LOYAI Privacy Policy

We collect and process personal data that you provide to us voluntarily, personal data generated by your use of the Service, and personal data received from third parties in connection with the Service. This may include, without limitation: identification and contact information such as name, email address, company name, job title, and telephone number; account and authentication credentials, including data received from third-party authentication providers such as Google where you choose to use such services; payment and billing information, which is processed by our third-party payment processor and not stored directly on our systems; technical and usage data including IP address, device identifiers, browser information, and behavioural data relating to your use of the Service; and any other personal data you choose to provide to us. We may collect additional categories of personal data as the Service develops, in which case this policy will be updated. We do not intentionally collect special category personal data as defined in GDPR Article 9.

Google sign-in is an optional way to create or access your LOYAI account. Through Google and Firebase Authentication, we receive your Google account identifier, email address and verification status, name, and profile picture URL when available. We request basic sign-in permissions (openid, email, and profile). We do not request access to Gmail messages, Google Drive files, contacts, calendars, or your Google password. Signing in does not give us access to the contents of your personal Google Wallet.

We use these details to authenticate you, create and display your account profile, associate you with your business workspace and access permissions, and provide account support and service communications. Firebase Authentication stores your authentication record. Account and workspace records are stored in our Google Firebase services. Firebase maintains authentication state in your browser storage so you can remain signed in. We protect access using authenticated requests, workspace permissions, and access rules.

Google and Firebase process sign-in information to provide authentication and hosting. Relevant account details may also be processed by the service providers in Section 4 where needed for billing, service emails, or support. We do not sell Google user data, share it with advertisers, use it for personalised advertising, or use Google sign-in profile data to train AI models. Any disclosure for legal or security reasons is limited to the circumstances described in Section 4.

We keep the account information while it is needed to provide your account and service. You can request account deletion and deletion of associated Google profile data by emailing info@loyaistudio.com. Records we must retain for legal, accounting, or security purposes remain subject to Section 6. You can also remove LOYAI's connection in your Google Account connections. Removing that connection stops future Google sign-in access; it does not by itself delete your LOYAI account or previously stored records. Sign out to end the session on your device.

LOYAI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements where applicable.

We process personal data for purposes including: providing, operating, maintaining, and improving the Service; managing accounts and processing transactions; communicating with you in connection with the Service, your account, and our commercial relationship; marketing our products and services to existing and prospective customers; conducting business development, sales, and customer relationship activities; analysing usage patterns to improve and develop the Service; detecting and preventing fraud, abuse, and security threats; enforcing our terms and agreements; and complying with applicable legal and regulatory obligations.

We rely on the following legal bases under GDPR Article 6, as applicable to each activity: (a) performance of a contract or steps taken at your request prior to entering a contract; (b) our legitimate interests in operating and developing our business, which we have assessed as not being overridden by the interests or fundamental rights of data subjects; (c) compliance with a legal obligation; and (d) your consent, where we have obtained it. Where we rely on legitimate interests, those interests include operating a commercial SaaS business, marketing to and communicating with current and prospective business customers, improving our services, and protecting our legal and business interests. We do not use personal data for automated decision-making that produces legal or similarly significant effects on individuals.

We may send marketing communications to existing customers and to business contacts where we have a legitimate interest in doing so, and to individuals who have opted in to receive such communications. You may opt out of marketing communications at any time by using the unsubscribe mechanism in the relevant communication or by contacting us at info@loyaistudio.com. Opting out of marketing does not affect service-related or transactional communications. We do not sell personal data to third parties for their marketing purposes.

We do not sell personal data. We may share personal data with third-party service providers engaged to support the operation of the Service and our business, including providers of infrastructure, payment processing, communications, analytics, error tracking, and sales and customer relationship management services. Such providers are permitted to process personal data only to the extent necessary to provide their services to us and are subject to appropriate contractual obligations. Our current sub-processors include Google LLC (Firebase, Cloud Functions, Cloud Storage, Google Wallet API, Google Generative AI), Vercel, Inc. (hosting and cookieless analytics), Stripe, Inc. (payment processing), Loops Right, Inc. (transactional email), Apple Inc. (Apple Wallet delivery and push), and Functional Software, Inc. (Sentry — error tracking, servers in Germany; sends only stack traces and request metadata, never identifiers or payloads). The authoritative list is maintained in Annex 2 of our Terms of Service. We may also disclose personal data where required or permitted by applicable law, including in response to lawful requests from public authorities; in connection with any actual or proposed merger, acquisition, restructuring, or sale of assets; and to enforce or protect our legal rights and interests.

