Privacy Policy
Effective date: 3 October 2026 Last updated: 19 October 2026
This policy explains what personal data Fideliya collects, why, who receives it, how long we keep it, and what you can do about it. It describes how the service works today. Where something depends on a setting at one of our providers, we say so.
1. Who we are and our two roles
Fideliya ("we", "us") runs the loyalty pass service at https://www.fideliyapass.com. Our principal place of business is in Spain. You can reach us about anything in this policy at contact@fideliyapass.com.
We handle personal data in two different roles.
We are the controller for the people who use Fideliya directly:
- Business owners who create an account.
- Team members a business owner invites to help run the account, for example to scan passes at the counter.
- Website visitors, including anyone who signs up.
As controller, we decide why and how this data is used, and this policy is our full notice to you.
We are a processor for end customers: the people who join a business's loyalty program, hold its pass, or receive one of its gift cards. Each business is the controller of its own customers' data. We store and process that data on the business's behalf and on its instructions, so that it can run its program.
If you are an end customer and want your data corrected or deleted, the quickest route is to ask the business you joined. Each business can delete a customer from its dashboard (see section 9). You can also write to us at contact@fideliyapass.com. We will pass your request to the business and help it respond.
2. What we collect
2.1 Business owners
| Data | Where it comes from | Why |
|---|---|---|
| Name and email address | You, when you sign up | To create and run your account |
| Sign-in details (a password, or the Google account you sign in with) | You, held by our sign-in provider Clerk | To let you sign in. We never see or store your password. |
| Business details: business name and type, logo and images you upload, the name, address and map position of each branch, your language and time zone, your answers during setup | You | To build your passes and your dashboard |
| Your passes, rewards, messages you send to customers, and settings | You | To run your loyalty program |
| Subscription status and the reference numbers our payment provider gives us | Stripe | To manage your plan. Stripe collects and holds your payment details. We do not see or store card numbers. |
| How you reached us: the website that referred you, campaign tags and advertising click identifiers in the link you followed, the first page you landed on, up to eight pages you viewed before signing up, your browser language and whether you used a mobile device | Your browser, when you sign up | To understand which channels bring us customers. We record this whether or not you accepted analytics cookies. |
| Your approximate location at sign-up: country, region, city, postal code, time zone and approximate coordinates | Estimated from your IP address by our hosting provider | The same reason. We record this whether or not you accepted analytics cookies. |
| A security log of actions in your account, with the IP address and browser details of the person who made each change | Our servers | To keep your account secure and investigate problems |
| Messages you send us, for example through our contact form (name, email and message) | You | To answer you |
2.2 Team members
When a business owner invites you, we receive your email address and the role the owner chose. When you accept, we also hold your name and, if the owner limits you to certain branches, which ones. Your sign-in details are held by Clerk. When you scan a pass or make a change, we record the action, your IP address and your browser details in the account's security log. When you add a stamp, give a reward, claim a points reward or take a gift card payment in the scanner, we also keep a scan receipt: who scanned, a random identifier the scanner made for that browser, and the card's counters before and after. It lets the same person undo that scan from the same device in its first seconds, and shows the business what was undone.
2.3 End customers
We process this data on behalf of the business you joined.
