Privacy
Last updated 13 August 2026
Reward Regulars runs digital loyalty cards for businesses. This page covers both sides of that: what we hold about a business that signs up, and what we hold about their customers.
Who holds what
When a business uses Reward Regulars, the business decides what its loyalty card offers and who its customers are. We store and process that information on the business’s behalf. If you are a customer of a shop using our cards and you want your details removed, you can ask us directly using the address at the bottom of this page, and we will act on it whether or not the shop asks us to.
If you are a business
We collect and store:
- your business name, your email address and a hashed version of your password
- your business address, which we use to work out the timezone your figures are reported in
- anything you choose to put on your card: your logo, your photos, your colours, your social handles and the wording of your offer
- the names and PINs of staff you add, with PINs stored hashed and never shown again
Passwords and staff PINs are stored using scrypt with a per-secret salt. We cannot read them and neither can anyone who obtains a copy of our database.
If you are a customer of a business using our cards
We collect only what the card needs to work:
- Your first name and email address, if you choose to add them. Your card works without either. They exist so your stamps can be found again if you change phone.
- The day and month of your birthday, if you add it, so a business can offer you something. We do not ask for and cannot store the year. That is a deliberate choice: a name, an email address and a full date of birth together are a materially worse thing to lose than the day and month alone.
- A random identifier in a cookie, so your phone can find its own card again. It is not linked to anything outside this service.
- Your stamps: when each was given, at which business, and which item it was for if that business prices items differently.
We do not ask for your phone number, your address, your date of birth or any payment details. There are no advertising or analytics trackers on your card. Nothing about your visits is sent to any third party.
What a business can see about its own customers
A business sees the first names, email addresses and stamp history of people who have used a card at that business, and totals such as how many customers came in on a given day. A business cannot see anyone who has not used a card with them, and cannot see any other business’s customers. That separation is enforced in the software, not by policy.
Marketing
Agreeing to hear from a business is a separate, unticked choice, made per business, and your card works exactly the same if you decline. We record the exact wording you were shown at the time you agreed. If you do agree, that permission applies only to the business you gave it to.
Who else gets your information
Our servers are in Sydney, Australia, run by DigitalOcean. Traffic to the site passes through Cloudflare. Email is sent by Resend, from their Tokyo region, which means your email address and the contents of a message we send you pass through their systems. We do not sell personal information, and we do not share it with anyone for their own purposes.
How long we keep it
For as long as the business uses the service, and for a reasonable period afterwards so a business that returns has not lost its customers’ cards. If you ask us to delete your information, we do that regardless of how recent it is.
Getting your information, or having it deleted
Email [email protected] and tell us what you want. We will confirm who you are before acting, so that nobody else can request your details. You can ask for a copy of what we hold, ask us to correct it, or ask us to delete it.
Changes
If we change how any of this works, we will change this page and update the date at the top. If a change materially affects what we do with your information, we will tell affected businesses directly.
Reward Regulars, New South Wales, Australia. [email protected]