Personal data may be transferred to and processed in countries outside the European Economic Area, including countries that may not provide the same level of data protection as the EEA. Where such transfers occur, we take steps to ensure that appropriate safeguards are in place in accordance with applicable data protection law, including where relevant the use of Standard Contractual Clauses approved by the European Commission. Further information about the safeguards applicable to specific transfers is available on request from info@loyaistudio.com.

We retain personal data for as long as is reasonably necessary for the purposes for which it was collected, taking into account applicable legal, regulatory, accounting, and business requirements. Financial and billing records are subject to statutory minimum retention periods under Finnish law. Personal data that is no longer required for any lawful purpose will be deleted or anonymised. Anonymised data may be retained and used indefinitely.

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. The appropriate level of security is determined by reference to the risks presented by the processing and the nature of the data concerned. No transmission of data over the internet can be guaranteed as completely secure; we cannot guarantee the security of data you transmit to us.

We use cookies and similar tracking technologies on the Service. Further information about the cookies we use, their purposes, and how to manage your preferences is set out in our Cookie Policy available at loyaistudio.com.

Subject to applicable law and certain conditions, you may have the right to: request access to personal data we hold about you; request correction of inaccurate data; request erasure of personal data in certain circumstances; object to or request restriction of certain processing; request data portability where processing is based on consent or contract and carried out by automated means; and withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing. Requests should be directed to info@loyaistudio.com. We will respond within the timeframe required by applicable law. We reserve the right to verify your identity before processing any request and to refuse requests that are manifestly unfounded, excessive, or otherwise permissible to refuse under applicable law.

If you consider that our processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), the supervisory authority competent for LoyAI Oy: tietosuoja.fi.

The Service may contain links to or integrations with third-party websites and services. LOYAI is not responsible for the privacy practices of any third party. This policy applies solely to personal data processed by LOYAI in connection with the Service.

LOYAI's business customers may issue digital loyalty cards to their own customers ("pass holders") via Apple Wallet (PassKit) and Google Wallet (Loyalty Cards). We process loyalty member and pass identifiers, the issuing business and location, stamp balances, reward and redemption records, enrolment and scan timestamps, and wallet installation or removal events where provided. Depending on the enrolment form, we also process the customer's name, email address, and marketing consent choices. For Apple Wallet updates, we process pass registration identifiers and device push tokens. These records let us issue and update cards, record visits, redeem rewards, deliver permitted messages, and report programme activity to the issuing business.

We store loyalty records in Google Firebase services and send the pass content and identifiers needed to Apple or Google to deliver and update the card. Google Wallet cards are issued through our business integration; we do not request access to a merchant's personal Google Wallet through Google sign-in. Location reminders use business coordinates configured on the pass; we do not receive a live location feed from the pass holder's device.

LOYAI processes pass-holder data on behalf of the merchant in our role as a data processor; the merchant (LOYAI's business customer) is the data controller for that data. Apple and Google process pass-holder data as separate controllers in connection with their respective Wallet services, governed by the Apple Wallet privacy disclosure and the Google Privacy Policy. LOYAI does not use pass-holder data for advertising, profiling, or any purpose other than operating the merchant's loyalty programme as instructed.

Pass holders who wish to remove their pass may delete it from the Apple Wallet or Google Wallet app on their device at any time. Pass holders who wish to delete the underlying loyalty record entirely should contact the merchant that issued the pass, or contact LOYAI at info@loyaistudio.com for assistance.

LOYAI Scan is the staff companion application for LOYAI's business customers, available on the Apple App Store and Google Play. The app uses the device camera solely to decode the QR codes printed on customer loyalty passes presented at the point of service. Camera frames are processed on-device by the operating system's native vision framework; LOYAI does not store, transmit, or retain camera images, photos, or video. The app does not access the device's photo library, microphone, location, contacts, calendar, or any other sensor or data source.

Staff users authenticate with a workspace-scoped staff code and password issued by their employer (LOYAI's business customer). The app processes the resulting authentication identifier, the workspace and location to which the staff member is assigned, the timestamp and outcome of each scan, and aggregate usage counters for operational and crash-diagnostics purposes. Personal data of the underlying loyalty pass holders is processed on behalf of the merchant in our role as a data processor under Section 11. Staff users may request removal of their account by contacting their workspace administrator or by emailing info@loyaistudio.com. Crash and performance diagnostics for the app are processed by Sentry as described in Section 4.

We reserve the right to modify this Privacy Policy at any time. Where changes are material, we will take reasonable steps to bring them to your attention before they take effect. Your continued use of the Service following any update constitutes your acceptance of the revised policy. The current version of this policy is always available at loyaistudio.com. This policy was last updated on 10 September 2026.