Privacy Policy

1. Who we are

LOYA provides a customer engagement platform that helps businesses manage leads and customers, run loyalty programmes and campaigns, validate receipts and unique codes, communicate with customers, sell online, manage field teams and publish website content. In this policy, a business that uses LOYA is a “Client”, the people who use the LOYA dashboard on a Client’s behalf are “Users”, and the Client’s customers, members, leads and campaign participants are “End Users”.

2. Our role for different data

• Website visitors and Users: we decide how this data is used, so we act as the data controller.
• End User data and Client staff data (for example loyalty members, leads, campaign participants and field staff records): the Client decides why and how this data is processed and is the controller. LOYA processes it on the Client’s instructions. If you are an End User, the Client’s own privacy notice also applies, and the Client is your first point of contact for requests about your data.

3. Information we collect

Website visitors

• Details you send through our contact form: name, email address, phone number, subject and message.
• Technical data such as IP address, browser type and pages visited, plus the results of bot protection checks (Google reCAPTCHA, Cloudflare).

Users and Clients

• Account details: name, email address, phone number, password (stored only as a secure hash) and profile picture.
• Company details: company and legal name, registered and mailing address, phone, email, website, projects and the company join code.
• Account activity: email verification status, sign-in times, assigned roles and permissions, blocked status and an activity log of actions taken in the dashboard.
• Security data: IP address, user agent and CAPTCHA results used to protect sign-in and sign-up.
• Plan and usage information, such as the subscription plan and how much of each feature is used.

End Users (processed on behalf of Clients)

Depending on the features a Client uses, this can include:

• Identity and contact data: name, email address, phone and WhatsApp number, date of birth, gender, marital status, postal addresses and profile picture.
• Loyalty and campaign data: member ID, tier, points, transactions, redemptions, vouchers, unique product codes, doorprize participation and results, game scores and campaign consent records.
• Receipts and images: receipt photos and the details read from them (store, date, items, quantities and amounts), and photos of product codes.
• Messages: web chat and WhatsApp conversations with the Client, including attachments.
• Orders and payments: order, billing and delivery details and payment status for purchases made through LOYA.
• Marketing and source data: UTM parameters, the channel a lead came from, products of interest and messages submitted through forms.
• Approximate location: city and region derived from IP address, used for fraud prevention and campaign reporting, and GPS coordinates of point-of-sale orders.
• Survey answers collected by field staff, such as age range, gender and purchase intent.
• Other data a Client chooses to import, for example lists of prospective students or event attendees.

Field staff (processed on behalf of Clients)

• Name, email, phone, position, project and assignment details.
• Check-in and check-out times with GPS location, address and photos, and activity photos and results.
• Payroll data: national identity number (NIK), bank name, account number, account holder name and pay details.

4. How we use information

• To provide, operate and support the LOYA platform and the features each Client turns on.
• To create and secure accounts, verify email addresses, reset passwords and manage roles and permissions.
• To run Client programmes: register members, award and redeem points, validate receipts and codes, run draws, fulfil rewards and process orders.
• To deliver messages a Client or User sends through LOYA, and to send our own service emails.
• To respond to enquiries sent through our website or by email.
• To detect and prevent fraud, abuse, duplicate submissions and security incidents, including rate limiting.
• To produce reports and analytics for Clients, and to measure and improve our services.
• To meet legal, tax and regulatory obligations and to enforce our Terms and Conditions.

5. Legal bases

We process personal data where it is needed to perform a contract with you or your organisation, where you or the relevant Client has obtained consent, where we must comply with a legal obligation, or where we have a legitimate interest, such as keeping the platform secure and preventing fraud. Where processing relies on consent, you may withdraw it at any time; this does not affect processing that took place before.

6. How we share information

We do not sell personal data. We share it only as follows:

• With the Client who runs the programme or workspace the data belongs to, and with that Client’s Users.
• With systems a Client connects, such as a brand’s or partner’s endpoint that receives receipt validation results.
• With service providers that help us run LOYA, listed in the next section.
• For legal reasons: to comply with law, a court order or a request from a competent authority, or to protect the rights, property or safety of LOYA, our Clients or others.
• In a business transfer, such as a merger or acquisition, subject to equivalent protection for your data.

