Privacy Policy

1. Who We Are

SmileSpeed Loyalty is developed and operated as a standalone product. We build loyalty tools that help merchants run a unified rewards program across their online store and physical retail locations.

If you have any questions about this policy, contact us at: hi@smilespeed.app

2. Data We Collect

We collect the following data to operate the loyalty program:

• Customer email address — used as the unique identifier for loyalty accounts
• Customer first and last name — displayed in the merchant dashboard and loyalty widget
• Order details — order ID, total amount, and timestamp — used to calculate and award loyalty points
• Points balance and transaction history — records of points earned, redeemed, and adjusted
• Shopify customer ID — used to link Shopify orders to loyalty accounts
• Lightspeed customer ID — used to link Lightspeed POS sales to loyalty accounts

We do not collect payment card numbers, passwords, government IDs, or any sensitive financial data.

3. How We Use This Data

Customer data is used exclusively to operate the loyalty program:

• Awarding points when customers place orders on Shopify or make purchases at Lightspeed POS
• Displaying points balance and transaction history to customers in the loyalty widget
• Enabling merchants to view member lists and adjust points balances
• Generating discount codes when customers redeem their points
• Syncing loyalty data between Shopify and Lightspeed POS

We do not sell, rent, or share customer data with third parties for marketing purposes.

4. Data Storage and Security

All data is stored in a PostgreSQL database hosted on Supabase (AWS eu-west-1 region). Access credentials are encrypted using AES-256-GCM encryption before being stored.

5. Data Sharing

We share data with the following sub-processors, solely to operate the service:

• Supabase Inc. — database hosting (AWS eu-west-1)
• Railway Corp. — application server hosting
• Shopify Inc. — platform that provides the merchant and order data
• Lightspeed Commerce Inc. — POS platform that provides in-store sales data

No customer data is shared with advertising networks, analytics platforms, or any other third parties.

6. Merchant Data (Store Owners)

When merchants install SmileSpeed Loyalty, we store their Shopify store domain, Lightspeed OAuth tokens (encrypted), and loyalty program configuration. This data is required for the app to function and is never used for any other purpose.

Lightspeed access tokens are encrypted with AES-256-GCM and stored only as ciphertext. Plain-text tokens are never logged or stored.

7. Data Retention

Customer loyalty data (email, points balance, transaction history) is retained as long as the merchant has the app installed. When a merchant uninstalls the app, their Shopify sessions are deleted immediately. Loyalty data is retained for 30 days after uninstall to allow for reinstallation, then permanently deleted.

Merchants can request immediate deletion of all data by contacting us at hi@smilespeed.app.

8. Customer Rights (GDPR / CCPA)

Customers of merchants using SmileSpeed Loyalty have the following rights:

• Access — request a copy of your loyalty data
• Correction — request correction of inaccurate data
• Deletion — request deletion of your loyalty account and all associated data
• Portability — request your data in a machine-readable format
• Opt-out — ask the merchant to remove you from the loyalty program

To exercise these rights, contact the merchant directly or email us at hi@smilespeed.app with your request. We will respond within 30 days.

9. Cookies and Tracking

SmileSpeed Loyalty does not use cookies or any tracking technologies on merchant storefronts. The loyalty widget embedded in storefronts does not set cookies, does not track browsing behavior, and does not use analytics or advertising scripts.

10. Children's Privacy

SmileSpeed Loyalty is a business tool for merchants and is not directed at individuals under the age of 16. We do not knowingly collect data from minors.

11. Changes to This Policy

We may update this privacy policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of the app after changes constitutes acceptance of the updated policy. For significant changes, we will notify merchants via the Shopify admin.

12. Contact

For any privacy-related questions, data requests, or concerns: