Privacy Policy

1. Who we are

PiqloLabs ("Piqlo", "we", "us"), a sole proprietorship (eenmanszaak) based in Amsterdam, the Netherlands, runs Piqlo: the website at piqlo.co, the web app, the Piqlo iPhone app, and the wallet passes we issue for businesses.

For privacy questions and requests, write to privacy@piqlo.co. We have not appointed a Data Protection Officer, because the GDPR does not require one for us (Article 37). As we are established in the EU, we do not need an EU representative (Article 27).

2. Two roles: your account, and your customers

Your account. For the personal data of account holders, the businesses and people who sign up for Piqlo, we are the controller under the EU General Data Protection Regulation (GDPR). Section 3 lists this data.

Your customers. When a business uses Piqlo to run loyalty cards and keep its customer list, the business is the controller of its customers' data, and Piqlo is its processor (Article 28 GDPR). We process that data only to provide Piqlo to the business, on its instructions. Our Data Processing Agreement covers this processing and forms part of our Terms of Service. Section 4 lists this data.

If you are a shop's customer. The shop decides how your data is used, so please send requests about your data to the shop. If you write to us instead, we pass your request on to the shop.

3. What we collect about you

• Account: your email address, your name, a profile picture if your sign-in method shares one, how you sign in (email and password, Google, or Apple), and whether your email address is confirmed. Your password is handled by Google Firebase Authentication. We never see it. An email address is needed to create an account and sign in; without one we cannot give you an account.
• Your business: your business name, logo, card designs and texts, rewards, and your locations (name and address). If you import your business, the details Google Places returns for the place you pick.
• Plan: your plan and the promo codes you redeem. Piqlo takes no online payments today, so we hold no payment details.
• Support: what you write to us. The support form also sends us your IP address and country, to help us stop abuse.
• Use of Piqlo: a small number of named events, such as "pricing page viewed" or "card created", with the page and card code they happened on. These events hold no IP address and no third-party identifier. To stop abuse, we count events per IP address in a short-lived cache for up to about 25 hours. When someone uses a free tool, such as the animated QR maker or the scan checker, we keep a hashed fingerprint (IP address, browser string and a secret value) for about an hour, to stop abuse of the tool.
• Searches: when you search for your business to import it, or for a GIF in the animated QR tool, we keep the search text with your account ID (or, before you sign in, a browser session ID) in our analytics for about 90 days, to watch usage limits.
• The iPhone app: a push token for each device where you allow notifications.
• Connected tools: if you create an API key or connect an AI assistant to Piqlo, we keep the key or the connection. The assistant receives the data you ask it to read; its provider is your choice and not our sub-processor.

4. Your customers' data, which we process for you

When you run cards with Piqlo, we store and process the following for you:

• Customers: first name (someone who gives none shows as "Guest"), email address if they give one, phone number if you add it, and which of your cards they hold.
• Visits: stamps or points, rewards earned and given, the date of each visit (Last visit), the location and counter scanner where it happened, and which staff member gave it, when staff sign in with a PIN.
• Offers: whether a customer agreed to get your offers, for which card, when and how, and every later change, kept as proof of their consent.
• Notes: what you and your team write about a customer. Please do not write health details or other sensitive data in notes.
• Contacts: customers you add yourself, and the details people save through your contact card.
• Wallet passes: the content of each pass (section 5), and the device identifiers and push tokens Apple Wallet and Google Wallet need to keep it up to date.
• Counter scanners: the names you give your staff, a hashed PIN, and when each scanner was last used.
• Taps and scans of your cards: country, city, device type, operating system and browser. We do not store IP addresses in scan analytics. To count a repeat scan only once, we keep a hashed fingerprint for at most 24 hours, made from the IP address, the browser string, the card and a secret value. This fingerprint is pseudonymous, not anonymous, and we use it for nothing else.
• Sign-ups and contact saves: to spot repeat sign-ups or repeat contact saves from one device, we keep a similar hashed fingerprint (IP address, browser string, card and a secret value) for 7 days when someone joins one of your cards or saves their details through your contact card. It never blocks anyone, and we use it for nothing else.

Emails to your customers

Piqlo sends two kinds of email to your customers for you: the link to their card (when they ask for it again, when they join another of your cards with an email address that already has a card with you, or when you add them with their email address), and the link that confirms they want your offers. These emails come from "your shop name via Piqlo" at a no-reply address (or from Piqlo, if our email provider does not accept your shop name as a sender name), and they send questions to you, not to Piqlo. Piqlo does not send offers or other marketing to your customers.

