Note for the Loyalito team: replace the generic hosting, database and email rows with your actual named vendors and their legal entities before launch, and review this list whenever you add a dependency that touches customer data.
Loyalito acts as a processor for your loyalty members’ data, and the companies below act as sub-processors to us. Each is bound by a written agreement with confidentiality and security obligations, and transfers outside the EEA are covered by Standard Contractual Clauses.
| Sub-processor | What it does | Data involved | Location |
|---|---|---|---|
| Hosting & application platform | Runs the Loyalito web application and serves the dashboard and public pages. | All service data in transit; request logs | EU region |
| Managed PostgreSQL database | Stores business accounts, loyalty members, visits and campaign history. | All stored service data | EU region |
| Stripe | Subscription billing and payment processing for business accounts. | Business billing contact and payment details. We never receive full card numbers. | EU / US under SCCs |
| Apple (Wallet / APNs) | Issues and updates Apple Wallet passes and delivers pass notifications. | Pass content and device registration tokens | Apple infrastructure |
| Google (Wallet) | Issues and updates Google Wallet passes. | Pass content and object identifiers | Google infrastructure |
| Firebase Cloud Messaging | Delivers web push notifications to customers who enabled them. | Push tokens and message content | Google infrastructure |
| Email delivery provider | Sends transactional email such as password resets, and campaign email where enabled. | Recipient email address and message content | EU / US under SCCs |
| Mailchimp (optional) | Only if you connect it: syncs consented loyalty members to your own audience. | Member name, email and consent status | US under SCCs |
Changes to this list
We will update this page before a new sub-processor begins handling customer data. If you would like advance notice by email, ask us and we will add you to the list.
What is not on this list
We do not use advertising networks, data brokers or analytics providers, so none appear here. See the cookie policy for the detail.
Related
The data processing agreement sets out the terms under which we process data on your behalf, and the privacy notice covers the rest.