1. Who we are and what this policy covers
“Loyal Loop”, “we”, and “us” refer to the operator of the Loyal Loop service. This Policy applies to our websites, business workspaces, public shops, Explore surfaces, order requests, digital receipts, delivery pages, Trust Cards, private tests, support, and related services.
For account, platform-security, product-improvement, and direct customer-account activities, Loyal Loop determines why and how the relevant personal data is processed. A business also determines why it records and uses information about its customers. Depending on the activity, that business may have its own obligations as a data controller while Loyal Loop processes information to provide the service.
2. Information we collect
- Account information: name, email address, phone number, password hash, profile image, verification state, sessions, and security events.
- Business information: business name, category, description, location, public contacts, social links, logo, team roles, preferences, plan, and setup status.
- Commerce information: products, Showcases, customer records supplied by a business, order requests, sales, receipts, payment statuses recorded by a business, proof of payment, delivery details, feedback, issues, and support requests.
- Customer-account information: contact information, saved shops and products, cart, order history, delivery addresses, preferences, and communication choices.
- Media: product photos or videos, logos, avatars, and other files you choose to upload.
- Usage and device information: interactions with eligible pages and features, timestamps, referral or campaign parameters we allow, approximate device/browser information, session identifiers, and security logs.
- Founding Circle information: invitation and cohort, onboarding progress, feature usage, feedback, interview notes, future-offer interest, any price a participant volunteers without prompting, and paid-pilot interest.
- Location and address information: locations or addresses you type, select, save, or provide for a business, order, or delivery.
We do not scrape a person's private social profile or contact list to build customer memory.
3. How we receive information
We receive personal data:
- directly from you when you create an account, submit a request, contact support, or provide feedback;
- from a business when it records a customer, sale, receipt, delivery, or support matter;
- automatically from your browser or device when needed for sessions, security, reliability, and bounded product analytics; and
- from service providers when they return delivery, messaging, media, map, authentication, verification, or payment status.
4. Why we use information
We use personal data to:
- create accounts and business workspaces;
- provide shops, discovery, customer memory, order, receipt, delivery, feedback, and support features;
- authenticate users, prevent abuse, investigate incidents, and secure the service;
- send requested service messages and honour communication preferences;
- measure whether Founding Circle businesses activate, return, encounter problems, and see enough value to consider a future offer;
- understand aggregate feature performance and improve Loyal Loop;
- maintain records, resolve disputes, enforce our Terms, and meet legal obligations; and
- provide payment or identity-verification features if they are later activated with appropriate notice.
5. Lawful bases
Depending on the context, we rely on performance of a contract, steps requested before entering a contract, consent, compliance with a legal obligation, or legitimate interests such as securing and improving the service, preventing fraud, and supporting users. Where we rely on consent, you may withdraw it without affecting processing that was lawful before withdrawal.
6. Businesses and customer information
A business must have a lawful reason to add or use customer information and must give any notice required by law. Its customer workspace is business-scoped. We do not expose one business's private customer notes or history to another business.
Customers may also provide information directly when they sign in, submit an order request, save an address, consent to updates, confirm delivery, report a problem, or leave feedback. We may connect that information to the relevant business and order so the requested journey works.
7. Public information and discovery
Business owners choose information to publish through shops, products, Showcases, Trust Cards, and share links. Customers should treat those areas as public and avoid submitting confidential information in a public field.
We may record bounded opens, saves, shares, follows, requests, purchases, and explicit interests to operate and improve discovery. We use signed or allow-listed attribution parameters where available and do not use social-profile scraping or unrestricted browser fingerprinting for this purpose.
8. Messages and communication choices
We may send essential security, account, request, receipt, delivery, and support messages. Optional reminders or marketing require the relevant permission where required. You may withdraw optional communication consent or use the provided opt-out method. We keep suppression records where necessary to honour an opt-out.
9. Payments and identity verification
Most current payment statuses are records supplied by a business, not bank confirmation. If payment processing or Protected Payment is activated, a licensed payment provider may collect payment details and return transaction references, status, fees, refunds, disputes, and settlement information to Loyal Loop. The checkout and an updated notice will explain the live arrangement before payment.
If seller verification is activated, a vetted verification provider may collect or validate business registration, bank-account ownership, identity documents, BVN, NIN or vNIN, selfie/liveness, sanctions, or similar information with an appropriate lawful basis and notice. Our intended design is to use provider-hosted collection and retain the minimum result, masked reference, risk flag, and audit evidence needed rather than raw identity numbers or biometric templates.
10. Service providers and disclosures
We use selected providers for hosting, databases, media storage, email, maps and address suggestions, analytics, security, authentication, communications, customer support, and—if activated—identity verification and payments. They receive only the information reasonably needed to perform their service and are subject to contractual or legal safeguards appropriate to their role.
We may also disclose information when required by law, to protect people or the service, to investigate fraud or abuse, or as part of a genuine financing, reorganisation, acquisition, or sale subject to appropriate safeguards. We do not sell personal data.
11. International transfers
Some providers may process information outside Nigeria. Where personal data is transferred internationally, we assess the transfer and use a lawful transfer mechanism or other safeguards required by applicable data-protection law.
12. Retention
We keep personal data only for as long as reasonably needed for the purpose collected, including to provide an active account, preserve transaction and consent evidence, resolve complaints, secure the service, meet tax or legal duties, and establish or defend legal claims. Retention periods vary by record type and provider obligation.
We delete or anonymise information when it is no longer needed, subject to legal holds, fraud-prevention records, suppression lists needed to respect opt-outs, and mandatory transaction or compliance retention. Closing an account does not always permit immediate deletion of every transaction or security record.
13. Security
We use reasonable technical and organisational safeguards appropriate to the information and risk, including access controls, role permissions, protected credentials, session controls, logging, backups, and provider reviews. No internet service can guarantee absolute security. Please contact security@useloyalloop.com if you believe data or an account is at risk.
14. Your privacy rights
Subject to applicable law and relevant exceptions, you may ask to be informed about processing; access, correct, or receive a copy of your personal data; object to or restrict certain processing; request deletion; withdraw consent; or request human review of a decision based solely on automated processing that produces a legal or similarly significant effect.
Loyal Loop does not currently make solely automated decisions that produce legal or similarly significant effects for ordinary customers or businesses. Discovery ranking and product suggestions may be automated, but they do not determine a person's legal rights.
Send a request to privacy@useloyalloop.com. We may need to verify your identity and relationship to a business before acting. You may also lodge a complaint with the Nigeria Data Protection Commission.
15. Cookies and local device storage
Loyal Loop uses cookies and similar browser storage for authentication, security, cart and preference continuity, private-access gating, remembered routes, and service operation. Where optional analytics or advertising technologies require consent, we will provide the relevant choice before using them.
16. Children
Loyal Loop is not designed for a child to operate a business account independently. If a customer is a child, the business and responsible adult must ensure that the transaction and use of personal data are lawful and appropriate. Contact us if you believe a child has provided personal data improperly.
17. Changes and contact
We may update this Policy as the service, providers, or law changes. We will update the effective date and provide appropriate notice of material changes. Questions, objections, and privacy requests can be sent to privacy@useloyalloop.com.