Loyal Loop
Log in

Privacy Policy

Your data should never feel mysterious.

This policy explains what Loyal Loop collects, why we use it, who receives it, and the choices available to customers, business owners, staff, and Founding Circle participants.

Effective 13 August 2026

1. Who we are and what this policy covers

“Loyal Loop”, “we”, and “us” refer to the operator of the Loyal Loop service. This Policy applies to our websites, business workspaces, public shops, Explore surfaces, order requests, digital receipts, delivery pages, Trust Cards, private tests, support, and related services.

Loyal Loop is operated by Loyal Loop Technologies Limited, a private company limited by shares incorporated in Nigeria with company registration number 9766170. Our service address is 16 Adebare Street, Ogudu, Lagos, Nigeria. Privacy questions and legal notices can be sent to privacy@useloyalloop.com and legal@useloyalloop.com.

For account, platform-security, product-improvement, and direct customer-account activities, Loyal Loop determines why and how the relevant personal data is processed. A business also determines why it records and uses information about its customers. Depending on the activity, that business may have its own obligations as a data controller while Loyal Loop processes information to provide the service.

2. Information we collect

  • Account information: name, email address, phone number, password hash, profile image, verification state, sessions, and security events.
  • Business information: business name, category, description, location, public contacts, social links, logo, team roles, preferences, plan, and setup status.
  • Commerce information: products, Showcases, customer records supplied by a business, order requests, sales, receipts, payment statuses recorded by a business, proof of payment, delivery details, feedback, issues, and support requests.
  • Customer-account information: contact information, saved shops and products, cart, order history, delivery addresses, preferences, and communication choices.
  • Messaging information: the phone number used for verification or an opted-in message, the message purpose and template, consent and opt-out evidence, provider message identifiers, delivery status, failure details, and support or opt-out text you send to our WhatsApp number.
  • Media: product photos or videos, logos, avatars, and other files you choose to upload.
  • Usage and device information: interactions with eligible pages and features, timestamps, referral or campaign parameters we allow, approximate device/browser information, session identifiers, and security logs.
  • Founding Circle information: invitation and cohort, onboarding progress, feature usage, feedback, interview notes, future-offer interest, any price a participant volunteers without prompting, and paid-pilot interest.
  • Location and address information: locations or addresses you type, select, save, or provide for a business, order, or delivery.

We do not scrape a person's private social profile or contact list to build customer memory.

3. How we receive information

We receive personal data:

  • directly from you when you create an account, submit a request, contact support, or provide feedback;
  • from a business when it records a customer, sale, receipt, delivery, or support matter;
  • automatically from your browser or device when needed for sessions, security, reliability, and bounded product analytics; and
  • from service providers when they return delivery, messaging, media, map, authentication, verification, or payment status.

4. Why we use information

We use personal data to:

  • create accounts and business workspaces;
  • provide shops, discovery, customer memory, order, receipt, delivery, feedback, and support features;
  • authenticate users, prevent abuse, investigate incidents, and secure the service;
  • send requested service messages and honour communication preferences;
  • measure whether Founding Circle businesses activate, return, encounter problems, and see enough value to consider a future offer;
  • understand aggregate feature performance and improve Loyal Loop;
  • maintain records, resolve disputes, enforce our Terms, and meet legal obligations; and
  • provide payment or identity-verification features if they are later activated with appropriate notice.

5. Lawful bases

Depending on the context, we rely on performance of a contract, steps requested before entering a contract, consent, compliance with a legal obligation, or legitimate interests such as securing and improving the service, preventing fraud, and supporting users. Where we rely on consent, you may withdraw it without affecting processing that was lawful before withdrawal.

6. Businesses and customer information

A business must have a lawful reason to add or use customer information and must give any notice required by law. Its customer workspace is business-scoped. We do not expose one business's private customer notes or history to another business.

Customers may also provide information directly when they sign in, submit an order request, save an address, consent to updates, confirm delivery, report a problem, or leave feedback. We may connect that information to the relevant business and order so the requested journey works.

7. Public information and discovery

Business owners choose information to publish through shops, products, Showcases, Trust Cards, and share links. Customers should treat those areas as public and avoid submitting confidential information in a public field.

We may record bounded opens, saves, shares, follows, requests, purchases, and explicit interests to operate and improve discovery. We use signed or allow-listed attribution parameters where available and do not use social-profile scraping or unrestricted browser fingerprinting for this purpose.

8. Messages and communication choices

We may send essential security, account, request, receipt, delivery, and support messages. Starting a WhatsApp verification code request authorises that specific security message; it does not subscribe you to receipts, order updates, reminders, or marketing. Where Loyal Loop offers WhatsApp receipts, delivery updates, reminders, or other optional messages, we ask for the relevant purpose separately.

