Privacy Policy

What this policy covers

Louyia is a mobile app for iPhone that connects local businesses with the customers who visit them. This policy covers the Louyia app, the Louyia server behind it, and this website.

The two kinds of account

Accounts exist only inside the Louyia app. There is no account on this website and no way to create one here.

• Customer. Joins businesses, collects stamps, earns rewards and books appointments.
• Business. Runs a loyalty program, manages a client list and takes appointments.

One sign-in identity belongs to one account of one type. Signing in with the same Apple or Google account always returns you to the same Louyia account.

Information you give us

Signing in

Louyia offers Sign in with Apple and Sign in with Google, and nothing else. There is no Louyia password to create, and Louyia never has one. When you sign in, the provider confirms your identity to Louyia and gives us an account identifier and, depending on the choices you make with that provider, an email address. If you use Apple’s Hide My Email, Louyia receives the relay address Apple generates for you rather than your own address.

Your profile

• The name you want shown to the businesses you join.
• Your birthday, if you add one. Louyia stores the month and the day only — not the year — because it is used for a birthday reward where a business offers one.

Business details, for Business accounts

Your business name and type; the reward you offer and how many stamps it takes; the card’s colours and your logo; your services with their prices and durations; your opening hours and time off; your address; and, if you choose to add them, a description, an Instagram handle, a public phone number, and up to twelve portfolio photos.

Information created when you use Louyia

• Loyalty activity. Which businesses you have joined, the stamps on each card, and rewards earned and redeemed.
• Joining activity. The invite codes a business creates, and the record that a code was used to join.
• Appointments. Which business, which service, the time, the duration and the price shown when you booked, and each change afterwards — confirmed, rescheduled, declined, cancelled or completed.
• Business policies. A policy a business sets for its clients, and the record that a customer acknowledged it.
• Preferences. Your language, and which notifications are turned on.
• Security records. Records of significant account actions, kept so that account problems and misuse can be investigated.

Device and technical information

• A notification token, only if you allow notifications. An identifier your phone’s operating system issues for the app, stored with the platform, the app version and the device name your phone reports. It is used to deliver notifications and for nothing else, and it is removed when you turn notifications off or delete your account.
• The network address a request arrives from. Louyia’s server uses it to limit how often the same source can call the service, which is what keeps the service usable and resistant to abuse.
• Camera, only while you are scanning. The app asks for the camera so it can read a business’s joining code. Nothing is recorded and no image is stored.
• Photos you choose, and only those. When you set a logo or add a portfolio photo, the app opens your phone’s picker and receives only the image you picked — it does not read your photo library. Information embedded in a photo by your camera, including location, is removed before the image is stored.

What a business makes public

A Business account has a public profile that customers in Louyia can see. It shows the business name and type, and whichever of these the business has added: a description, an Instagram handle, a public phone number, a logo, portfolio photos, and the address where the business has chosen to show it.

A business decides what goes there. Do not put anything on a public profile that you would not want a customer to see.

What a business can see about its clients

A business can see, for people who have joined that business: the display name they chose, their progress on that business’s own loyalty card, when they last collected a stamp there, and the appointments they have with that business.

A business is not shown a customer’s email address or sign-in identity, and cannot see anything about that customer’s relationship with any other business. Louyia has no directory of customers for a business to browse.

How Louyia uses information

• To provide the features you are using — cards, stamps, rewards and appointments.
• To keep the service working and to prevent abuse of it.
• To send notifications about your appointments, and reminders you have turned on.
• To answer support requests you send us.
• To meet legal, tax and accounting obligations.

Louyia does not use your information to build an advertising profile, and does not use it to make automated decisions that have a legal or similarly significant effect on you.

Service providers

Louyia relies on a small number of providers, which process information on Louyia’s behalf for the purposes above.

• Supabase — stores Louyia’s database and uploaded images, and runs the sign-in system.
• Vercel — hosts Louyia’s server and this website.
• Apple and Google — you sign in through them, and they confirm your identity to Louyia.
• Apple, through the App Store — takes payment for a Business subscription and confirms to Louyia what was purchased and whether it is still active.
• Superwall — presents the subscription screen inside the app and reports whether a subscription is active. It receives an account identifier that means nothing outside Louyia. It is not given your name, your email address or your business’s details.
• Expo — passes push notifications to Apple’s notification service for delivery to your device.
• PostHog — receives the product analytics events described below, attached to an internal account identifier. Not your name, email or sign-in identity.
• An address search service — when a business types its address, that text is sent from Louyia’s server to an address search provider (OpenStreetMap-based services, and Google Places in regions where it is enabled) so that suggestions can be offered. The request is made by Louyia’s server rather than by your phone, so the provider is not told which account is typing.

