Privacy Policy

01Who we are

Loop is operated by Saminu Hansaja Wickramasinghe, an individual based in Sri Lanka (“we”, “us”), at:

We are responsible (the data controller) for the information about people who use Loop to run a shop: owners, managers and staff, and their accounts.

The information about a shop's customers, the people who hold its stamp cards, belongs to that shop. The shop is its controller, and we process it for the shop, on its instructions, to run its stamp cards.

02What this policy covers

This policy covers everything that makes up Loop:

• This website, looployalty.lk
• The Loop dashboard at loop.tapace.lk, where owners and managers set up their shop
• The Loop app for iPhone and Android, which owners, managers and staff use to issue and stamp cards
• The sign-up and card pages that customers open to get a shop's card
• The stamp cards themselves, once they are in Apple Wallet or Google Wallet

Customers don't need to install anything or create an account. Information about customers explains what happens to their information.

03Information we collect from shops and staff

When you create a Loop account or use Loop for a shop, we collect:

• Account details: your name and email address, and your password, which we store only in a scrambled (hashed) form. If you sign in with Google or Apple, we receive your name, email address and an account ID from them. Apple may give us a private relay email address instead of your real one.
• Profile photo: if you choose to add one, from your camera or your photo library.
• Shop details: your shop's name, logo and country, its branches with their addresses and, if you add it, their map location, your stamp card designs, images and the messages you write for your customers.
• Team details: who belongs to which shop and their role, and the email addresses of people you invite.
• Activity: which team member issued, stamped or redeemed a card, at which branch and when. Your shop sees this history.
• Device and usage information: your IP address, device type, operating system, app or browser version, and the times you sign in and use Loop. We use these to keep you signed in, protect your account and fix problems.
• Messages to us: anything you send us when you ask for help.

When you choose a password, we check it against lists of passwords exposed in data breaches. Only a short fragment of an anonymous fingerprint of the password leaves our servers. Your password itself never does.

04Camera and photos in the app

The Loop app asks for camera access only when you first use a feature that needs it:

• Scanning cards: the camera reads the QR code on a customer's stamp card. The video is read on your phone and never stored or sent anywhere. Only the code it finds is sent to Loop to open that card.
• Profile photo: if you take a new photo, it is uploaded to Loop as your profile photo.

Choosing a profile photo from your library uses your phone's own photo picker. Loop sees only the photo you pick, not the rest of your library, and doesn't ask for photo library permission.

You can turn camera access off at any time in your phone's settings. You can still use the rest of the app and find customers' cards by phone number.

05Information about customers who hold a card

When a shop gives you a stamp card through Loop, or you sign up for one yourself from the shop's link, we process this information for the shop:

• Contact details: your phone number, and your name and email address if they are given. The phone number lets the shop find your card if you can't show it.
• Card details: your card number, how many stamps you have, rewards you have redeemed, and when and at which branch each stamp was given.
• Card delivery: when you open the link to get your card, we use your IP address and device type to deliver the card and offer the right wallet. If you ask for the card by email, we send the link to that address.
• Card updates: once your card is in Apple Wallet, your phone checks in with our servers to receive new stamps, using an anonymous device ID and a notification token from Apple. Google Wallet updates your card through Google.

A card can show a shop's branch locations so that your wallet can bring the card up when you are nearby. Your phone does this by itself. We never receive your location.

The shop decides what goes on its card and what messages it sends, and it can see your details and card history in its Loop dashboard. The shop is responsible for having a lawful reason to collect your details. Questions or requests about your information are best sent to the shop. You can also contact us, and we will pass them on and help the shop answer.

06How we use information

We use the information described above only to:

• Create and run accounts, shops and teams, and sign you in
• Create stamp cards, deliver them to Apple Wallet and Google Wallet, and keep them up to date
• Let shops issue, stamp and redeem cards and see their customers and history
• Send emails you need, such as sign-in codes, invitations and card links
• Answer your questions and requests
• Keep Loop secure, stop abuse and fraud, and fix problems
• Comply with the law

We do not sell personal information. We do not show ads, we do not track you across other companies' apps or websites, and we do not use analytics or advertising tools in the Loop app. We do not use customers' information for our own purposes or share it with other shops, and we do not send it to third-party AI services.

