Privacy Policy

Last updated: 25 October 2026

loyalty101 lets local venues — cafés, salons, studios — issue loyalty cards that live in Apple Wallet and Google Wallet, record visits and reward guests who come back. This page explains what happens to the data behind those cards, in plain language. Questions: turmetsmakoev25@gmail.com.

Who is responsible for what

The venue you joined. It is their loyalty programme: they decide what to reward, what to ask you for and what to send you. For your data as a guest, the venue is the controller.

loyalty101 is the machinery behind it. The service is run by Turmets. We process guest data on the venue's instructions and never for our own purposes — we do not build profiles across venues, we do not sell data and we run no advertising. We are not operating through a registered company at the moment; when that changes, its details will appear here.

For the accounts of venue owners and staff — the people who sign in to the dashboard or scan cards at the counter — we are the controller ourselves.

In practice: if you want your data deleted, write to the venue or to us, and it gets passed to whoever needs to act on it.

What we collect from guests

If you join through a venue's Telegram bot: your Telegram account ID, the first and last name shown on your Telegram profile, your @username if you have one, and the interface language your app reports — we use it to pick the language the bot answers in. You can also sign in with Telegram on a venue's web page, where the venue has switched this on: that venue's bot asks you to confirm, and once you press "Yes" on its question, that browser is signed in to your Telegram account for that venue only — it can see your card there and show it at the counter, and nothing at other venues. Signing in this way creates no card and links nothing to an email.

If you join through the web form: your email address, which we confirm by sending a one-time code to it — the address is how you sign in and get your card back later; the name you type; and the language you picked on that page, which we keep with your record. Your phone number only if you choose to give it: we do not confirm it, and it never signs you in. If you once got a card from the form under your phone number, typing that number lets you move your cards from the form, at every venue where you have one, to your email; a staff member then gives you a short code to confirm you are at the venue, and we record who gave it and when. To stop anyone from testing which numbers have a card, we count how many numbers you check in a day.

If you get your card through WhatsApp: the identifier WhatsApp gives our business for your account — it is not your phone number — your phone number in international format if WhatsApp passes it on (with a WhatsApp username you can keep it hidden, and then it usually does not reach us), and, if we do not have your name yet, the one on your WhatsApp profile. WhatsApp does not tell us your language, so we take it from the greeting you send: it ends in a short tag such as [dora·sr] that names the venue and the language of the greeting, and we keep that language with your record. We read your message only to find what you are asking for — that tag, a button you tapped, STOP or START — and do not store its text. We keep the message's identifier instead, so that a message WhatsApp delivers twice is handled once; identifiers older than eight days are cleared out as new messages arrive.

If you answer the WhatsApp question about a venue's news: your answer, which venue it was for, when you gave it and which wording of the question you saw — and, if you later take a yes back, when you did. If you send STOP, we also note a refusal against each of your cards, with the time: that is how we know not to ask you again. If you later send START, we note that against your cards too.

If the venue has its own privacy notice: on the web form you tick that you have read it before the card is issued, and we keep which version of the notice you confirmed and when, together with your card at that venue — the record goes when the card does. In the venue's Telegram bot, a link to the notice comes with your first card there.

We do not ask for a date of birth or a home address, and we ask for an email address only on the web form, to sign you in. Telegram is kept apart on purpose: joining a venue once through Telegram and once by email or WhatsApp creates two memberships, and we do not link them into one person. The web form and WhatsApp can meet on your phone number: if you gave your number on the form and WhatsApp passes the same number on, it leads to the same card as the form, whichever of the two you used first. If WhatsApp does not pass your number on, we cannot tell that both are you, so a card from the form and a card from WhatsApp stay separate. Should your number reach us later, it joins your WhatsApp card only if it is not already tied to a different one; two balances are never merged.

If you show your card by tapping a tag at the counter: where the venue has switched this on, the tag opens a page that knows only the venue and the counter. Once you are signed in and press the button, we record a request: which venue and counter it was for, your card there, a keyed fingerprint of your browser's sign-in session — not the session itself — so that only your browser can follow it, a random key your page makes for each press of the button, so that asking again after a lost answer finds the same request instead of making a second one, when you made it, the message the venue's bot sent to the cashier on duty, and how it ended and when: waiting, turned away by the cashier, timed out, not delivered or done. When the cashier records a loyalty operation from your request — choosing it in the venue's bot and confirming it — the request also keeps that operation and its result: the action, the amount the cashier entered for it, the points paid and earned, and your balance after it; the page shows you that result while your sign-in lasts. The cashier sees your name and your balance; the page shows your card and that result, and never your card's QR code.

