Privacy

About you and your team: name, email, a scrambled copy of your password (we can’t read it), and when you logged in. Failed logins are kept for one day, as scrambled codes, to stop password guessing.

About your shop’s orders: order number, date, amount, status, products, delivery area, how the order arrived (for example Instagram or Google), whether a coupon was used, an occasion label such as “birthday”, and scrambled IDs for the phone number, email and company name. The scrambling key is created on your website and never leaves it.

What your team does in Loyalbase: which customers were marked as contacted, when, and from which list, so Results can show who came back. Customers are identified only by a Loyalbase number (like “Customer 10234”).

Marketing numbers, if you connect them: totals from Meta (ad spend, reach, clicks and purchases Meta reports for your ad accounts, and reach, likes and comment counts on your Facebook Page and Instagram posts) and Google Analytics (visits by channel and checkout steps). No customer details are part of these, and we only read: Loyalbase never posts, changes ads or spends money on your accounts.

Meta access key: when you connect Facebook and Instagram, Meta gives Loyalbase an access key for the Pages, Instagram accounts and ad accounts you pick. It is stored encrypted and used only to read the numbers above. Press Disconnect on the Marketing page and the key is deleted straight away. You can also remove Loyalbase in your Facebook settings under Business integrations.

Customer names, phone numbers, email addresses, delivery addresses, cake or card wording, and payment details. These stay on your website and only ever travel between your website and your own browser.

When you open a list or a customer, Loyalbase gives your browser a pass that lasts 5 minutes. Your browser shows that pass to your website, and your website sends the names and numbers back to your browser only. They aren’t sent to Loyalbase’s servers and aren’t saved there. Each lookup is listed on the Loyalbase page in your WordPress, so you can see who looked at what.

The app and its database run in Singapore (Vercel and Supabase). Everything travels encrypted, and the secret your website uses to talk to Loyalbase is stored encrypted.

Only the people you invite to your shop can see its numbers. We look at a shop’s data only to fix a problem you’ve asked us about.

If the weekly plan is switched on, Loyalbase sends your shop’s totals (for example “120 regulars, 34 late, sales up 8%”) to Anthropic’s Claude to write the plan. No names, phone numbers, emails, order numbers or customer numbers are sent.

When a shop asks “How was your order?”, the customer’s score and any note they choose to write are kept with their customer number and order, never their name. People who scan a shop’s QR code to give feedback stay anonymous. The “Join on WhatsApp” QR code just opens a chat with the shop: Loyalbase stores nothing about who scanned it, only how many times it was opened.

If a shop connects its Google Business Profile, Loyalbase reads its reviews (the star rating, the words, the date and the shop’s reply) to show them in one place and suggest replies. Reviewers’ names and photos are not kept. Loyalbase only posts a reply when the shop owner presses Post. When a reply is drafted with AI, the review’s words and rating are sent to Anthropic’s Claude to write it. Disconnecting Google deletes Loyalbase’s access straight away.

When you ask a question on the Ask page, your question and the totals needed to answer it (for example sales by month, best-selling products, delivery areas, or “34 people matched”) are sent to Anthropic’s Claude. Customer names, phone numbers, emails, order numbers and customer numbers are never sent. When an answer lists customers, the list goes straight to your screen and the names come from your website, as everywhere else in Loyalbase. Questions and answers aren’t saved.

Delete your shop: owners can delete their shop in Settings → Delete this shop. Everything Loyalbase holds about it (orders, customers, results, marketing numbers, team access) is removed straight away, and from our backups within 30 days.

Disconnect only: in WordPress, open Loyalbase and press Disconnect. Nothing more is sent, and your numbers stay in Loyalbase in case you reconnect. Deleting the plugin from WordPress also deletes the scrambling key, so the scrambled IDs can never be matched again.

If one of your customers asks to be deleted: their personal details are on your website, so delete them in WooCommerce. Then tell us the order numbers and we’ll remove those orders from Loyalbase too.

Your own account: ask us and we’ll delete it.

Questions or requests: contact the person who set up your Loyalbase account, and they’ll pass it to us. If we change this page in a way that matters, we’ll tell shop owners in the app first.

See also our terms of service.