Privacy

What we do with what you send us

Last updated 26 August 2026

Draft — two facts still missing. This notice describes accurately what the site and the demo form actually do, but it cannot yet name the legal entity behind loyalz.io and the address that answers data requests. Until those are filled in it should not be treated as the published notice. Set NEEDS_OWNER in build_legal.py and this banner disappears.

This notice covers loyalz.io and the demo request form on it. It is written against what the site actually does rather than against a template, so where it names a retention period or a processor, that is the one in the code.

Who is responsible

The controller of the data described here is [legal entity to be named]. Questions, and any of the requests listed under your rights, go to [contact address to be named].

What the form collects, and why

The demo form asks for five things and records a sixth. Nothing here is optional decoration: each field either identifies who to reply to, or decides whether a demo can show you anything useful.

What	Why	Legal basis
Name, company, company e-mail	To answer the enquiry and know who is asking.	Art. 6(1)(b) — steps taken at your request before a contract.
Company website (optional)	To look at the shop before the call, so the twenty minutes are not spent on questions we could have answered ourselves.	Art. 6(1)(b).
Average monthly ad spend, as a range	To judge whether a demo can show anything meaningful yet. Below roughly 5,000 EUR a month the numbers have not accumulated, and we would rather say so than take the meeting.	Art. 6(1)(b).
Consent tick, its exact wording, and when it was given	To be able to show what you agreed to, in the words you saw.	Art. 6(1)(c) — accountability under Art. 7(1).

Where we record that you came from

Loyalz is a product about knowing which advertisement brought a customer, so it would be a poor advertisement for itself if it could not tell you where its own enquiries come from. When you arrive from a link carrying campaign parameters, your browser stores that arrival locally on your device.

Two things are worth being plain about. First, none of it leaves your browser unless you submit the form — it sits in your own storage and is transmitted only with a submission you chose to make. Second, there are two records with two different lifetimes:

The path of this visit, in sessionStorage under lz_s — up to eight arrivals, so that a visit which began with a search ad and continued from a newsletter is not recorded as though only one of them happened. It is erased when you close the tab.
The first arrival, in localStorage under lz_ft, kept for 180 days — the campaign that introduced you, still known if you come back a month later and write to us then.

Neither record contains a name, an e-mail address, an account, or any identifier we could use to recognise you anywhere else.

The parameters recorded

utm_source, utm_medium, utm_campaign, utm_content, utm_term, utm_id, and the advertising click identifier a platform appends to its own links: gclid, gbraid, wbraid, srsltid, gad_source (Google), fbclid, igshid (Meta), ttclid (TikTok), msclkid (Microsoft), li_fat_id (LinkedIn), twclid (X), epik (Pinterest), rdt_cid (Reddit), sccid (Snapchat). A partner link may also carry ref, via, partner or aff in place of utm_source.

Alongside those: the page you landed on, the time, and — if you arrived from another site — the host of that site. The address you came from is reduced to its host name, and its path is kept only when it is not a search engine. The query string of the referring page is never stored, because that is where other people's personal data arrives uninvited.

Clearing your browser storage removes all of it. It is not used to build a profile, is not shared with advertising networks, and is not read by anything other than this form.

The legal basis is Art. 6(1)(f) — our legitimate interest in knowing which of our own campaigns produced an enquiry. If you would rather it were not recorded, clearing site data before submitting removes it, and the form works exactly the same without it.

What is recorded to stop abuse

A public form is a target. When a submission is received we store a one-way hash of the IP address (never the address itself) and the browser's user-agent string, to rate-limit and to recognise floods. Basis: Art. 6(1)(f), our interest in the service staying available.

The reply is read by a model

Enquiries are summarised and prioritised with an AI model before a person reads them, so that a serious enquiry is not left waiting behind an automated one. This is a sorting aid and not an automated decision within the meaning of Art. 22: a person reads every enquiry and decides what happens next. The content is not used to train any model.

Who processes it on our behalf

Processor	What for	Where
Supabase	The database the enquiry is stored in	EU — Frankfurt
Vercel	Hosting and the function that receives the form	EU — Frankfurt
Anthropic	Summarising and prioritising the enquiry	Outside the EEA, under Standard Contractual Clauses
Mailgun	Sending the notification to us	EU — the provider's European region
Cloudflare	The Turnstile check that separates people from bots	Global network

How long it is kept

The enquiry — 24 months from submission, then deleted.
Click identifiers, IP hash and user agent — 12 months, then removed from the row while the enquiry itself remains.
Counts of refused submissions (a failed bot check, a rate limit) — 14 days. These hold no enquiry, only the reason and a hashed address.
A submission identified as automated — kept as a row for 180 days rather than deleted at once, so that a genuine enquiry misfiled as automated can still be found and answered.
The record on your own device — the visit path until you close the tab, the first arrival for 180 days, or until you clear your browser storage.

Your rights

You can ask for a copy of what is held, ask for it to be corrected or deleted, ask that processing be restricted, object to the processing based on legitimate interest, and ask for your data in a portable form. Write to [contact address to be named] and we will answer within one month. You can also complain to a supervisory authority — in Poland, the President of the Personal Data Protection Office.

Cookies

This site sets no advertising or analytics cookies. The only thing it stores on your device is the first-touch record described above, in local storage rather than a cookie, and the Turnstile check may set a short-lived token while it decides whether you are a person.