| Data | Where it comes from |
|---|---|
| Name and email address, and phone number if you give it, stored in international format | You, when you join. Before accepting an email address, we check that its domain can receive mail; the check keeps nothing about you. For 15 minutes after joining, you can correct your email address on the phone you joined from. If an email to you bounces, the business's staff can enter a new address you give them, without seeing the old or the new one. |
| Your pass: when you joined, your stamps or points, rewards earned and used, the date of each visit, and the status of your pass | The business's staff, when they scan your pass |
| A receipt for each stamp, reward or gift card payment made in the scanner: your card's counters before and after, and whether the scan was undone | The scanner, so that the staff member who scanned can undo a mistake in the first seconds |
| Which branch you joined at, and which branch a visit or gift card payment was recorded at | The QR code you scanned, and the branch the staff chose. We do not receive your own location. |
| Referrals: who referred whom. When you share your referral link, the friend who opens it sees your first name. | You and the friend you refer |
| Notes the business's staff write about you | The business. These notes are never shown to you or sent anywhere. |
| Whether your pass is in Apple Wallet or Google Wallet. For Apple Wallet, the device and push identifiers Apple provides so the pass can update, and the iOS version of the device. | Your phone, when you add the pass |
| A record of the emails and wallet notifications sent to you, and whether you unsubscribed from email | Our servers |
| When someone asks to have a pass sent again to an email address that already has one, the request's IP address and browser details | Our servers, to detect abuse |
| When an email address is corrected, the old and the new address | Our servers, in the security log |
| Whether an email to your address bounced for good or was marked as spam, with the date and the reason | Resend, our email provider, which tells us. We then stop sending email to that address, and the business sees the mark on your record so it can ask you for the right one. |
2.4 Gift card recipients
When a business sends a gift card, we receive the recipient's name and email address so we can deliver it. When the recipient claims it, the gift card is linked to their loyalty record with that business, and we record the claim's IP address and browser details to detect abuse. If the gift card is added to Apple Wallet, we hold the device and push identifiers Apple provides so the card can update. If an email to the recipient's address bounces for good or is marked as spam, Resend tells us, we record it with the date and the reason, and we stop sending to that address.
2.5 Website visitors
| Data | Where it comes from | Why |
|---|---|---|
| Pages viewed, clicks, time on page, the referring page | Your browser, through analytics cookies (see section 4) | To understand how the website is used |
| Device type, operating system, browser and IP address | Your browser | The same, and to run the website |
| Your country, estimated from your IP address | Our hosting provider | To decide whether to show the cookie banner |
| How you arrived: campaign tags, advertising click identifiers, the referring site | The link you followed | To measure our marketing |
| Recordings of how you use the website and the dashboard | Your browser, through analytics cookies (see section 4) | To improve the product |
3. Purposes and legal basis
This table covers data for which we are the controller. For end customers, the business is the controller and decides the legal basis for its program.
| Purpose | Data | Legal basis |
|---|---|---|
| Create and run your account, your passes and your program | Owner, team member and business data | Contract |
| Bill your subscription | Subscription status, Stripe references | Contract, and legal obligation for tax records |
| Process end-customer data for each business | End-customer data | On the business's instructions, as its processor |
| Keep the service secure and prevent abuse | Security logs, IP addresses, rate-limit counters | Legitimate interests |
| Understand where sign-ups come from | Sign-up attribution and approximate location | Legitimate interests |
| Website analytics, session recordings and advertising measurement | Usage data, recordings, cookies | Consent in the regions listed in section 4; elsewhere, legitimate interests |
| Product events sent from our servers | Account identifier, business identifier and type, approximate location | Legitimate interests |
| AI features you choose to use | The data listed in section 5 | Contract |
| Service and product emails to business owners | Name, email address | Contract for service emails; legitimate interests for product emails, which you can unsubscribe from in each email |
| Answer your messages | Name, email address, message | Legitimate interests |
| Comply with the law | What the law requires | Legal obligation |
4. Analytics, session recording and advertising
The cookie banner. If you visit from the European Economic Area, the United Kingdom, Switzerland, Morocco or a Gulf Cooperation Council country, we show a cookie banner. Analytics and advertising tools load only after you accept them. If we cannot tell which country you are visiting from, we treat you the same way. If you visit from anywhere else, we show no banner and these tools are on by default.
Cookie settings. Every page with our footer has a "Cookie settings" link. Anyone, in any country, can use it to accept or refuse analytics and advertising cookies. If you refuse, analytics and advertising stop, and they stay off on later visits in that browser.
Analytics. We use PostHog to see how the website and the dashboard are used: pages viewed, clicks and device information. PostHog is set to discard the IP address that comes with each event.
Session recordings. We record how the website, sign-up and sign-in, setup and the dashboard are used, through PostHog, to improve the product. What you type into form fields is masked and not recorded. Recordings are deleted after 30 days.