As you use the card: your balance at that venue, every stamp, point or reward recorded against it, when it happened and which staff member recorded it.

To keep the card working: the card's serial number, the token your phone presents to fetch updates for it, and — once you add it to a phone wallet — what we need to reach that card again when your balance changes: on Apple, the identifier your phone registers with us; on Google, the fact that the card was saved.

If the venue sends a message: whom it went to and whether it reached you, failed, or was refused — for a Telegram message, because you blocked the bot; for a wallet notification, because the card is no longer registered on the phone; for a WhatsApp message, the identifier Meta gives it, whether it was delivered and read, and the reason Meta gives if it was not delivered. We keep this so that nobody gets the same message twice and the limits on how often a venue may write can be kept.

What we collect from venue owners and staff

For owners and managers who sign in to the dashboard: the email address used to sign in, the name recorded with that account, and a session record so the browser stays signed in. For staff who record visits at the counter: the name, the Telegram username and the Telegram account ID of the account the venue authorised, the job label and access status the venue gave it, and a record of the loyalty operations they perform.

Technical data

To keep the service from being abused we count requests per IP address on the public paths — joining a programme, issuing a card, signing in, fetching a venue's images, and the diagnostic reports a phone sends about a card. These counters live in the memory of the running server, never reach our database and disappear when it restarts. One exception keeps the email sign-in from being used up by a single sender: with each sign-in code we store a keyed fingerprint of the network address it was requested from — not the address itself — and delete it together with the code. IPv6 addresses are shortened to the network part before they are counted.

Separately, the hosting platform keeps a request log of its own, which records the caller's IP address in the ordinary way any web server does. Our own application logs record errors and notable events rather than every request, and they never contain the contents of your card. Where we write a phone number, an email address or a WhatsApp identifier, we mask it, and a sign-in code is never written down. Most of our log lines shorten a card's serial number, but not all of them: diagnostic reports an iPhone sends us are stored as the phone worded them, trimmed in length, and some operational tooling records a serial in full.

Why, and on what basis

Messages from the venue

A venue can reach you in three different ways, and they are worth telling apart.

In Telegram, if that is how you joined: a new offer, a reminder, an announcement, arriving in the same chat as your card. You can stop these by blocking the bot, which also ends your own conversation with it — you would no longer be able to ask it for your card or your balance.

On the card itself, as a wallet notification: a short line pushed to the card in your phone's wallet, which your phone may show on the lock screen. This one does not go through Telegram at all, so it reaches guests who joined by phone number as well, and blocking the bot does not stop it. What stops it is removing the card from your wallet, or turning off notifications for it in your phone's settings.

Neither of these two has a separate switch for offers only — we would rather say so plainly than describe a button that does not exist. Whichever route you use to stop the messages, the stamps you have earned stay where they are.

On WhatsApp, if you got your card there, it works the other way round: a venue's news reaches you only after you have said yes to that venue, and every news message carries a button that stops that venue's news. The news comes from our shared WhatsApp number, with the venue's name in the message. A venue sends you no more than four news messages in 30 days, all venues together no more than eight, and none between 21:00 and 9:00 in the venue's time. Right after the card we ask, separately for each venue, whether you want that venue's news on WhatsApp, and once you have answered we do not ask again. Saying no does not affect your card. Sending STOP to the same chat takes back every yes at once and stops the question too, for every venue, including ones you join later. Turning off marketing messages from us in WhatsApp's own settings works the same way as sending STOP. To have the questions back, send START: we then ask about each of your venues again, and only your yes to a question brings that venue's news back — the earlier yeses do not return by themselves. A yes under an earlier question works as well. If no card is tied to your WhatsApp yet, STOP has nothing to switch off: we tell you so, and your first card there still comes with the question.

Venues do not see each other's guests

Every card, balance and visit belongs to one venue. A venue sees only its own guests and their history with it. If you carry cards from three venues on this platform, none of the three learns anything about the other two.

Who else sees it

The venue you joined sees your name, the identifier you joined with, your balance and your visit history with it.

To run the platform we use providers who process data on our behalf:

Our public website loads its typefaces from Google's font service, which means Google sees the IP address of anyone opening these pages. No other third party runs on this site: we use no analytics, no advertising and no tracking pixels.

We do not sell personal data and we do not hand it to anyone for advertising.

Where the data lives

On servers in the European Union — Google Cloud, region europe-west1 in Belgium — in an encrypted database. The certificates that sign the wallet cards are stored encrypted with a key we hold separately.