7. Service providers

Depending on the features used, personal data may be processed by:

• Cloud hosting, databases and object storage, including Linode (Akamai).
• Cloudflare, for website delivery, security and bot protection (Turnstile).
• Google, for reCAPTCHA bot protection and maps.
• Mailgun, for sending transactional emails such as verification and password reset emails.
• Damcorp, for WhatsApp Business messaging.
• Midtrans, for processing payments for point-of-sale orders.
• IAK (Mobile Pulsa) and RISE, for delivering mobile credit and e-wallet rewards.
• IP2Location, for deriving approximate location from IP addresses.
• Artificial intelligence and optical character recognition providers, such as OpenAI, for reading receipts and codes. Where a Client supplies its own provider account, that processing takes place under the Client’s account.

These providers may use personal data only to provide their services to us or to the Client.

8. International transfers

Some of our service providers store or process data outside Indonesia, for example in Singapore and the United States. When data leaves Indonesia, we take steps required by applicable law to make sure it remains protected to a comparable standard.

9. How we protect information

• Data is sent over encrypted connections (HTTPS).
• Passwords are stored as one-way hashes, never in readable form.
• Key contact identifiers of End Users, such as email addresses and phone numbers, are held in a separate, access-controlled data vault in encrypted form for the features that support it.
• Chat messages, voucher codes, unique codes and stored third-party credentials (such as API keys) are encrypted.
• Access to Client data is limited by company workspaces, roles and permissions.
• Sign-in, sign-up, password reset and contact forms are protected by CAPTCHA and rate limits.
• Error logs are scrubbed of email addresses, phone numbers and secrets before they are stored.

No method of transmission or storage is completely secure. If we become aware of a breach that affects your personal data, we will notify you and the relevant authorities as required by law.

10. How long we keep information

• Account and company data is kept while the account is active and for a reasonable period afterwards.
• End User data is kept for as long as the Client needs it to run its programmes, or as set out in our agreement with the Client. When that agreement ends, we delete or return the data on the Client’s request, unless the law requires us to keep it.
• Contact form submissions are kept for as long as needed to handle the enquiry and any follow-up.
• Error logs are kept for up to 30 days. Cached copies of data expire automatically, typically within minutes to hours.
• We keep some records for longer when required for legal, tax, accounting or dispute purposes.

11. Your rights

Subject to applicable law, you have the right to:

• be informed about how your personal data is processed;
• access and obtain a copy of your personal data;
• correct inaccurate or incomplete data;
• request deletion of your data, or ask us to stop or restrict processing;
• withdraw consent you have given;
• object to decisions based solely on automated processing that significantly affect you; and
• lodge a complaint with the competent authority.

Users and website visitors can contact us using the details below. End Users should contact the Client that runs the programme; we will help the Client respond. We may need to verify your identity before acting on a request.

12. Cookies and similar technologies

• Essential cookies keep you signed in (jwt) and protect forms against forgery (_csrf).
• Security cookies may be set by Cloudflare and Google reCAPTCHA to detect bots and protect the site.
• Local storage in the dashboard remembers display preferences, such as theme and layout.

We do not use advertising cookies. You can block or delete cookies in your browser, but parts of the platform, including sign-in, will not work without essential cookies.

13. Emails and messages

We send service emails that are needed to run your account, such as email verification, password reset and important notices. Emails, chat and WhatsApp messages that a Client sends to its customers through LOYA are sent on the Client’s behalf. To stop receiving them, contact the Client that sent them. To stop marketing messages from LOYA itself, contact us.

14. Children

LOYA is not directed at children under 18. Clients must not use LOYA to collect data from children without the consent of a parent or guardian where the law requires it. If you believe a child has given us personal data without that consent, please contact us and we will take appropriate action.

15. Changes to this policy

We may update this policy as our services or the law change. We will post the updated version on this page with a new date and, for significant changes, notify Users by email or in the dashboard.

16. Contact us

For questions or requests about this policy or your personal data, contact: