Privacy Policy

• Account data: your name, email and workspace settings.
• Billing data: handled by Stripe; we receive limited details to manage your subscription and never store full card numbers.
• Program data you create: card designs, brand assets, rewards, and the member details and stamp/points activity you add.
• Usage data: log and device information, and consent-gated analytics, used to run and improve the Service.

We use data to provide the Service, create and update your Apple and Google Wallet passes, process payments, send transactional email (such as billing and account notices), keep the platform secure and improve how it works.

To issue and update loyalty cards we share the information needed to generate a pass with Apple and Google. Their handling of Wallet passes on your customers' devices is governed by Apple's and Google's own policies.

Payments are processed by Stripe. We receive only limited billing information (such as the card brand, last digits and billing address) and never full card numbers.

We rely on trusted providers to run the Service: Supabase (database and authentication), Stripe (payments), Resend (email), Vercel (hosting), Cloudflare R2 (image storage) and Apple and Google (Wallet passes). Consent-gated analytics may use Google Analytics, Meta and PostHog.

We use essential cookies to run the Service and, only with your consent, analytics cookies to understand usage. Visitors in the EEA are asked to choose before any non-essential cookies are set.

We keep data while your account is active and for a reasonable period afterwards to meet legal and operational needs. Member data is deleted on request, subject to any retention the law requires.

Depending on your location, you may have the right to access, correct, delete, export or object to the processing of your personal data. To exercise these rights, contact us at the address below. Your members should direct such requests to you as the controller of their data.

Where data is transferred outside your region, we rely on appropriate safeguards, such as the European Commission's standard contractual clauses, to protect it.

We protect data with industry-standard measures, including encryption in transit, encrypted storage of connection tokens, and row-level access controls so each workspace only reaches its own data.

We may update this Policy and will post the new date above. Questions or requests? Email hello@glowreach.app.