Alerts on your phone

If you allow notifications in the Piqlo iPhone app, an alert such as "Maya just earned a free coffee" can include a customer's first name and the reward. Apple delivers it.

We process all of this only to provide Piqlo to you, under our Data Processing Agreement. We never use your customers' data for our own marketing, and we never sell it.

5. Wallet passes

When a customer saves their card to Apple Wallet or Google Wallet, the pass shows their first name, a barcode (a random token, not their name or email), their stamps or points and rewards, the date they joined, their lifetime visits and rewards, and the shop's name, logo and design. The back of the pass can show the shop's address and opening hours, if the shop adds them, names the service as piqlo.co (PiqloLabs) and links to the customer's card and their offers choice.

Once a customer adds a pass, Apple or Google keeps it on the customer's phone and in their own systems, under their own terms with the customer. A pass stays on the phone until the customer removes it.

6. Location

Customers: we do not track your customers' locations. Piqlo never receives where a customer's phone is. Scan analytics record only the country and city a tap or scan came from, as our network reports it, and server traces record the country, region and city a request came from (section 9).

Owners: Piqlo does not ask for your device's location. A location you add in Piqlo is the name and address you type.

7. Why we use data

• To provide Piqlo (contract, Article 6(1)(b)): your account, cards, plan, support, and the emails the service needs.
• Our legitimate interests (Article 6(1)(f)): security and abuse prevention (rate limits, bot checks, logs), tap and scan analytics for your cards, our own product events, and improving Piqlo. We have weighed these interests against your rights: the data is limited, the parts that identify a device are short-lived, and none of it is used for advertising. You can object (section 11).
• Legal obligations (Article 6(1)(c)): records that tax law requires us to keep, and answering lawful requests.
• Consent (Article 6(1)(a)): only where we ask for it, such as notifications in the iPhone app. You can withdraw it at any time.

For your customers' data, you choose the legal basis as the controller. For offers, that basis is your customers' consent, which Piqlo records for you.

We make no decisions about anyone based solely on automated processing that have legal or similarly significant effects (Article 22 GDPR). Rate limits and bot checks can slow down or refuse a request automatically; if that stops you, write to support@piqlo.co.

8. Who receives data

We share personal data only with the providers we need to run Piqlo. Each one is listed on our sub-processors page, with what it receives, where it processes data and the terms and transfer safeguard we rely on. We never sell personal data and never share it for advertising.

Some data also goes where you or your customers choose: to Apple or Google when a customer adds a pass, and to a tool or AI assistant you connect. We disclose data to authorities only when the law requires it, and we tell the person concerned when we are allowed to.

9. Where data is stored

Our core platform runs on Cloudflare. Your account profile and the customer data you collect through Piqlo live in Cloudflare D1, which we created under Cloudflare's EU jurisdiction: a binding commitment that the database stores its data inside the European Union. The Durable Objects that coordinate stamps, points and account limits are pinned to the same EU jurisdiction.

Not everything stays in the EU:

• Your sign-in details (email, password hash and sign-in records) are handled by Google Firebase Authentication, which runs only in the United States.
• Images, such as logos and pass designs, are stored in Cloudflare R2 with a Western Europe location hint. Cloudflare treats this hint as best effort, and public images are cached on Cloudflare's global network.
• Cloudflare KV, a cache that Cloudflare replicates globally, holds copies of signed Apple Wallet passes, which can include a customer's first name, for up to 30 days, and short-lived abuse counters that include IP addresses for up to about 25 hours.
• Each request is handled at the Cloudflare location nearest to the visitor, which can be outside the EU. Logs, traces and analytics are kept on Cloudflare's network. A trace can contain an IP address that is part of a cache entry's name, search text an owner typed, such as a customer's name or email address, text someone typed that our servers passed on, such as a GIF search, and the country, region and city a request came from.
• Emails are sent from Ireland, but our email provider, Resend, keeps its logs in the United States.
• When a customer adds a pass to Apple Wallet or Google Wallet, Apple or Google keeps a copy of it.

For each provider outside the European Economic Area, the sub-processors page names the agreement we rely on and, where the provider offers one, the transfer safeguard, such as Standard Contractual Clauses. Where a US provider is certified under the EU-US Data Privacy Framework, that framework applies too. For Apple Wallet and Google Wallet we rely on Apple's and Google's platform terms; we have no separate data processing agreement with them. For a copy of the safeguards, write to privacy@piqlo.co.

