KeepYa

Legal · KeepYa

Privacy Policy

Last updated: July 21, 2026

Plain-language summary

KeepYa is the technology behind the loyalty program of the business you signed up with. Your data belongs to the relationship between you and that business: the business decides what it is used for, and KeepYa processes it on their behalf to run the program.

We only send you program communications if you ticked the notifications box, and you can unsubscribe at any time from any email. We do not sell your data.

1.Who we are and each party's role

KeepYa (keepya.app) is a loyalty platform that lets businesses run points, stamps and rewards programs with digital cards for Apple Wallet and Google Wallet.

Two distinct roles are involved in processing personal data:

  • The business is the data controller for its customers' data. When you join a business's loyalty program, your data is part of the relationship between you and that business: they decide the program's purposes and are your first point of contact for any question about your data.
  • KeepYa acts as the data processor on the business's behalf: we store and process the data only to provide the service (issuing your digital card, recording points and visits, sending the program's communications) and following the business's instructions.
  • KeepYa is the controller only for business account data and for people who visit our website or contact us directly.

2.What data we collect

If you are a loyalty program customer

  • Sign-up data: first and last name, email address and, if the business asks for them, phone number and date of birth.
  • Program activity: points or stamps earned, visits recorded, rewards and coupons issued or redeemed, level reached and referral code.
  • Digital card data: technical identifiers needed to issue and update your pass in Apple Wallet or Google Wallet.
  • Consent record: the date you accepted the terms, and the date and origin of your decision about program notifications.
  • Email interaction: delivery, open, bounce and unsubscribe events for program emails, which we use to honour your preference and keep the list clean.

If you are a business or visit our site

  • Business account and billing data (name, email, company, plan).
  • Contact details you send us through the sales form.

We do not collect special categories of data (health, beliefs, biometrics) or customers' payment card details.

3.What we use your data for

  • Running the loyalty program: creating your customer profile, issuing your digital card, earning and redeeming points, stamps, rewards and coupons.
  • Operational messages: sending your digital card, confirmations and links you request. These are necessary to provide the service and do not depend on your notification preference.
  • Program communications (only with your consent): news, rewards, benefits, campaigns and automated messages from the business, by email or push notification on your digital card.
  • Metrics for the business: aggregated reports on program activity.
  • Security and compliance: preventing fraud and program abuse, and meeting legal obligations.

When you sign up, the program notifications box is optional and unticked by default. If you leave it unticked you can still take part in the program: you simply stop receiving promotional communications.

We record the date and origin of your decision as evidence of your consent.

You can change your mind at any time:

  • From the "Manage my notifications" link included in every program email.
  • By asking the business directly, which can update your preference from its dashboard.
  • By writing to hello@keepya.app.

If an email bounces or you mark a message as spam, we automatically stop sending to your address.

5.Apple Wallet and Google Wallet

Your loyalty card is stored in Apple Wallet or Google Wallet. For it to work, we share with Apple or Google the minimum data needed to issue and update the pass (pass identifier, the card's visible content and program status).

Apple's and Google's use of that data is governed by their own privacy policies. You can delete the pass from your wallet at any time; when you do, we stop sending updates to that device.

6.Who we share data with

  • The program's business: the controller of your data, who accesses it from its dashboard.
  • Infrastructure providers: server and database hosting.
  • Email provider (Resend): to deliver program emails and record delivery and unsubscribe events.
  • Apple and Google: to issue and update digital cards, as described above.
  • Authorities: only where a legal obligation requires it.

We do not sell or rent your personal data, and we do not share it with third parties for their own advertising.

7.How long we keep your data

We keep your data for as long as you take part in the business's loyalty program. If the business deletes your profile, or if you ask us to erase your data, we delete or anonymise it within a reasonable period, unless we must keep certain information to meet a legal obligation (for example, the business's billing records).

8.Your rights

Depending on the law that applies in your country (such as the GDPR in the European Union, Law 25.326 in Argentina, the LFPDPPP in Mexico or Law 1581 of 2012 in Colombia), you have the right to:

  • Access the data we hold about you.
  • Correct inaccurate or incomplete data.
  • Erase your data and leave the program.
  • Object to specific uses, such as promotional communications.
  • Port your data where the law provides for it.
  • Withdraw your consent at any time, without retroactive effect.

Because the business is the data controller, the most direct route is to exercise these rights with the business itself. You can also write to hello@keepya.app: we will pass your request to the business and give them the technical support needed to answer it.

If you believe your request was not handled properly, you can complain to your country's data protection authority.

9.Security

We apply appropriate technical and organisational measures: encrypted traffic (HTTPS/TLS), signed links for personal pages, access control by business and location, and event logging. No system is infallible, but we review our measures continuously.

10.International transfers

Our infrastructure and email providers may process data in countries other than yours (including the United States and the European Union). Where that happens, we rely on recognised safeguards, such as standard contractual clauses, and require providers to make equivalent protection commitments.

11.Minors

KeepYa loyalty programs are aimed at people who are of legal age in their country. We do not knowingly collect minors' data; if we find a minor's registration without valid authorisation, we will delete it.

12.Cookies

We use essential cookies only: those needed to keep your session, remember your language and protect forms (for example, against CSRF attacks). We do not use advertising or third-party tracking cookies on program pages.

13.Changes to this policy

If we change this policy materially, we will update the "last updated" date and, where the change affects how your data is processed, communicate it by a reasonable means (for example, a notice in a program email or on this page) before it takes effect.

14.Contact

For any privacy question you can write to hello@keepya.app. If your question is about a specific business's program, tell us which business so we can route it correctly.

You can also review our Terms & Conditions.