Privacy policy

LoopinCard (“LoopinCard”, “we”) provides digital loyalty cards that shops (“merchants”) issue to their customers (“cardholders”) in Apple Wallet, Google Wallet or on the web. This policy explains what personal data we handle, why, where it is kept and the rights you have under India's Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Information Technology Act, 2000.

1. Who is responsible for your data

• Shop owners and staff: we decide how your account data is used, so we are the Data Fiduciary.
• Cardholders: the shop whose card you joined decides why your data is collected; it is the Data Fiduciary and we act as its Data Processor, handling your data only to run that shop's card. You can contact either the shop or us.

2. What we collect from cardholders

• Your first name; optionally your mobile number and your birthday (day and month only, no year).
• Your stamps, rewards, offers used and the time of each visit.
• Which poster or link you joined from, and whether a friend invited you.
• A technical identifier for your wallet pass or browser notifications, so updates reach your card.
• Feedback you choose to leave after a visit.

3. What we collect from shop owners and staff

• Shop name, email, password (stored only as a salted scrypt hash), address and map location.
• Card design, logo and photos you upload, offers, messages and settings.
• Staff PINs are stored hashed and used only to open the counter scanner.

4. What is collected automatically

• IP address and request time, used to block abuse (for example limiting login attempts). They are kept only as long as needed for that purpose.
• A few essential cookies to keep you signed in and to remember which cards are on your phone. See the cookie policy. We do not use advertising or analytics cookies.

5. Why we use it

• To issue, update and stamp the loyalty card, and to let staff recognise it at the counter.
• To deliver the shop's messages, reminders, birthday treats and offers to your card, when you have agreed to them.
• To show the shop simple statistics about visits and which posters work.
• To secure the service, prevent fraud (such as stamp farming) and meet legal obligations.

We rely on your consent, given when you join a card or create an account. You can withdraw it at any time (section 10).

6. What we never do

• We never sell or rent personal data, or share it with advertisers.
• We never track your location. The shop's address is stored inside the card; your own phone decides when to show it.
• We never share one shop's customers with another shop.
• We never use your data to train AI models.

7. Wallet cards and notifications

Apple and Google deliver updates and messages to cards in their wallets; browsers deliver web notifications. They receive only what is needed to deliver the update. To stop messages, remove the card from your wallet, turn off its notifications, or block notifications for our site in your browser. Removing the card does not delete your stamps; ask us to delete them.

8. Who we share data with

Only the shop whose card you hold, and the service providers that run LoopinCard, under contracts that limit their use to providing the service. The current list is on our Trust page. We may disclose data if required by Indian law or a valid order of a court or authority.

9. Where data is stored, and for how long

• Our servers and database are in Mumbai, India. Apple and Google may process wallet updates on their global networks.
• Data is kept while the shop uses LoopinCard. We delete it within 90 days of a verified deletion request or account closure.
• Backups are taken nightly on our Mumbai server and kept for 14 days, then permanently deleted.
• We may keep billing records for as long as tax law requires.

10. Your rights

Under the DPDP Act you can:

• get a summary of the personal data we hold about you and who it was shared with;
• correct, complete or update it;
• have it erased, unless the law requires us to keep it;
• withdraw consent, as easily as you gave it;
• nominate someone to exercise these rights if you die or become unable to;
• have your complaint heard by our Grievance Officer, and then by the Data Protection Board of India.

Send your request through our contact form or call +91 85559 67330, using the mobile number or name on the card. We reply within 7 days and act within 30 days.

11. Children

LoopinCard is meant for adults. Shops must not knowingly enrol anyone under 18 without verifiable consent from a parent or guardian. If you believe a child's data was collected, write to us and we will delete it.

12. Security

All traffic uses HTTPS. Card links carry secret tokens, passwords and PINs are hashed, logins and sign-ups are rate-limited, staff access is limited by role, and every release is tested against common attacks. Read more on our Trust page. If a breach affects your data, we will inform you and the Data Protection Board as the DPDP Act requires.

13. Changes to this policy

We will post any change here with a new date, and tell shop owners by email before significant changes take effect.

14. Grievance Officer and contact

Grievance Officer, LoopinCard
Contact: our contact form
Phone: +91 85559 67330
Address: India