Who is responsible
Each shop manages its loyalty program and decides why its customer information is used. RegliCard handles that information to provide the service on the shop’s instructions. RegliCard’s operator is separately responsible for team accounts, security, Trial Requests, and support communications.
The service is provided under the RegliCard name. Privacy and business enquiries can be sent to our support contact below.
Information we handle
- Shop-team details, including name, email address, role, shop membership, and authentication records.
- Customer details provided to a shop: name, email address, optional birth month and day, preferred language, and archive status. We do not collect the birth year.
- Loyalty activity, reward history, shop membership, and RegliCard status.
- Wallet delivery and device information needed to issue and update an Apple Wallet pass.
- Trial Request details: proposed shop name, address, country, Business Type, intended Owner name, email address, phone number, and preferred language.
- Trial Request consent, submission, confirmation-email, and administrator review or closure records.
- Technical information needed for authentication, hosting, security, and abuse prevention, including session records, request logs, and IP-derived rate-limit identifiers.
- Messages and other information sent when someone contacts support.
The application’s rate-limit counters store keyed digests rather than raw IP addresses or email addresses. RegliCard does not use customer information for advertising or sell it.
Why we use it
- Provide accounts, shop workspaces, customer enrollment, loyalty tracking, scanning, and Wallet passes.
- Authenticate people, enforce shop permissions, prevent abuse, and protect the service.
- Deliver account, Wallet, and Trial Request receipt emails, respond to support, and operate requested features.
- Review Trial Requests, contact the intended Owner about that request, and decide whether to create a Shop and start a Trial.
- Meet legal obligations and establish, exercise, or defend legal claims.
Québec
The shop remains responsible for its customer information when RegliCard acts as its service provider. Purposes must be explained clearly and the required consent obtained. Optional birthday information is a separate choice; joining does not subscribe a customer to marketing.
Who receives information
We disclose information only as needed to operate the service:
- Authorized members of the relevant shop team.
- Supabase for authentication, database, and scheduled services, with the project hosted in Ireland (eu-west-1).
- Vercel for hosting and security, with application functions configured for Ireland (dub1). Vercel Web Analytics and Speed Insights are disabled.
- Resend for outgoing account, Wallet, Trial Request, and support email.
- Cloudflare Email Routing and Gmail for receiving and handling support and business email.
- Apple when a person chooses to add and use an Apple Wallet pass.
- Professional advisers, authorities, or another party where law requires it or a business transfer makes it necessary.
These providers may process information outside France or Québec. An Irish database or function region does not mean that all provider processing stays in Ireland. Information processed elsewhere may be accessible under that country’s laws. Contact us for information about the providers and safeguards relevant to your request.
Retention and deletion
Customer records are erased after 24 months without enrollment, loyalty activity or verified Checkout, unless a specific legal retention obligation applies. RegliCard and the shop carry this out through a documented manual retention review. When a shop leaves, it has 30 days to request an export before we delete its live customer data. Legal obligations or documented legal holds may require limited information to be kept longer.
Archiving is not deletion: it retains loyalty history, deactivates the RegliCard, and expires its private claim link. Deletion requests are handled manually with the responsible shop. Installed Wallet passes can remain until the holder removes them. Deleted live data may remain in restricted provider backups until those backups expire; contact us for the recovery period applicable to your data.
We retain unconverted Trial Requests for 12 months after submission, then remove them through the scheduled Supabase cleanup job; an administrator-only manual fallback is available if the scheduler is unavailable. A Converted Trial Request remains linked to its Shop as operational history. The Trial Request checkbox authorizes contact about that request; it is not marketing consent, and we do not use the submission to subscribe anyone to marketing.
Your choices and rights
Loyalty customers should normally contact the shop they joined first because that shop controls their loyalty record. Shop-team members and anyone with a platform privacy question can contact RegliCard directly.
Québec
You may request access or correction, withdraw consent subject to applicable limits, and request a portable copy of computerized information collected from you where the law provides it. You may contact our privacy lead or complain to Québec’s Commission d’accès à l’information. We handle requests manually after verifying identity and the shop concerned.
Access and correction requests receive a response within 30 days. Our first support response target is separate from this legal deadline.
Security and children
We use access controls, tenant-scoped authorization, encryption in transit, secret management, and operational safeguards appropriate to the service. No online service can promise absolute security, and this notice does not claim a certification that RegliCard has not obtained.
Pilot loyalty programs are for adults. Shops must not enroll children during the pilot. Optional birth month and day are used only for the shop’s birthday recognition, not age verification or marketing.
Contact and changes
Contact the RegliCard privacy lead at support@reglicard.com.
We aim to give a first response within two business days, Monday to Friday in Toronto. This is an acknowledgement or next step, not a promise to complete every privacy request within that time. We update this notice’s date when it changes and provide further notice when required.