Events from our servers. Separately from cookies, our servers send PostHog a small number of events about business accounts, for example signing up, each setup step, creating a pass, a customer joining, recording a visit or a redeemed reward, and starting or completing a subscription payment. They carry the account identifier, the business's identifier and type, its plan, language and creation date, whether it has a live pass, whether a card is a test card, and the approximate location (country, region and city) that our hosting provider works out from the IP address of the owner's request. They never carry the business's name or address, or a customer's name, email address, phone number or identifier: a customer joining is counted, with nothing about the customer. They are sent whether or not analytics cookies were accepted.
Advertising. We use the Meta Pixel, provided by Meta Platforms Ireland Ltd., to measure and target our advertising. It runs only on our public website (for example the home page, pricing, the blog and sign-up), never inside the dashboard, and it loads only after you accept advertising cookies where consent is required. It can record pages viewed, your browser identifiers and IP address, and that you signed up. We send Meta no email address or phone number, and no events from our servers.
Email. The emails we send, to business owners and on a business's behalf to its customers, may record when they are opened and which links are clicked. For a click, this includes the IP address and browser details of the device that clicked.
Pages end customers use. No analytics, session recording or advertising tool loads on the pages end customers use to join a program, view their pass, claim a gift card or unsubscribe. To show each business how its join page is used, we count from our servers, without cookies, that a join page was opened, that its form was started, that a card was created, that the card was handed to Apple Wallet or Google Wallet, and that Apple Wallet added it. These counts carry the business's and the pass's identifiers and a random number that lasts only as long as the page is open; never the person's name, email address, phone number, IP address or any identifier, and nothing typed into the form.
Error monitoring. Sentry runs on every page, including those. When an error happens, it can keep a recording of the screen with all text and inputs masked, so that we can fix the error.
5. The AI features
Fideliya AI writes a short briefing on a business's figures and answers questions a business owner types. It also helps design pass banners. These features use Anthropic's Claude models, and the banner images are made by Higgsfield, with Ideogram as a backup.
What is sent to Anthropic:
- the business's figures (counts and totals);
- the names of the business, its passes, its rewards and its branches, as they are written, with the business type and its city and country;
- the question the owner types, with email addresses and phone numbers removed first. Any other text, including a name, is sent as typed;
- for banners: the business type, colours, business name and description, the reward, the language and the owner's banner hint, and then the generated image for a quality check.
What is never sent: the customer list, any customer's name, email address or phone number taken from our records, notes, or payment data.
Anthropic. Anthropic's commercial terms say it may not train its models on the data we send through its API. Anthropic deletes that data within 30 days, unless its safety systems flag it as breaking its usage policy, in which case it can keep it for up to 2 years.
Image providers. Higgsfield and Ideogram receive the image description, which can include the business name and the owner's banner hint. They use it under their own terms. Higgsfield's privacy policy says it may use what it receives to train its models. Ideogram's terms say it does not train on what it receives unless it is flagged for breaking its usage policy, and allow it to use that data in other ways.
AI assistants you connect
A business owner on a plan that includes it can connect an AI assistant of their choice, such as Claude or ChatGPT, to one of their businesses. The owner starts the connection from the assistant and approves it in Fideliya. This is separate from Fideliya AI above: the assistant and its provider are the owner's choice, not ours, and that provider is not our processor.
What the assistant can read. Through the connection, the assistant can read the connected business's figures, its loyalty cards, its gift cards, its referrals, its branches, its recent counter activity and its customers. A customer's details include their name, email address and phone number, their cards, visits, points and rewards. In lists, email addresses and phone numbers are partly hidden; the assistant sees one customer's in full only when it asks for that customer.
What it can do. The owner chooses the access when connecting. Read only reads and changes nothing. Read & write also enrols customers and prepares gift cards. Full access also prepares messages to customers, and the cancelling of a scheduled one. A gift card is issued, and a message sent or cancelled, only after the owner confirms it inside the assistant; a message goes at once or at a time the owner schedules, at most 30 days ahead. An assistant never adds or takes away visits, points or rewards, and never spends a gift card: those change only when the business scans the customer's pass.
Where the data goes. What the assistant reads is sent to the assistant's provider on the owner's instruction. It leaves Fideliya, and the provider's own terms and privacy policy apply to it from then on. Our Terms (section 5.4) make the owner responsible for that choice.