What Louyia does not do

• Louyia does not sell your personal information, and does not share it for cross-context behavioural advertising.
• There is no advertising tracking. The app contains no advertising network, no advertising identifier and no advertising cookies.
• Louyia does not use analytics for advertising, for tracking you across other companies’ apps or websites, or for building a profile to target you with. The product analytics described below exist to tell us which features are used, and nothing else.
• The app contains no crash-reporting service today. If one is added, this policy will be updated to say so before it ships.
• Louyia does not handle your card details. Apple takes the payment for a subscription; Louyia never sees a card number.
• This website sets no cookies, runs no analytics and carries no tracking script.

Product analytics

Louyia collects a small amount of information about how the app is used, so that we can see which features people actually reach, find the places where something is confusing or broken, and decide what to improve next. It is the difference between guessing at how Louyia is working and knowing.

What is collected

A short, fixed list of actions — things like starting business setup, joining a loyalty card, giving a stamp, booking an appointment, or a subscription being purchased or restored. Each one records that the action happened, and at most a small label such as whether the account is a Customer or a Business, or which of the two Business plans is involved.

The list of events and their labels is fixed in the app. Nothing you type is part of it. There is no way for a name, a phone number, an email address, an appointment note, a message, a photo, an invite code, a payment identifier or any other free text to become part of an analytics event, because none of those has anywhere in an event to go.

How it is linked to you

Events are attached to the same internal account identifier Louyia already uses for you — a random identifier that means nothing outside Louyia. Your email address, your name and your sign-in identity are not sent. When you sign out, delete your account, or a different account signs in on the same device, that link is cleared, so activity is never carried over from one account to the next.

Who processes it

PostHog, a product analytics provider, processes this on Louyia’s behalf. We use it for product analytics only. We have turned off its session recording, its automatic capture of taps and screens, and its approximate location lookup — so no recording of your screen is made, no tap or form content is captured, and no location is derived.

Notifications

If you allow notifications, Louyia uses them to tell you about your appointments — when a booking is confirmed, rescheduled, declined or cancelled, and as a reminder before it starts. A business can also choose loyalty reminders for its own clients, such as a nudge when a reward is close.

You can turn notifications off at any time in your phone’s Settings, or in Louyia’s own settings. Turning them off removes the token for that device.

Subscriptions and payment

Customer accounts do not pay Louyia. A Business subscription is purchased through your Apple ID in the App Store. Apple processes the payment, and Louyia stores what was purchased and whether it is currently active, so the app knows what a business account may use.

Your subscription is managed by Apple, not by Louyia. You can view, change or cancel it in your Apple ID settings on your device.

How long information is kept

Your account information is kept while your account exists. When you delete your account, the information described in the next section is deleted with it.

Some records are kept for longer where they are needed for security, or where the law requires it — for example a record that a subscription was purchased, which is part of our accounting obligations.

Deleting your account

What deletion removes

• Your Louyia profile, and the sign-in identity that Louyia holds for you.
• For a Business account: the business, its loyalty program, its card design, its services and availability, its public profile and its portfolio photos.
• Any notification tokens stored for your devices.

What remains, and why

A business’s own historical records — for example that a stamp was given on a particular day — are not deleted, because they belong to that business’s records as well as to you. Where such a record referred to you, it no longer does: the link to your account is removed, so the record survives without identifying you.

Security

Traffic between the app and Louyia’s server is encrypted in transit. Because sign-in is handled entirely by Apple and Google, Louyia holds no password for you — there is no Louyia password that can be guessed or leaked.

Access to information is scoped to the account it belongs to: a business can reach its own clients, cards and appointments, and not another business’s. We do not describe our internal security arrangements in detail here, because doing so would not help you and would help somebody attacking the service.

No service can promise perfect security. If we become aware of a breach affecting your information, we will act on it and notify you where the law requires it.

Children

Louyia is not directed at children. Do not use Louyia or create an account if you are under 13, or under the minimum age required to consent in your country if that age is higher. Louyia does not knowingly collect information from children. If you believe a child has created an account, email us at help.louyia@gmail.com and we will remove it.

Where information is processed

The providers listed above operate internationally. Your information may therefore be stored and processed in a country other than the one you live in, including the United States. Wherever it is processed, this policy applies to it.

Your choices

Inside the app you can change your display name and your business details at any time, turn notifications on or off, and delete your account entirely.

Depending on where you live, you may also have the right to ask for a copy of the information Louyia holds about you, to have it corrected, or to object to a particular use of it. Email help.louyia@gmail.com and we will do our best to help. We may need to confirm that you control the account before we act on a request, so that nobody can make a request about somebody else’s account.

Changes to this policy

When what Louyia does changes, this policy changes with it, and the date at the top is updated. If a change is significant, we will make it clear in the app rather than relying on you to re-read this page.

Contact us

Questions about this policy, or about the information Louyia holds about you, can be sent to us by email.