Privacy policy

Applies to the Loyco website. Last updated: 2026-10-14

1. Who is responsible

Loyco AS (org. nr. 816 202 612, Øvre Ole Bulls Plass 1, 5012 Bergen, Norway) is the data controller for the personal information described in this policy. It covers loyco.io and its subdomains, including the pricing wizard, the ROI calculator, our ebooks and the customer onboarding portal.

Hotels and retailers use the Loyco platform to run their own loyalty programs. When we process data about their members, we do so on their behalf as a data processor, under a data processing agreement. That processing is covered by the privacy policy of the hotel or retailer whose program you joined, not by this policy.

2. What we collect and why

We only collect what we need for the purposes below. Most of it you give us yourself when you fill in a form, use the pricing wizard or chat with us.

Contact, demo and ebook forms

What:
Name, email address, phone number, company, your message, and the page you sent the form from.
Why:
To answer your inquiry, book a demo, send you the material you asked for, and follow up.
Legal basis:
Our legitimate interest in responding to business inquiries, or steps you ask us to take before entering into an agreement.

Pricing wizard and ROI calculator

What:
Business type, business and program name, country, number of hotels, rooms or stores, the modules and integrations you pick, and the price estimate. If you enter contact details (name, email, phone), we store them with your session. Your progress is saved step by step under a random session ID.
Why:
To show you a price, prepare a quote or call when you ask for one, and understand where visitors stop in the wizard so we can improve it.
Legal basis:
Steps you ask us to take before entering into an agreement, and our legitimate interest in improving the wizard.

Meeting bookings and quote requests

What:
Name, email address, phone number, company details from the pricing wizard, and the time you book.
Why:
To hold the meeting and prepare an offer.
Legal basis:
Steps you ask us to take before entering into an agreement.

Orders

What:
Contact and company details, what you ordered, the price, and the time you accepted our terms.
Why:
To deliver the service, invoice you, and get you started.
Legal basis:
Performance of a contract, and our legal obligations under bookkeeping law.

Newsletter

What:
Your email address and your consent.
Why:
To send you our newsletter. Every newsletter has an unsubscribe link.
Legal basis:
Your consent, which you can withdraw at any time.

Live chat

What:
Your messages and anything you choose to share in the chat.
Why:
To answer your questions.
Legal basis:
Our legitimate interest in responding to inquiries.

Business website lookup

What:
The website address you type into the first step of the pricing and onboarding wizards. We fetch that public web page and use an AI model to suggest your company name, industry, country and brand color. We do not send your name or contact details to the AI model.
Why:
To fill in the wizard for you so you do not have to type everything.
Legal basis:
Our legitimate interest in offering an easy sign-up process.

Customer onboarding

What:
Your email address (to send you a sign-in link), business and loyalty program details, and the logos and images you upload.
Why:
To set up your loyalty program on the Loyco platform.
Legal basis:
Performance of a contract, or steps you ask us to take before entering into one.

Website usage

What:
IP address, device and browser type, pages viewed, clicks, referring site and approximate location, collected through cookies and similar technologies (see section 4).
Why:
To keep the website secure and working, measure and improve it, and measure and target our advertising.
Legal basis:
Strictly necessary storage needs no consent. Analytics and advertising cookies rely on your consent.

If you send a job application to our careers address, we use it only to assess your application.

3. Who we share it with

We do not sell personal information. We use the service providers below to run the website and our sales process. They process data on our behalf and under our instructions, except Google and Meta, which also use advertising data for their own purposes as described in their own privacy policies.

  • Vercel: Website hosting. Servers in Frankfurt, Germany.
  • Supabase: Database and file storage. Servers in Zurich, Switzerland.
  • HubSpot: CRM, website forms, live chat, newsletter, cookie banner and website analytics.
  • Resend: Sending transactional emails, such as sign-in links and order confirmations.
  • Amplitude: Product analytics and session replay. EU data center.
  • Google (Analytics, Ads and Tag Manager): Website analytics and advertising measurement.
  • Meta (Facebook and Instagram): Advertising measurement and targeting through the Meta Pixel.
  • Datafast: Website traffic statistics.
  • Vercel AI Gateway and Anthropic: The AI model behind the business website lookup.
  • Mapbox: The interactive map on our home page.

Leads and orders are also registered in our internal sales system so our team can follow up. We may share information with public authorities when the law requires it.

4. Cookies, analytics and advertising

We use cookies and similar technologies for the purposes below. When you first visit, a cookie banner lets you accept or decline functionality, analytics and advertising cookies. You can change your choice at any time by deleting the cookies for loyco.io in your browser, which brings the banner back.

Strictly necessary and functionality

Remember your cookie choices, keep you signed in to the onboarding portal, remember whether you are browsing our hospitality or retail pages, and power the live chat and the map on our home page.

Analytics

Google Analytics, Amplitude, HubSpot and Datafast tell us how the website is used: which pages are visited, how visitors move between them, and where they leave. On desktop, Amplitude may record a replay of a visit (clicks, scrolling and page changes) to help us find usability problems. Text you type into form fields is masked and not recorded.

Advertising

Google Ads, the Meta Pixel and HubSpot measure which ads lead to visits and inquiries, and let us show our ads to people who have visited the website. When you send a form or book a meeting, your email address and name may be passed to Google and Meta in hashed (scrambled) form so they can match the conversion to an ad. Some of this data is sent through our own server-side tagging service at sst.loyco.io before it reaches Google and Meta.

The full list of cookies, with how long each one lasts, is in our cookie policy.

5. Transfers outside the EEA

Some of our providers, such as HubSpot, Google, Meta, Resend, Anthropic and Mapbox, are based in the United States and may process data there. Switzerland, where our database is hosted, is recognized by the EU as offering adequate protection. For transfers to the United States, we rely on the provider being certified under the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses.

6. How long we keep it

  • Inquiries and leads: for as long as we are in dialogue with you, and then for a limited period in case you come back to us. You can ask us to delete it at any time.
  • Customers: for as long as the agreement lasts. Accounting records are kept for five years, as required by the Norwegian Bookkeeping Act.
  • Newsletter: until you unsubscribe.
  • Analytics and advertising data: for the retention period set in each tool, after which it is deleted or aggregated.

7. Your rights

Under the GDPR you have the right to access the personal information we hold about you, to have it corrected or deleted, to restrict or object to our processing, and to receive your data in a portable format. Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect processing that took place before.

To use your rights, email personvern@loyco.no. We answer within one month. You can also complain to the Norwegian Data Protection Authority (Datatilsynet). See also our GDPR page.

8. Security

All traffic to the website is encrypted (HTTPS). Personal information is stored with providers that encrypt data at rest, and only employees who need it for their work have access. We review our security measures regularly.

9. Children

Our website is meant for businesses and is not directed at children. We do not knowingly collect personal information from children.

10. Changes to this policy

We update this policy when we change how we process personal information. The date at the top shows when it was last changed, and the current version is always available on this page.

Contact

Loyco AS
Org. nr. 816 202 612
Øvre Ole Bulls Plass 1
5012 Bergen, Norway
Email: personvern@loyco.no
Phone: +47 40 42 42 00