How long a connection lasts, and how to end it. A connection lasts 90 days (30 days for an assistant running on the owner's own computer), and then the owner connects again. The owner can disconnect at any time in the dashboard, under AI assistants. We tell the owner each time a new assistant is connected. We also email the owner each time an API key is created. Disconnecting an assistant, or deleting an API key, cancels the messages it scheduled that have not been sent. We keep a log of each request a connection or an API key makes (the time, what was asked for and the result, but no customer data) for 30 days. When a connection or an API key makes a change, we keep our answer to it for 24 hours, so that the same request sent twice is carried out once.
6. Who we share data with
Our processors. These providers process personal data for us, on our instructions, under data processing terms. Each receives only what it needs for its task. Where data leaves the United Kingdom or the European Economic Area, the last column shows the safeguard the provider's own terms set out.
| Provider | What for | Data | Where | Transfer safeguard |
|---|---|---|---|---|
| Vercel | Hosting the website and the application; storing uploaded images | Every request, including IP addresses; logos and images businesses upload | Our application runs in London | Standard Contractual Clauses and the UK transfer addendum |
| Neon | Our database | All the data in section 2 | London | Standard Contractual Clauses and the UK transfer addendum |
| Upstash | Rate limiting | IP addresses, account identifiers, counters | London | EU-US Data Privacy Framework, with Standard Contractual Clauses as a fallback |
| Clerk | Sign-in for business owners and team members | Name, email address, sign-in details | United States | EU-US Data Privacy Framework and Standard Contractual Clauses |
| Stripe | Subscription payments | Business owner email and language (so that receipts and invoices come in it), payment details Stripe collects | United States and Ireland | EU-US Data Privacy Framework, then Standard Contractual Clauses or the UK transfer addendum |
| Resend | Sending email | Recipient name and email address, the message, opens and clicks, bounce and spam reports | Sent from Ireland | Standard Contractual Clauses and the UK transfer addendum |
| Sentry | Error monitoring | Technical error details, account identifier, a recording of the screen when an error happens, with all text and inputs masked | Germany | Standard Contractual Clauses and the UK transfer addendum |
| PostHog | Product analytics and session recordings | Usage events, device identifiers, account identifier, business name, approximate location, session recordings | European Union | EU-US Data Privacy Framework |
| Anthropic | AI briefings, the question box and banner design | See section 5 | United States | Standard Contractual Clauses and the UK transfer addendum |
Meta. We use the Meta Pixel (section 4). For measuring our advertising, Meta Platforms Ireland Ltd. processes the data for us. For the website event data it also uses for its own purposes, Meta Platforms Ireland and Fideliya are joint controllers under Article 26 of the GDPR, as set out in Meta's Business Tools Terms. Meta's European and UK data transfer addenda cover transfers to Meta Platforms, Inc. in the United States. You can learn how Meta uses data in Meta's privacy policy.
Independent recipients. These services receive some data in the course of what we do, but use it under their own terms and their own privacy policies, not as our processors.
| Recipient | What for | Data |
|---|---|---|
| Google (Wallet) | Google Wallet passes | Pass content, including the customer's name |
| Apple (Wallet and Maps) | Updating Apple Wallet passes; finding a branch on Apple Maps | Device push identifiers; a branch's name and position |
| Google (Maps) | Maps and address search in the dashboard | IP address, the addresses searched |
| Higgsfield | Banner images | Image description (see section 5) |
| Ideogram | Banner images (backup) | Image description (see section 5) |
| Google Fonts and Fontshare | Fonts on our pages | IP address, browser details |
| Product Hunt | A badge on our website | IP address, browser details |
When a customer adds a pass to Apple Wallet or Google Wallet, Apple and Google apply their own terms to the pass in their wallet. If the customer removes the pass from their wallet, it no longer updates on their phone.
