Privacy Policy

1. Who this policy covers

This policy covers Loial’s website and services at loial.ca. “Loial,” “we,” and “us” mean the operator of those services. The businesses that use Loial are “merchants.” People who join a merchant’s loyalty program are “customers.”

For customer information a merchant puts into Loial, the merchant generally decides why the information is collected and how the loyalty program operates. Loial processes that information to provide the merchant’s program. The merchant’s own privacy notice may also apply. Loial remains responsible for the information it controls for its own accounts, support, security, and operations.

2. Information we handle

• Merchant and staff information: email address, account and authentication information, business name and category, location and time zone, currency, branding, staff roles, support messages, and account activity.
• Customer loyalty information: phone number, optional first name, enrollment source and date, marketing-consent status and time, loyalty card and wallet identifiers, stamps or points, purchases or qualifying activity, rewards, redemptions, and campaign delivery status. The phone number is used as the identity key within that merchant’s program; Loial does not create a cross-merchant customer profile in the current product.
• Wallet and device information: information needed to issue and update an Apple Wallet or Google Wallet pass, including pass identifiers and, for Apple’s update service, device registration and push-token information.
• Billing information: Stripe customer and subscription identifiers and limited payment-method information such as card brand and last four digits. Loial does not store complete payment-card numbers.
• Technical information: browser or device details, IP address, cookie values, authentication events, and service or security logs where generated by Loial or its providers.

3. Why we use it

• to create and secure merchant accounts and provide customer enrollment;
• to run loyalty rules, record activity, calculate balances, issue rewards, and update wallet passes;
• to send a merchant’s wallet campaigns only to customers who opted in to marketing;
• to provide analytics, support, billing, service notices, and troubleshooting;
• to protect the service, investigate misuse, prevent fraud, and maintain records; and
• to comply with law and respond to valid legal process.

We do not sell personal information. Loial’s current product does not send customer email or SMS campaigns; merchant campaigns are delivered through wallet-pass features.

4. Consent and marketing choices

A phone number is required to create or find a customer’s card. A first name is optional. The marketing checkbox on enrollment is optional and unticked by default. If a customer opts in, the merchant may send occasional offers or news through the wallet pass; joining the program does not depend on that choice.

A customer can ask the merchant operating the program or Loial to withdraw marketing consent. Withdrawal does not by itself delete the loyalty card or activity needed to run the program. Requests can be sent to support@loial.ca.

5. When we share information

We share information only as needed for the purposes above, including with:

• the merchant and authorized staff who operate the relevant loyalty program;
• providers that host Loial, store data, authenticate accounts, send account email, or provide security and support infrastructure;
• Stripe for subscription billing and payment-method collection;
• Apple and Google when needed to issue or update a wallet pass;
• professional advisers, authorities, or other parties where required by law or needed to protect people, rights, or the service; and
• a successor or buyer if Loial is involved in a merger, financing, reorganization, or sale, subject to applicable law.

These providers may process information outside Canada or outside Quebec. Where required, Loial uses appropriate contractual, organizational, and technical measures and can provide more information about cross-border handling through the contact below.

6. Cookies and similar technology

Loial uses cookies or similar storage that are needed for login sessions, security, and remembering a language preference. The current website does not intentionally use advertising cookies or third-party behavioural tracking. Providers may create their own strictly operational logs or identifiers when delivering their services.

7. Retention and security

We keep information only for as long as it is reasonably needed for the purposes in this policy, including while a merchant account or loyalty program is active. After closure, we may retain billing, consent, audit, security, dispute, and other records for the period required by law or reasonably needed for legitimate business purposes. Wallet device records are kept while needed to issue, update, or revoke a pass. Backups may persist for a limited period before they are overwritten.

We use safeguards appropriate to the sensitivity of the information, including access controls and security practices for our application and providers. No internet service can guarantee absolute security. If a breach creates obligations to notify people or a regulator, Loial will take the steps required by applicable law.

8. Access, correction, and complaints

You may ask what personal information we hold about you, request a correction, ask about its use or disclosure, withdraw consent where applicable, or request deletion where the law permits. Send a written request to our Privacy Officer at support@loial.ca. We may need to verify your identity and may refer a request about a merchant’s program to that merchant. We will respond within the time required by applicable law.

If we cannot resolve a privacy concern, you may have the right to complain to the privacy regulator in your province or territory, or to the Office of the Privacy Commissioner of Canada where federal law applies.

9. Children and changes

Loial is intended for businesses and their customers, not children. We do not knowingly collect a child’s personal information without any consent required by law. If you believe a child’s information was provided improperly, contact the Privacy Officer.

We may update this policy as the service or legal requirements change. The revised policy will be posted at loial.ca with a new “Last updated” date. Material changes will be communicated where required.

10. Contact the Privacy Officer

Privacy Officer, Loial
support@loial.ca
General support: support@loial.ca