DRAFT — NOT APPROVED FOR LIVE CUSTOMER ACCEPTANCE. Draft — not yet approved for live customer acceptance. This document is pending review of the business facts marked [TO CONFIRM] before it can be relied upon.
Privacy Policy
Last updated: 26 October 2026 (draft)
This policy explains how Iseka Loyalty ("we", "us") handles personal data. It covers two groups: business users (owners and staff who manage a loyalty programme) and loyalty customers (people who join a business's stamp-card programme).
1. Who is responsible for your data
The Service is provided by Yeskendir Zharimbet, trading as Iseka Loyalty (a sole trader — Iseka Loyalty is a trading name, not a separate legal entity or registered company). Service address for legal notices: Discovery, 50 Waterline Way, London, SE8 3NB, United Kingdom. The provider is the data controller for business account data. Contact for any privacy question: isekaagency@gmail.com.
- Business accounts: we are the data controller for business users' account and billing data.
- Loyalty customers: the business whose programme you join is the data controller. We act as that business's data processor under our Data Processing Agreement. If you are a loyalty customer, please contact the business first — but you can always reach us too and we will help route your request.
2. What we collect and why
Business users (controller: us)
| Data | Purpose | Lawful basis (UK GDPR) |
|---|---|---|
| Name, email, password (stored only as a hash) | Create and secure your account | Contract |
| Business details, branding, programme settings | Run and display your loyalty programme | Contract |
| Subscription and payment status | Billing (card details are handled by Stripe, never by us) | Contract; legal obligation (tax records) |
| Activity and audit logs (who stamped what, when) | Security, fraud prevention, programme integrity | Legitimate interests |
Loyalty customers (controller: the business; processor: us)
| Data | Purpose | Lawful basis |
|---|---|---|
| Card code, stamp count, rewards earned | Run the loyalty card | Contract with the business (legitimate interests of the business) |
| Optional name, email, phone and sign-up answers | Let the business recognise and serve you | Provided voluntarily; the business is responsible for its lawful basis |
| Marketing opt-in (only if you tick the box) | Occasional offers from the business | Consent — never assumed, always optional, withdrawable at any time |
We do not ask for or want sensitive personal data (such as health, ethnicity or beliefs), and businesses must not collect it through the sign-up form. Apple Wallet passes contain no contact details — only the card's stamp state and a scan code.
Business sign-up forms: each business can customise the questions on its own sign-up form. The questions are chosen by that business, which is responsible for explaining why it needs them and for its own lawful basis. Your answers are visible to that business and are stored with your membership; they are never shown to other businesses or placed on your Apple Wallet pass.
3. Who we share data with
We use the following service providers (subprocessors) to run the Service:
| Provider | What they do | Location / transfers |
|---|---|---|
| Lovable Cloud (database, authentication and hosting, built on Supabase) | Stores business accounts, loyalty memberships, stamps and rewards; hosts the application. | [TO CONFIRM — data region not yet verified] |
| Stripe | Processes the business's monthly subscription payment. Card details go directly to Stripe; we never see or store them. | [TO CONFIRM — Stripe processes in the US and EU under its own terms] |
| Apple (Apple Wallet / Apple Push Notification service) | Delivers loyalty passes to Apple Wallet and pushes pass updates. Passes contain no contact details — only the card's stamp state and a scan code. | [TO CONFIRM] |
| Google (sign-in with Google, optional) | Authenticates business owners who choose Google sign-in. | [TO CONFIRM] |
Where a provider processes data outside the UK, transfers must be covered by an adequacy regulation, UK standard contractual clauses (IDTA or the UK addendum) or another lawful safeguard. [TO CONFIRM — transfer mechanism per provider once regions are verified] We never sell personal data.
4. How long we keep data, and how to export or delete it
- Business account data: kept while the account is active. When a subscription ends, you can ask us to export or delete your data. The proposed policy is deletion or anonymisation within 12 months of the subscription ending, unless you ask sooner or the law requires longer retention. [TO CONFIRM — account and customer-data deletion process and timetable have not been operationally verified]
- Loyalty customer data: kept while the membership is active. Businesses can anonymise a member at any time, which removes identifying details while keeping anonymous stamp statistics; customers can ask the business — or us — for deletion.
- Billing records: kept for the period required by UK tax law (normally 6 years).
- Audit and security logs: the proposed policy is retention for up to 12 months to protect the Service, followed by deletion. [TO CONFIRM — log deletion process and timetable have not been operationally verified]
5. Your rights
Under UK GDPR you have the right to access your data, have it corrected or erased, restrict or object to processing, data portability, and to withdraw consent at any time (for example for marketing). To exercise any right, email isekaagency@gmail.com — loyalty customers can also ask the business directly. You can complain to the Information Commissioner's Office (ICO) at ico.org.uk; we would appreciate the chance to resolve things first.
6. Cookies and storage
The Service uses no advertising or tracking cookies. We use essential browser storage only: to keep you signed in and to remember preferences such as which business you last viewed. Your loyalty card link is stored in your own browser.
7. Security
Access to loyalty data is enforced in the database (row-level security with server-side, audited operations); card links use unguessable secrets; payment card details never touch our systems. No method of transmission or storage is perfectly secure, but we design for least-access by default.
8. Changes
We will update this policy as the Service evolves and will note the date above. Material changes will be flagged to business users by email or in the dashboard.
Questions about this document? Email isekaagency@gmail.com.