Privacy Policy

1. Introduction

Welcome to Royalty ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, disclose, and safeguard your information when you use our loyalty program platform.

2. Information We Collect

We collect information in the following ways:

2.1 Information You Provide

• Account Information: Name, email address, password when you create an account
• Business Information: Business name, industry, location when setting up your loyalty program
• Customer Data: Information about your customers that you upload or collect through our platform (names, emails, phone numbers, points balances)
• Payment Information: Billing details processed securely through Stripe

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on platform
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, referring URLs

3. How We Use Your Information

We use your information to:

• Provide and maintain our loyalty program services
• Process transactions and send related information
• Send administrative information (updates, security alerts)
• Respond to your comments, questions, and support requests
• Analyze usage to improve our services
• Generate AI-powered recommendations for your loyalty program
• Prevent fraud and ensure platform security

4. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

• Service Providers: Supabase (database hosting), Stripe (payments), Cloudflare (security), Anthropic (AI features)
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets

5. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy. When you delete your account, we delete or anonymize your data within 30 days, except where we are required to retain it for legal purposes.

6. Your Rights (GDPR/CCPA)

Depending on your location, you may have the following rights:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a portable format
• Objection: Object to certain processing of your data
• Restriction: Request restriction of processing

To exercise these rights, visit Settings > Delete Account or contact us at privacy@royaltyapp.ai

7. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS) and at rest
• Row Level Security (RLS) on all database tables
• Regular security audits and penetration testing
• Rate limiting to prevent abuse
• Access controls and authentication

8. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers in compliance with applicable data protection laws.

9. Children's Privacy

Our services are not directed to individuals under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

10. Cookies and Tracking

We use essential cookies to maintain your session and preferences. We use Cloudflare Turnstile for security verification. We do not use third-party advertising cookies.

11. Third-Party Links

Our platform may contain links to third-party websites. We are not responsible for their privacy practices. Please review their privacy policies before providing personal information.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

13. Business Owners and Customer Data

If you are a business owner using Royalty, you act as the Data Controller for your customers' data. Royalty acts as a Data Processor. You are responsible for:

• Obtaining appropriate consent from your customers
• Having your own privacy policy that covers your use of Royalty
• Responding to data subject requests from your customers
• Ensuring lawful basis for processing customer data