Privacy
Policy

1. Who we are and what this policy covers

Loyaly.AI ("Loyaly", "we", "us", "our") operates a loyalty and rewards platform that connects shoppers with offline stores. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and the choices and rights you have.

This policy applies to:

• the Loyaly consumer mobile app for iOS and Android, where you earn and redeem LYTs;
• the Loyaly Merchant App and Merchant Dashboard used by partner stores;
• the loyaly.ai website, including enquiry and contact forms;
• our in-store analytics products — Behavision AI, SpendSense AI and Dyscount AI — as deployed at partner stores and malls.

If you use Loyaly at a partner store, that merchant may also process your data under its own privacy policy. We are not responsible for a merchant’s independent use of your data, and we encourage you to read their policy as well.

2. Information we collect

Information you give us

• Account details: your mobile number, name, email address, date of birth (optional), gender (optional), and profile photo if you add one.
• Merchant details: for store owners, your business name, address, GSTIN or registration details, product catalogue, campaign settings, and payout information.
• Communications: messages you send through our contact form, support requests, survey responses, and feedback.

Information we collect automatically when you use Loyaly

• Reward activity: LYTs earned and spent, games played (Maze, Spin Wheel, Scratch Card, Match Master), coupons issued and redeemed, streaks, and challenge completions.
• Device and technical data: device model, operating system version, app version, language, time zone, crash logs, IP address, and a device identifier used to prevent duplicate or fraudulent reward claims.
• Usage data: screens viewed, features used, session length, and referral source.
• Battery level: the Battery Challenge reads your device battery percentage at the moment you open the app, solely to decide which surprise coupon to show you. We do not build a profile from it.

Information collected with your permission

• Location: approximate or precise location, used to show nearby participating stores and to confirm a store visit at redemption. You can decline or withdraw this permission in your device settings; store discovery will then rely on a location you enter manually.
• Step and activity data: step counts read from your phone’s motion sensor or from Apple Health / Google Fit, used only to verify walking challenges such as the 5,000-step challenge and to award LYTs. We do not use this data for advertising and we do not share it with merchants at an individual level.
• Camera and photos: images you capture at a Selfie Booth or upload to your profile. Selfie Booth images are processed to deliver the reward and any sharing option you choose.
• Notifications: push notifications about rewards, coupons, and campaigns, which you can turn off at any time.

In-store sensors and footfall analytics

• Behavision AI measures visitor counts, dwell time, and movement patterns inside partner premises. It is configured to produce aggregated and statistical counts, not to identify individual shoppers, and we do not use it to build facial recognition profiles.
• Where a partner store deploys cameras or sensors, signage at the premises should inform you. If a merchant configures these tools in a way that identifies individuals, that merchant is responsible for obtaining your consent.

3. How we use your information

We use personal data to:

• create and secure your account, and authenticate you by mobile number;
• calculate, award, and redeem LYTs, coupons, and game-based discounts (1 LYT = ₹1 in redeemable value);
• show you nearby participating stores and relevant offers;
• run and settle merchant campaigns, and give merchants aggregated performance analytics;
• detect and prevent fraud, duplicate accounts, bot play, and abuse of reward mechanics;
• provide customer support and respond to your enquiries;
• improve our products, including debugging, measuring feature performance, and research using aggregated or de-identified data;
• send service messages (for example, reward confirmations or policy updates) and, with your consent, marketing messages;
• comply with law, enforce our terms, and establish or defend legal claims.

We do not sell your personal data. We do not share your personal data with third parties for their own independent advertising.

4. Consent and legal basis

Where Indian law applies, we process personal data under the Digital Personal Data Protection Act, 2023 and applicable rules, primarily on the basis of your consent and for the legitimate uses that Act permits — for example, providing a service you have asked for, or complying with a legal obligation.

You may withdraw your consent at any time, either in the app or by writing to us. Withdrawing consent does not affect processing already carried out, and some features (such as location-based store discovery or step challenges) will stop working without the relevant permission.

