LoyalKit Cards
Sign inStart free

The details

Privacy Policy

Last updated: October 12, 2026

LoyalKit is a digital loyalty card service operated by Mahmoud El Batish ("LoyalKit," "we," "us", "operator"). We provide digital loyalty cards for businesses of any kind, delivered through Apple Wallet and Google Wallet. This policy explains what information we collect from business owners who use our service and from end customers who join a participating business's loyalty program through LoyalKit.

Information we collect

From shop owners: business name, contact email, password hash, phone number (optional), shop location, and any branding assets (logo, brand color, welcome message) the owner uploads.

From end customers (loyalty program participants): first name, phone number, stamp and points balances, and loyalty activity timestamps at the specific shop the customer joined. We do not collect payment information from end customers.

Technical and security data: IP address and browser user-agent may be processed for security and abuse prevention. Vercel Web Analytics provides aggregated page, referrer, country, browser, operating-system, and device information without using cookies.

Website analytics

We use Google Analytics for Firebase to understand marketing page visits, trial-button clicks, and progress through the account-creation steps. We do not send form answers, names, email addresses, phone numbers, business names, or shop identifiers to analytics.

Google Analytics uses cookies and browser identifiers to measure visits. Advertising storage, advertising personalization, and advertising user data are disabled.

How we use information

  • To operate the loyalty program: issue and update wallet passes, track stamps and points, and deliver rewards.
  • To provide the owner dashboard, including customer lists and aggregated activity metrics.
  • To communicate service updates and respond to support requests.
  • To send payment-due reminders and payment confirmations through WhatsApp when a shop owner has explicitly consented.

We do not sell personal data. We do not share personal data with third parties for advertising.

WhatsApp payment reminders and Whish Pay

When you contact LoyalKit support on WhatsApp, we process your name, phone number or Meta business-scoped identifier, message text, attachments, delivery and read status, and voice-call metadata such as time, duration, and outcome. Only authorized LoyalKit superadmins can access this shared support inbox. Support messages, attachments, and call metadata are retained until a superadmin deletes the conversation or linked support data is removed with the shop. Financial records remain separate. Minimal hashed deduplication and opt-out markers remain to prevent deleted history from reappearing and respect your contact preferences.

WhatsApp support uses Meta and private Google Firebase storage. Incoming voice calls use encrypted VoIP connections and may pass through Cloudflare TURN relays, which process network connection information and relay encrypted media. We do not record or transcribe calls. Apple and Google process device notification tokens for message and call alerts. Reply STOP or UNSUBSCRIBE, or ask support not to contact you, to opt out of WhatsApp sends. Sending a new support message does not restore billing consent.

For shops assigned to Whish Pay billing, we use the owner's approved WhatsApp number to send payment reminders and confirmations. Consent is recorded when the shop is enrolled. The owner can reply STOP or UNSUBSCRIBE to stop future WhatsApp payment messages without disabling the shop's payment option.

When an owner chooses to pay, LoyalKit shares the minimum transaction details needed by Whish Pay, such as the amount, currency, invoice description, and a transaction reference. Whish processes the payment under its own privacy terms. LoyalKit does not place Whish credentials, owner contact details, or editable prices in the public payment link.

Wallet passes

When a customer adds a LoyalKit loyalty card to Apple Wallet or Google Wallet, the pass payload (shop name, brand color, customer first name, loyalty balance or progress, reward information, and a QR code used by the shop for identification) is delivered to Apple or Google so the pass can be displayed on the customer's device. This is the standard Apple Wallet and Google Wallet pass flow. No payment information is included in passes. Apple and Google may collect additional device-level information under their own privacy policies.

Data retention

Customer records are retained while the loyalty card is active. Customers may request deletion at any time by emailing hello@loyalkitcards.com. Shop owners may also delete customer records from their dashboard. Deleted records are purged from active systems immediately and from encrypted backups within 30 days.

Google Analytics event-level data is configured for a maximum retention period of 14 months. Aggregated reports may be retained for longer without containing account form values or customer contact details.

Security

  • All data is transmitted over HTTPS.
  • Data at rest is stored in encrypted databases hosted on Google Firebase.
  • Access to customer data is scoped per shop; owners and their staff can only see data for shops they administer.

Your rights

Customers and shop owners may request access to, correction of, or deletion of their personal data by contacting us at the address below. We will respond within 30 days.

Children

LoyalKit is not directed at children under 13, and we do not knowingly collect personal data from children under 13.

Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with a new "Last updated" date.

Contact

Questions about this policy? You can reach Mahmoud El Batish at hello@loyalkitcards.com