Privacy Policy

1. Introduction

Welcome to Royalty ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you use our loyalty program platform.

2. Information We Collect

We collect information in the following ways:

2.1 Information You Provide

• Account Information: Name, email address, password when you create an account
• Business Information: Business name, industry, location when setting up your loyalty program
• Customer Data: Information about your customers that you upload or collect through our platform (names, emails, phone numbers, points balances)
• Payment Information: Billing details processed securely through Stripe

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on platform
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, referring URLs

3. How We Use Your Information

We use your information to:

• Provide and maintain our loyalty program services
• Process transactions and send related information
• Send administrative information (updates, security alerts)
• Respond to your comments, questions, and support requests
• Analyze usage to improve our services
• Generate AI-powered recommendations for your loyalty program
• Prevent fraud and ensure platform security

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

• Service Providers: Supabase (database hosting), Stripe (payments), Cloudflare (security), Anthropic (AI features), PostHog (product analytics — see section 10)
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy. When you delete your account, we delete or anonymize your data within 30 days, except where we are required to retain it for legal purposes.

6. Your Rights (GDPR/CCPA)

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a portable format
• Objection: Object to certain processing of your data
• Restriction: Request restriction of processing

To exercise these rights, visit Settings > Delete Account or contact us at privacy@royaltyapp.ai

7. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS) and at rest
• Row Level Security (RLS) on all database tables
• Regular security audits and penetration testing
• Rate limiting to prevent abuse
• Access controls and authentication

8. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

9. Children's Privacy

Our services are not directed to individuals under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

10. Cookies and Analytics

We use essential cookies to maintain your session and preferences. We use Cloudflare Turnstile for security verification. We do not use third-party advertising cookies, and we do not sell or share your data with advertisers.

For product analytics we use PostHog, a processor acting on our instructions. PostHog processes this data in the United States. Where this involves transferring personal data out of the UK or European Economic Area, that transfer is governed by Standard Contractual Clauses under our data processing agreement with PostHog. How the analytics work depends on which part of the site you are on:

• On our public pages (such as our home page, pricing and blog) analytics run in a cookieless mode. We set no cookies and store nothing on your device for analytics. Visits are counted using a rotating, salted hash derived from your IP address and browser type. Your IP address is used only momentarily to compute that hash and is not retained; the salt is rotated and discarded daily, so the resulting value cannot be used to identify you or to track you across other websites or across days. Because nothing is stored on your device, no cookie consent banner is required. We do not record sessions on these pages.
• Inside your account (pages under /app), analytics use standard storage so that we can understand how our product is used and fix problems. This includes session recordings of your interactions with the Royalty dashboard. All text and all form inputs are masked before leaving your browser — this means the contents of your customer lists, email addresses, phone numbers and messages are never transmitted to or stored by our analytics provider. Recordings capture layout and interaction, not content.

We use this data only to improve Royalty — to see which features are used, where people get stuck, and what is broken. It is never used for advertising.

Opting out. You can exclude your device from all analytics at any time by visiting royaltyapp.ai/?notrack=1. This preference is stored locally on your device and applies until you clear your browser storage. You can re-enable analytics with royaltyapp.ai/?notrack=0. We also honour your browser's Do Not Track and Global Privacy Control signals where they are sent.

11. Third-Party Links

Our platform may contain links to third-party websites. We are not responsible for their privacy practices. Please review their privacy policies before providing personal information.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

13. Business Owners and Customer Data

If you are a business owner using Royalty, you act as the Data Controller for your customers' data. Royalty acts as a Data Processor. You are responsible for:

• Obtaining appropriate consent from your customers
• Having your own privacy policy that covers your use of Royalty
• Responding to data subject requests from your customers
• Ensuring lawful basis for processing customer data