10. How long we keep data

• Your account: until you delete it. Deleting your account deletes your cards, your customers, their notes and your sign-in account straight away. Google removes the sign-in record from its backups within 180 days. Tap and scan events tied to your account expire within about 90 days, and the short-lived copies below expire on their own schedule.
• A card you delete: it leaves your dashboard straight away, and we erase it, with its customer records, 30 days later.
• Customers who leave: when someone no longer holds any of your cards (you remove them, or the card they held is deleted), we erase them, with these exceptions. If they agreed to get your offers by email, we keep their first name, email address, visit dates and the proof of their consent, so you can still send them offers, until they withdraw or for up to 3 years after their last visit (or after they agreed, if that was later); their phone number and notes are deleted. A contact someone saved through your contact card stays until you delete it. And when a card is deleted or a sign-up expires, a customer you added yourself or wrote a note about stays in your list until you delete them.
• Delete customer: erases that person from your list and our database straight away. A cached copy of their Apple Wallet pass expires within 30 days, and a pass already on their phone stays until they remove it.
• Sign-ups that never get a stamp or points: erased after 72 hours. Someone who added the card to Apple Wallet stays while the pass is on their phone, and someone who got a Google Wallet pass stays for up to 90 days. Someone who confirmed by email that they want your offers is kept for offers, as above.
• Tap and scan events: about 90 days. Totals per card stay with the card.
• Short-lived copies: abuse counters with IP addresses for up to about 25 hours, the scan fingerprint for up to 24 hours, the sign-up and contact fingerprints for 7 days, the free tool fingerprints for about an hour, and cached Apple Wallet passes for up to 30 days.
• Server logs and traces: up to 7 days at Cloudflare, then deleted.
• Searches for business import and GIFs: about 90 days.
• Backups: our database keeps restore points for up to 30 days.
• Image files: some files uploaded for a card's background or wallet design are not yet removed automatically when you delete your account or the card. Write to privacy@piqlo.co and we delete them.
• Email logs: kept by Resend under its retention settings.
• Records that tax law requires: as long as Dutch tax law requires, currently 7 years.
• Support and privacy emails: as long as we need them to handle your request and keep a record of it.

11. Your rights

Under the GDPR you have the right to:

• Access and take your data with you: export your account, your cards and your customers' data as a file from Settings. On Pro and Business, you can also download your customers as a spreadsheet from Customers. For anything the export leaves out, such as your locations and staff, write to privacy@piqlo.co.
• Correct it: change your name and details in Settings at any time.
• Erase it: delete your account in Settings (section 10 says what remains and for how long).
• Restrict or object: write to privacy@piqlo.co, including to object to processing based on our legitimate interests.
• Withdraw consent: at any time, without affecting what was done before.
• Complain: to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority where you live.

We answer requests within one month.

If you are a shop's customer

The shop is the controller of your data, so ask the shop to see, correct or delete it. You can turn the shop's offers off yourself at any time, on your card page or from the link on your wallet pass. Turning them back on works the same way and takes effect when you open the link we email you. You can also ask the shop to turn them off for you. Your card, stamps and rewards are not affected. If you contact us, we forward your request to the shop.

12. Cookies and browser storage

We use only cookies that are strictly necessary: __session keeps you signed in, and piqlo_anon (30 days) links a card you build on our website before signing up to your new account. We use no advertising, tracking or third-party analytics cookies.

The web app also keeps a few things in your browser's storage, such as your sign-in session, your theme, the shop location you last picked and, on a counter scanner, the signed-in staff member's name and session and stamps waiting to be sent while offline. A shop's card page keeps a customer's private card link and progress in their own browser, so their card opens again. All of this stays on the device.

Public forms, such as joining a card, use Cloudflare Turnstile to check for bots. It looks at technical details of the browser for that check only.

13. Security

Data is encrypted in transit (TLS 1.2 or later) and at rest. We use access checks on every request, rate limits, bot checks on public forms, validation that blocks links to private or internal addresses, constant-time comparison of secrets, hashed PINs for counter scanners, and safe failure for stamps and points. We review security as part of significant changes. If a breach puts your data at risk, we tell you and the authorities as the law requires.

14. Children

Piqlo accounts are not for anyone under 16. If you believe a child under 16 has given us personal data, write to privacy@piqlo.co and we delete it. A shop that offers its loyalty card to young customers is responsible for doing so lawfully.

15. Changes to this policy

When we change this policy in a way that matters, such as a new provider that processes personal data, we tell account holders by email or in the app before the change takes effect. The date at the top shows the latest version.

16. Contact and complaints

Privacy questions, requests and complaints: privacy@piqlo.co. Product support: support@piqlo.co. Everything else: hello@piqlo.co.

PiqloLabs, a sole proprietorship (eenmanszaak), Amsterdam, the Netherlands.