Businesses and their tools. A business's owner and team see their own customers' data in the dashboard. Owners on a paid plan can download it as a CSV file. If an owner connects a webhook to a service of their choice, we send that service each new customer's name, email address and phone number, each gift card recipient's name and email address, the name of each customer whose pass is scanned or who reaches a reward, and the names of both customers when a referral completes. When a scan is undone or a gift card payment is taken, the service receives the amounts and identifiers, with no name. We email the owner each time a webhook is added or pointed to a new address, and we stop sending while the account is not on the plan that includes webhooks. If an owner connects an AI assistant or uses an API key, the assistant or the owner's software receives what it reads (see "AI assistants you connect" in section 5). With an API key, the owner's software can also record visits, points and rewards and, with the permission the owner gives for it, take gift card payments, as staff do at the counter.
Legal requests. We disclose data when the law requires it, for example to a court or a public authority.
If Fideliya changes hands. If Fideliya is sold or merged, personal data may pass to the new owner, who must keep to this policy. We will tell you before that happens.
International transfers. Our database and application run in London, in the United Kingdom, which the European Union recognises as giving adequate protection. Some providers above are based in, or may access data from, other countries, including the United States. For those transfers we rely on the safeguards in the tables above. You can ask us for details at contact@fideliyapass.com.
7. Cookies and similar storage
Cookies we set
| Name | Purpose | How long |
|---|---|---|
__session, __client_uat and related Clerk cookies |
Keep you signed in | Set by Clerk |
fdl_authed |
Remembers that you are signed in, so the right pages load | 30 days |
fideliya-onboarding-complete |
Remembers that you finished setup | 365 days |
fdl_analytics_consent |
Remembers your analytics choice | 365 days, renewed on each visit |
NEXT_LOCALE |
Remembers your language | 365 days |
geo-country |
Your country, to decide whether to show the cookie banner | Until you close the browser |
ft |
How you first arrived at our website (campaign tags, click identifiers, referrer) | Until you close the browser; 90 days if you accept analytics cookies |
lt |
How you arrived on this visit | Until you close the browser |
fideliya_pending_token |
Keeps a pass you designed before signing up while you create your account | 1 hour |
fp_join_fix |
Lets an end customer correct their email address from the phone they joined on, and from no other device | 15 minutes |
Cookies set by advertising tools, only after consent in the regions in section 4:
| Name | Provider | How long |
|---|---|---|
_fbp, _fbc |
Meta Pixel | Set by Meta |
Storage in your browser (local storage, kept until you clear it):
| Key | Purpose |
|---|---|
fideliya_cookie_consent |
Your cookie choice |
ph_<project>_posthog |
PostHog analytics identifiers, only when analytics are on |
fideliya-theme |
Light or dark mode |
fideliya_scanner_location_<account> |
The branch last chosen in the scanner |
fideliya_scanner_device |
A random identifier for this browser's scanner, so that only this device can undo the scans made on it |
fideliya_scanner_shift_<account> |
Today's scans on this device ("This shift"): each customer's name and what was added. Replaced the next day. |
fideliya_scanner_camera_ok, fideliya_scanner_scanned_<account>, fideliya_hide_homescreen_tip |
Scanner preferences |
fideliya-has-passes, fideliya_cr_fired_<account> |
Dashboard and sign-up measurement flags |
fideliya:create:draft:<account> |
A pass design you have not saved yet |
fideliya_homepage_draft, and the IndexedDB database of the same name |
The pass you made on our homepage before signing up, so setup can start from it: what you changed (name, reward, colours, the wallet shown) and the logo and cover files you added. It stays in this browser, is never sent to us before you sign up, and is deleted after 36 hours or once setup has taken it. |
8. How long we keep data
| Data | How long |
|---|---|
| Your account | Until you delete it. When you delete it, it is deleted at once (see section 9). |
| End-customer data | While the business runs its program. When the business deletes a customer, their identifying details are removed and their visit records stay with no name attached (section 9). Everything is deleted when the business deletes the pass or its account. |
| Gift cards | Until they are claimed, or until the business deletes the gift card or its account |
| Security logs | For as long as the account exists. They are deleted with it. |
| Scan receipts | For as long as the pass or gift card they belong to. They are deleted with it, or with the account. |
| Messages you send us | Until you ask us to delete them |
| Payment records | Stripe keeps invoices and payment records. We keep the records the law requires for tax. |
| Session recordings | 30 days |
| Connections to AI assistants | 90 days, or 30 days for an assistant on the owner's own computer, unless the owner disconnects it sooner |
| Log of API and AI assistant requests | 30 days |
| Our answers to changes an AI assistant or an API key made, so that a request sent twice is carried out once | 24 hours |
| Other analytics data | For the period our PostHog plan sets: one year on the free plan, seven years on paid plans |
| Database backups | Deleted data can remain in our database's backup history for up to 7 days |
| Cookies and browser storage | As listed in section 7 |
Deleting an account. An account can be deleted from its Settings, from the account screen of our sign-in provider, or by us. Whichever way, it is deleted at once with its businesses, passes, customers, gift cards, team and its security log entries. We also cancel any live subscription at once, and delete the images the business uploaded or generated. We keep one short record that an account was deleted: when it happened, how, and how many businesses it had, with a one-way hash of the account identifier. It contains no name or email address.