When WhatsApp messaging is enabled, Twilio and Meta Platforms, including WhatsApp, process the destination number, approved message template or content, and technical delivery information needed to send and secure the message. You can withdraw an optional choice in Loyal Loop or use the stated opt-out method, including replying STOP where supported. We keep the minimum suppression record needed to prevent further messages after an opt-out. We do not turn a security code, purchase, phone number, or support conversation into marketing permission.

9. Payments and identity verification

Most current payment statuses are records supplied by a business, not bank confirmation. If payment processing or Protected Payment is activated, a licensed payment provider may collect payment details and return transaction references, status, fees, refunds, disputes, and settlement information to Loyal Loop. The checkout and an updated notice will explain the live arrangement before payment.

If seller verification is activated, a vetted verification provider may collect or validate business registration, bank-account ownership, identity documents, BVN, NIN or vNIN, selfie/liveness, sanctions, or similar information with an appropriate lawful basis and notice. Our intended design is to use provider-hosted collection and retain the minimum result, masked reference, risk flag, and audit evidence needed rather than raw identity numbers or biometric templates.

10. Service providers and disclosures

We use selected providers for hosting, databases, media storage, email, maps and address suggestions, analytics, security, authentication, communications, customer support, and—if activated—identity verification and payments. They receive only the information reasonably needed to perform their service and are subject to contractual or legal safeguards appropriate to their role.

Current product integrations include Vercel for website delivery and bounded web analytics, Cloudinary for uploaded media, Resend for service email, Twilio and Meta Platforms (including WhatsApp) for WhatsApp messaging and verification when enabled, Google Places for address suggestions, and an optional Google Gemini integration for bounded product assistance. Loyal Loop also records first-party product events such as eligible views, saves, shares, requests, and purchases; the current product does not use those records as third-party advertising profiles.

We may also disclose information when required by law, to protect people or the service, to investigate fraud or abuse, or as part of a genuine financing, reorganisation, acquisition, or sale subject to appropriate safeguards. We do not sell personal data.

11. International transfers

Some providers may process information outside Nigeria. Where personal data is transferred internationally, we assess the transfer and use a lawful transfer mechanism or other safeguards required by applicable data-protection law.

12. Retention

During the Founding Circle pilot, business and customer records remain in the relevant business workspace until they are deleted through an available product control, the account is closed, or a verified deletion request is completed. An automatic one-year or three-year deletion schedule is not currently active. Short-lived verification codes, recovery links, invitation links, and sessions expire on the shorter periods described by their screens or security controls.

After an account closure or deletion request, we delete or anonymise information that is no longer needed, subject to transaction evidence, complaint records, legal holds, fraud-prevention records, suppression lists needed to respect opt-outs, backups, and mandatory tax or compliance retention. Closing an account does not always permit immediate deletion of every transaction or security record. Contact privacy@useloyalloop.com for the schedule that applies to a specific record.

13. Illustrative and demo content

A surface explicitly labelled as illustrative, preview, or demo content is not presented as a real customer, seller, order, payment, or endorsement. An authenticated production business workspace is scoped to that business and does not silently substitute seeded records when its real data is empty or unavailable.

14. Security

We use reasonable technical and organisational safeguards appropriate to the information and risk, including access controls, role permissions, protected credentials, session controls, logging, backups, and provider reviews. No internet service can guarantee absolute security. Please contact security@useloyalloop.com if you believe data or an account is at risk.

15. Your privacy rights

Subject to applicable law and relevant exceptions, you may ask to be informed about processing; access, correct, or receive a copy of your personal data; object to or restrict certain processing; request deletion; withdraw consent; or request human review of a decision based solely on automated processing that produces a legal or similarly significant effect.

Loyal Loop does not currently make solely automated decisions that produce legal or similarly significant effects for ordinary customers or businesses. Discovery ranking and product suggestions may be automated, but they do not determine a person's legal rights.

Send a request to privacy@useloyalloop.com or follow our data-deletion instructions. We may need to verify your identity and relationship to a business before acting. You may also lodge a complaint with the Nigeria Data Protection Commission.

16. Cookies and local device storage

Loyal Loop uses cookies and similar browser storage for authentication, security, cart and preference continuity, private-access gating, remembered routes, and service operation. Where optional analytics or advertising technologies require consent, we will provide the relevant choice before using them.

17. Children

Loyal Loop is not designed for a child to operate a business account independently. If a customer is a child, the business and responsible adult must ensure that the transaction and use of personal data are lawful and appropriate. Contact us if you believe a child has provided personal data improperly.

18. Changes and contact

We may update this Policy as the service, providers, or law changes. We will update the effective date and provide appropriate notice of material changes. Questions, objections, and privacy requests can be sent to privacy@useloyalloop.com.