pass already installed on a device may remain there until its holder removes it. Backup copies may remain for a limited recovery period.
We retain unconverted Trial Requests for 12 months after submission, then remove them through the scheduled Supabase cleanup job; an administrator-only manual fallback is available if the scheduler is unavailable. A Converted Trial Request remains linked to its Shop as operational history. The Trial Request checkbox authorizes contact about that request; it is not marketing consent, and we do not use the submission to subscribe anyone to marketing.
Your choices and rights
Loyalty customers should normally contact the shop they joined first because that shop controls their loyalty record. Shop-team members and anyone with a platform privacy question can contact RegliCard directly.
EU / EEA rights
Depending on the circumstances, a person may ask for access, correction, deletion, restriction, portability, or object to processing, and may withdraw consent. They may also complain to their local data-protection authority.
Canadian rights
A person may ask for access to and correction of personal information, withdraw consent subject to legal or contractual limits, and challenge compliance. In Quebec, requests may also be made to the person responsible for the protection of personal information.
Security and children
We use access controls, tenant-scoped authorization, encryption in transit, secret management, and operational safeguards appropriate to the service. No online service can promise absolute security, and this notice does not claim a certification that RegliCard has not obtained.
RegliCard is not directed to children. Shops must not enroll a child unless they have the authority and any consent required in the child’s jurisdiction.
Contact and changes
Contact the RegliCard privacy lead at reglicard.cards@gmail.com. Quebec privacy requests may use the same contact. We will update the date above when this notice changes and provide additional notice where a material change requires it.