For guests in Serbia: EU member states are on the list of countries recognised by the Serbian government as providing an adequate level of protection, so this transfer needs no separate consent from you. Apple, Google and Telegram may process the card or the chat outside the EU, under their own terms. Meta processes WhatsApp messages in the United States as well, relying on its own safeguards for that transfer.

How long we keep it

For as long as you are a member of that venue's programme. Ask for deletion and we delete without delay, and in any case within 30 days.

The record of your answers to the WhatsApp question lives and goes with your card at that venue: it is kept while you are a member, including a yes you later took back, and deleted together with the card.

If a venue stops using loyalty101, we delete its guest data within 30 days of the programme ending. Until then the cards are frozen rather than erased, so that a venue coming back does not cost its guests the stamps they earned.

A sign-in code and the count of numbers you checked are kept for 48 hours after they are made. After that they count for nothing and are deleted: a code the next time anyone asks for a sign-in code, a check the next time anyone checks a number. A Telegram sign-in attempt, with your Telegram account ID once you confirm it, stops working 5 minutes after it is started and is deleted the next time anyone starts a Telegram sign-in once it has been expired for an hour. A guest sign-in session ends 180 days after you last used it, or at once when you sign out. A request you make by tapping a tag at the counter counts for 90 seconds at most and is deleted the next time anyone makes such a request once it is more than 7 days old. The operation recorded in a request and its result are kept in the request for those 7 days and deleted with it; the operation itself stays in your card's history like any other. The random key your page made for a request is deleted with the request.

Aggregated counts that no longer point at any person — how many visits a venue had in a month — may be kept as statistics.

Your rights

You have the right to know what we hold about you and get a copy of it, to correct anything wrong, to have it deleted, to restrict or object to the processing, to take your data elsewhere, and to withdraw consent at any time without giving a reason — for a venue's news on WhatsApp, sending STOP is enough, and it withdraws your yes for every venue at once.

Write to the venue or to turmetsmakoev25@gmail.com. We answer within 30 days.

If you think something is wrong, you can complain to a supervisory authority. In Serbia that is the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, office@poverenik.rs. In the EU or EEA, it is the authority of the country you live in.

Children

loyalty101 is not meant for children. If we learn that someone under 15 joined a programme without a parent's consent, we delete the record.

How we protect it

Traffic runs over HTTPS. The database is encrypted at rest, and the certificates that sign wallet cards are encrypted a second time with a key that is never stored beside them. Staff access is scoped to the single venue that authorised it, and no venue can reach another venue's data. No system is perfectly secure, and we do not claim otherwise — but that is the standard we hold ourselves to.

Cookies and what your browser stores

The dashboard sets one cookie when a venue owner signs in. It holds a session token, nothing else, is marked HttpOnly, Secure and SameSite=Lax, and expires after 30 days or when you sign out. It is strictly necessary to keep you signed in.

When you sign in by email on the page where guests join, we set two cookies: a short one that ties the emailed code to this browser for 10 minutes, and a session cookie that keeps you signed in for up to 180 days after you last used it. Both hold a random token and nothing else, are marked HttpOnly, Secure and SameSite=Strict, and are sent only to our sign-in addresses. They are strictly necessary to sign you in; signing out removes them. Signing in with Telegram works the same way: a short cookie ties the sign-in you confirm in the bot to this browser for 5 minutes, and then the same session cookie is set. The bot's "Sign out everywhere" button ends every browser session of your Telegram account at once.

The page where guests join keeps the language you picked in your browser's local storage, so the page opens in it next time. That copy stays on your device; the choice itself is sent with the form when you join and is kept with your record. The card page that WhatsApp links to reads and keeps the same choice, and sends it nowhere. The page you open by tapping a tag reads and keeps it too, and sends it only when you ask to sign in, so that a sign-in email comes in that language; it is not kept with your record. That page uses the same session cookie as signing in, and sets none of its own. While a request you make there is under way, it keeps the request's random key in the tab's session storage and, once our server has named the request, the request's identifier with it, so that checking again, even after a reload, asks about the same request; both are removed once the page has shown how the request ended, and are gone when the tab is closed.

We set no analytics, advertising or tracking cookies, and there is nothing here for a consent banner to ask about.

Changes to this policy

If we change this page, we change the date at the top. If a change is significant — a new purpose, a new provider — we tell the venues, and they can tell their guests.

Contact

Questions about privacy, or a request about your data: turmetsmakoev25@gmail.com