5. When we share information

We share personal data only in the following situations:

• Partner merchants: when you redeem LYTs or a coupon in store, the merchant receives the information needed to honour the redemption — typically the coupon or redemption code, its value, and the fact of the visit. Merchants receive campaign analytics in aggregate, not your individual step data, battery readings, or location history.
• Service providers: cloud hosting, database, analytics, crash reporting, SMS/OTP, email, and payment or settlement providers who process data on our instructions under contract.
• Professional advisers: auditors, lawyers, and insurers, where reasonably necessary.
• Corporate transactions: if Loyaly is involved in a merger, acquisition, financing, or sale of assets, data may transfer as part of that transaction, subject to this policy.
• Legal and safety: where required by law, court order, or a lawful request from a public authority, or where necessary to protect the rights, property, or safety of Loyaly, our users, or the public.

6. Cookies and similar technologies

Our website uses cookies and similar technologies for essential functionality, such as routing your request, keeping a page session consistent, and protecting our enquiry forms. We do not run third-party advertising or cross-site tracking cookies on loyaly.ai.

You can block or delete cookies in your browser settings. Essential cookies cannot be turned off without affecting how the site works. Our mobile apps use device-level identifiers and on-device storage for the equivalent purposes.

Our Cookie Policy sets out each category in full, including how long cookies last and how to clear them.

7. How long we keep data

We keep personal data only as long as needed for the purpose it was collected for, or as long as the law requires.

• Account and reward balance data: for as long as your account is active, and for a reasonable period afterwards to settle disputes and meet accounting obligations.
• Transaction and redemption records: for the period required under applicable tax and accounting law.
• Step and battery readings: retained only as long as needed to verify and award the relevant reward, then deleted or aggregated.
• Selfie Booth images: retained for the campaign period and deleted afterwards, unless you have asked us to keep or share them.
• Support correspondence: typically up to 24 months from the last message.

When you delete your account, we delete or irreversibly anonymise your personal data, except where we must retain records by law or to resolve an open dispute. Unredeemed LYTs are forfeited on deletion and cannot be restored.

8. How we protect your data

We use industry-standard safeguards including encryption of data in transit, access controls and role-based permissions, secured cloud infrastructure, logging, and regular review of our systems. Access to personal data inside Loyaly is limited to staff who need it for their role.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as required by law. Please keep your device and account credentials secure and tell us immediately if you suspect unauthorised access.

9. Your rights and choices

Subject to applicable law, you have the right to:

• access a summary of the personal data we process about you and the parties it has been shared with;
• correct or complete inaccurate or outdated data;
• erase personal data that is no longer needed for the purpose it was collected for;
• withdraw consent for any processing based on consent, including location, step data, camera access, and marketing;
• nominate another individual to exercise these rights on your behalf in the event of death or incapacity;
• raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied with our response.

To exercise any of these rights, write to loyalydigital@gmail.com from the email address or mobile number registered with your account. We respond to verified requests within the timelines set by applicable law, and ordinarily within 30 days.

You can also manage most choices directly: permissions in your device settings, notifications in the app, and marketing preferences through the unsubscribe link in any marketing email.

10. Children

Loyaly is intended for users aged 18 and above and is not directed at children. We do not knowingly collect personal data from a child without verifiable consent from a parent or lawful guardian, and we do not carry out behavioural tracking or targeted advertising directed at children.

If you believe a child has provided us personal data, contact loyalydigital@gmail.com and we will delete it.

11. Third-party links and services

Our app and website link to third-party services — app stores, partner merchant sites, social media, and payment providers. Those services are controlled by others and have their own privacy policies. We are not responsible for their practices, and this policy does not cover them.

12. Storage and international transfers

We primarily store and process personal data in India. Some of our service providers may process data on servers located outside India. Where that happens, we transfer data only to jurisdictions permitted under applicable Indian law and require contractual safeguards that hold the recipient to protections comparable to those in this policy.

13. Changes to this policy

We may update this policy as our products and the law evolve. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you in the app or by email. Continuing to use Loyaly after an update means you accept the revised policy.

14. Contact and grievance redressal

For any question about this policy, or to exercise your rights, contact our Grievance Officer:

• Email: loyalydigital@gmail.com
• Loyaly.AI, Hyderabad, Telangana, India
• Response time: acknowledgement within one business day, and resolution within the period set by applicable law.

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.