Privacy policy

Last updated: September 23, 2026.

elay is a digital loyalty card service for Apple Wallet and Google Wallet, operated from Santa Cruz de la Sierra, Bolivia, and used by businesses in different countries. This policy explains what data we handle, why, and what rights you have, wherever you are. We wrote it in plain language on purpose.

If the data protection law of your country gives you more rights or places more obligations on us than this policy does, that law applies and we respect it.

1. Two kinds of people, and who is responsible for each

• Businesses: the coffee shop, salon or store that creates an elay account and sets up its loyalty program. For its account data, elay is the controller.
• Customers: the people who join a business's program and save its card on their phone. For that data, the business is the controller and elay is the processor: we handle it only on the business's instructions and so that its program works.

If you are a customer, you gave your data to the business. It's also worth reading what the business tells you about its program.

2. What data we keep

About businesses: the name and email of the person who creates the account (through Google sign-in), the business name, type of business, phone or WhatsApp number, locations, plan and recorded payments. If the business connects its register or point of sale, also the sales and purchases that system sends.

About customers: the name, phone number and email they enter when they join; their birthday if the business asks for it and the person fills it in; answers to any extra questions the business added to the sign-up form; which wallet (Apple or Google) they installed the card in; and the card history: stamps, rewards earned and redeemed, and dates.

Technical: the identifiers Apple and Google require to update the pass on the phone, and system access logs (date, action taken) that we use for security and support. We don't use advertising cookies or third-party trackers.

We don't ask for or store credit card data. Payments to elay are processed outside the platform by the applicable payment method (for example PayPal, bank transfer or bank QR), under that provider's policies.

3. What we use it for, and on what basis

• To issue the card, add stamps and keep it up to date on the phone (to provide the service the customer asked for by joining).
• To send customers the notifications the business decides to send (promotions, a reward ready to redeem, a birthday greeting). The business writes and sends them, not elay.
• To show the business its customer list, its stats and, if it connected its register, its sales.
• To provide support, keep the service secure, prevent abuse and bill the plan (our legitimate interest and our contract with the business).
• To meet legal and accounting obligations or valid requests from authorities.

Optional data, such as a birthday, is used only if the person chose to give it, and they can withdraw it at any time.

We don't sell personal data and we don't share it for third-party or targeted advertising. We don't use it for our own advertising. We never combine one business's customer list with another's.

4. Who it is shared with

• The business the customer joined: it sees its own customers' data and nothing else.
• Apple and Google: for the card to live in Wallet, the pass (with the customer's name and stamps) goes through their servers under their own privacy policies.
• Technical providers for hosting, database, sign-in and email, who process the data only to provide their service to us and under confidentiality obligations.
• Authorities, only if an applicable law or a valid court order requires it.
• If elay merged or were acquired, the data would pass to the new owner with the same protections as this policy, and we would let you know.

5. International transfers

Our servers and providers may be in a country other than yours, and data may travel between countries for the service to work. When that happens, we choose well-known providers and require them to protect the data at least as described in this policy and as required by applicable law.

6. How long we keep it

For as long as the business has an elay account. If the business closes its account or lets it expire, its data and its customers' data are deleted after 90 days, except payment records we must keep for accounting or legal reasons. A customer can ask us to delete their card and data at any time.

7. Security

All communication is encrypted (HTTPS). Access to a business's dashboard requires signing in, and only the people the business authorizes can get in. The tokens that connect a register to elay are unique to each business and can be revoked. No system is perfect: if we detect an incident that affects your data, we notify the affected businesses and, where the law requires it, the affected people and the relevant authorities, within the deadlines that law sets.

8. Your rights

Depending on the law of your country, you may have the right to:

• know what data we have about you and get a copy, including in a format you can take to another service;
• correct it if it's wrong and ask for it to be deleted;
• object to a use or ask us to restrict it, and withdraw any consent you gave;
• stop receiving promotional notifications;
• not be treated worse for exercising any of these rights;
• file a complaint with the data protection authority in your country.

If you are a customer, the fastest way is to ask the business; if you prefer, write to us directly and we'll coordinate with them. If you are a business, you can export your list from the dashboard and ask for your whole account to be deleted by email. We respond within 30 days, or sooner if the applicable law sets a shorter deadline. We may ask for some information to confirm it's you.

To stop receiving a business's notifications, just delete the card from your Wallet.

9. Minors

elay is not intended for children under 13, or under the minimum age your country's law requires to give personal data without a parent's permission, if that age is higher. If a business finds that a minor joined without that permission, it must let us know so we can delete the card.

10. Changes

If we change this policy, we update the date above and, if the change is significant, we let businesses know by email before it takes effect.

11. Contact

For any question or request about your data: elayapp.scz@gmail.com. This policy is available in Spanish and English.