07Who we share information with

We share information only with:

• The shop: a shop's owners, managers and staff see the customers and cards of that shop. Team members see each other's names and roles.
• Service providers that run parts of Loop for us: cloud hosting and databases, file and image storage, email delivery, sign-in, security and bot protection, and the wallet pass service that creates and updates the cards.
• Apple and Google, to deliver cards to Apple Wallet and Google Wallet, to send card updates, and when you choose to sign in with Apple or Google.
• Authorities, when the law requires it, or to protect the rights and safety of people who use Loop.
• A successor, if Loop moves to a company we set up to run it, or to a buyer of the service. They would remain bound by this policy, and we would tell you.

Our service providers, and any company we own or set up to run Loop, may use the information only to provide their service to us, and must protect it at least as well as this policy does.

08Where information is stored

Our service providers, including Apple and Google, may store and process information outside Sri Lanka. When we transfer personal information abroad, we do so as permitted by Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and take reasonable steps to keep it protected.

09Cookies and storage on your device

The dashboard uses cookies to keep you signed in and secure. The app keeps your sign-in in your phone's secure storage, and remembers your chosen branch on your phone. This website remembers only whether you chose light or dark mode, in your browser's storage.

We do not use advertising or tracking cookies. You can clear cookies and storage in your browser or phone at any time; you will then need to sign in again.

10How long we keep information

• Your account: for as long as you have it. When you delete it, we delete it straight away (see Deleting your account).
• Shops: for as long as the shop exists. When the owner deletes their account, their shops, cards and customers are deleted with it, and the shop's cards stop working.
• Customers' information: for as long as the shop keeps it. A shop can delete a customer at any time, which removes their details and card history and stops their cards working.
• Backups: deleted information can stay in our backups for up to 14 days, until they are replaced.
• Security records: server logs are kept only as long as needed to keep Loop secure and fix problems.

We may keep information longer only where the law requires it, for example to resolve a dispute, and only for that purpose.

11Deleting your account

You can delete your Loop account and its data yourself at any time, in the app, on the web or by emailing support@looployalty.lk. Deleting it removes your profile, your shop memberships and every shop you own. Deleted information can stay in backups for up to 14 days.

The steps, and exactly what is deleted and kept, are on our Delete your account page.

12Your choices as a card holder

• Remove the card: delete it from Apple Wallet or Google Wallet at any time. It stops receiving updates and messages.
• Stop messages: turn off notifications for the card in your wallet's card settings.
• Turn off location: turn off location suggestions for the card in your wallet or phone settings.
• Delete your details: ask the shop to delete you as a customer. If you can't reach the shop, email us at support@looployalty.lk with the shop's name and your phone number, and we will arrange it with the shop.

13Your rights

Under Sri Lanka's Personal Data Protection Act, No. 9 of 2022, and depending on where you live, you may have the right to see, correct, export or delete your personal information, to object to how it is used, and to withdraw your consent at any time. Withdrawing consent doesn't affect what was done before.

You can see and change your name and photo in your account settings, and delete your account as described above. For anything else, email support@looployalty.lk. We may need to confirm who you are before we act. If the request is about a shop's customer information, we will work with that shop to answer it.

If you think we have not handled your information properly, you can complain to the Data Protection Authority of Sri Lanka, or to the data protection authority where you live.

14How we protect information

We protect information with encryption in transit and at rest, hashed passwords, access limited to the people who need it, and each shop's data kept apart from every other shop. No system is completely secure, so we cannot guarantee absolute security. If a breach affects your information, we will tell you and, where required, the authorities.

15Our commitments to shops

When we process customers' information for a shop, we:

• Use it only to provide Loop to that shop and on its instructions
• Keep it confidential and limit access to people who need it
• Protect it with the measures described above
• Tell the shop without undue delay if we become aware of a breach affecting it
• Help the shop answer its customers' requests
• Delete it when the shop deletes it or closes its account, as described in How long we keep information

16Children

Loop accounts are for people aged 16 or over. We do not knowingly create accounts for anyone younger. If you believe a child under 16 has given us information, contact us and we will delete it. Shops are responsible for following the law when they give stamp cards to young customers.

17Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new date and, if the changes are significant, tell account holders by email or in Loop before they take effect.

18Contact us

For questions about this policy or your information, email support@looployalty.lk, use our contact page, or write to: