Privacy Policy

Alexandre Christinat
Chemin de Rovereaz 21b, 1012 Lausanne, Switzerland
Contact: contact@alexc.ch

Your account (if you create one):

• name, email address and password (stored only in encrypted form, never in plain text);
• if you sign in with Google or Microsoft: the identifier of your account with that service, your name, your email address and, where applicable, your profile picture;
• technical information about your sign-in sessions: IP address, browser type, sign-in dates.

Your loyalty cards:

• the shop concerned and the date the card was created;
• each validated visit: date, time and, if the shop has enabled this option, the purchase amount;
• the rewards obtained;
• if you agree to receive the shop's messages: the date, IP address and browser of your consent, kept as proof, the version of the text displayed and, where applicable, the date of its withdrawal, as well as the messages sent to your card;
• if you add the card to Apple Wallet: the device identifier and the notification token provided by Apple Wallet, which are used to update the card.

A card created without an account is not linked to any name or email address: it can only be accessed via a unique link that only you know.

For merchants: information about your shops (name, loyalty rules and, with the Pro option, colours, logo, review link and messages), the addresses of the staff members you invite, the number of rewards handed over, which is used to calculate the invoice, and the status of your Pro subscription. Logos you add are stored by LoyalCody.

• to run the service: create and display your cards, count your visits, unlock your rewards;
• to manage your account and sign-in, including confirmation and password reset emails;
• to keep the service secure and prevent abuse;
• to invoice merchants based on the number of rewards handed over and, for those who have chosen it, the Pro option;
• to display the shop's messages on your card, if you have agreed to this.

LoyalCody never uses your data for advertising and never sells it. The shop where you have a card may send you messages on your Wallet card or on your card's page only if you have agreed to this. It may also enable an automatic message when you have not come back for a certain time, with a free stamp on your card. You can withdraw this consent at any time from your card.

This processing is based on the performance of the service you use, on our legitimate interest in keeping it secure, on your consent for shops' messages and, for sign-in via Google or Microsoft, on your choice to use that sign-in method.

• The shop where you have a card sees your visits, your rewards, the amounts entered during your visits and, if your card is linked to an account, your email address. It can view and export this customer list, and its staff members can scan your card. It does not see your cards at other shops.
• Our hosting provider (Infomaniak Network SA, servers located in Switzerland), which stores the website and the database.
• Resend, which sends our emails (account confirmation, forgotten password). It receives only your email address, your name and the content of the message.
• Cloudflare Turnstile, which checks that the sign-up and forgotten-password forms, as well as the creation of a loyalty card without an account or of an additional card, are completed by a person and not a robot. It receives technical information about your browser and your IP address, without any advertising cookie.
• Stripe, for merchants only, which processes payment of invoices and of the Pro option. It receives the name, email address, invoice amounts and card details, which we neither see nor store.
• Apple, if you add your card to Apple Wallet: card updates go through Apple's notification service (Apple Push Notification service), which receives the device identifier and the notification token.
• Google, if you add your card to Google Wallet: Google receives the information displayed on the card, such as the shop's name, your progress, your rewards and, if you have accepted them, the shop's messages.
• Google Analytics and Google Ads, only if you accept measurement cookies, on the public pages of the website (not on cards or the dashboard). They receive the pages visited, a truncated IP address, technical information about your browser and, where applicable, the fact that a sign-up took place.
• Google or Microsoft, only if you choose to sign in with their service. Their own privacy policy then applies.

Resend, Cloudflare, Stripe, Apple, Google and Microsoft may process data in the United States. These transfers rely on the safeguards provided for by law, such as the Swiss-U.S. Data Privacy Framework or standard contractual clauses.

• your account and your cards are kept for as long as you use the service, then deleted on request;
• a sign-in session expires after 7 days of inactivity;
• your consent to a shop's messages, and any withdrawal of it, are kept with your card so that this consent can be proven;
• data required for invoicing merchants is kept for 10 years, as required by Swiss law (Art. 958f of the Swiss Code of Obligations, CO).

LoyalCody uses a session cookie, which is essential for staying signed in, and remembers your cookie choice in your browser. When you create a card without an account, a cookie links it to this browser: only this browser can then change your consent to the shop's messages.

Only with your consent, we use Google Analytics to measure the audience of public pages and Google Ads to find out which ads lead to sign-ups. These tools set measurement cookies. Without consent, no Google script is loaded. We do not carry out targeted advertising based on this data.

You can change your mind at any time: Manage cookies.

Communications with the website are encrypted (HTTPS), passwords are encrypted before being stored, and only a limited number of people have access to the administration of the service.

At any time, you can:

• find out what data we hold about you and obtain a copy of it;
• have inaccurate data corrected;
• request the deletion of your data (see Data deletion);
• object to processing.

Write to us at contact@alexc.ch. We reply within 30 days. If you believe that your rights are not being respected, you can contact the Federal Data Protection and Information Commissioner (FDPIC).

We may update this policy, for example if the service evolves. The date of the last update is shown at the top of this page.