What a deletion cannot reach. Stripe keeps its invoices and payment records. Passes already saved on customers' phones stay there until the customer removes them, although they no longer update. Emails already sent stay in the recipients' inboxes.
9. Your rights and how to use them
You have the right to access your data, to have it corrected or deleted, to restrict or object to how it is used, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.
Business owners
- Delete your account yourself in Settings. It takes effect at once (see section 8).
- Download your customers, visits and passes as a CSV file, on a paid plan. For a copy of anything else we hold about you, write to us.
- Correct your name, business details and settings in your account. To change your email address, use your account profile.
- Unsubscribe from product emails through the link in each email.
Team members. The business owner can remove you from the account. For anything else, write to us.
End customers. Ask the business you joined. An owner or manager can delete you from the dashboard, after a confirmation. This removes your name, email address and phone number, the business's notes about you, the name and email address on gift cards sent to you, your name, email address, IP address and browser details in our security log, and the links to your Apple devices. Your pass is voided in Apple Wallet and expired in Google Wallet, with your name removed. Your visits, scans, rewards, referrals, the record of messages sent, and gift card balances and payments stay, with no name attached, so the business's totals stay correct. A gift card's link to the phone it is saved on stays, because a gift card holds money: the gift card and its balance stay usable by whoever holds it. We keep a record that the deletion happened, with no name or contact details. The webhook events we keep for 30 days, and the business's notifications in the dashboard, lose your name and contact details too, so they are never sent or shown again. A deletion cannot reach emails already delivered, data the business has already sent to its own tools through a webhook, or files it has already exported. You can also write to us and we will pass your request to the business. To stop emails, use the unsubscribe link in any email.
How to ask. Write to contact@fideliyapass.com. We may ask you to confirm who you are. We reply within one month. If a request is complex, we may need up to two more months, and we will tell you within the first month.
Complaints. You can complain to a data protection authority. In Spain, where our principal place of business is, that is the Agencia Española de Protección de Datos (www.aepd.es). You can also complain to the authority where you live or work. We would rather hear from you first, so we can try to put it right.
Other places. Depending on where you live, you may have other rights, for example under California law. Write to us and we will help.
10. Security
- Our hosting, database and other providers encrypt data in transit and at rest.
- Our website is served only over HTTPS.
- We do not store passwords or card numbers. Clerk holds sign-in details and Stripe holds payment details.
- Each business's data is kept separate from every other business's, and team members see only what their role allows.
- We keep a security log of changes made in each account.
- Joining a program, scanning, gift cards, uploads, AI questions, the contact form and other sensitive actions are rate limited to prevent abuse.
No system is completely secure. If a breach affects your data, we will tell you and the authorities as the law requires.
11. Children, changes and contact
Children. Fideliya is not meant for children under 16, and we do not knowingly collect their data. If we learn we have, we will delete it.
Changes. We will update this policy when the service changes. If a change matters, we will email business owners before it takes effect and show a notice on our website. The dates at the top show when this policy took effect and when it was last updated.
Contact. Fideliya, contact@fideliyapass.com, https://www.fideliyapass.com. Principal place of business: Spain.