Privacy Policy

Last updated: 28 October 2026

This policy explains how Loyii handles personal data from website visitors, applicants, business account holders, staff and referrers, and the customer data we process for businesses using Loyii.

Who we are and who controls your data

Loyii is a loyalty and WhatsApp messaging platform operated by PT Nexus Global Group, a company registered in Indonesia and operating from Malaysia. Contact hello@loyii.app about privacy, a data request or a complaint.

We control the account, application, billing, referral and technical data needed to run our own business. A restaurant or other business using Loyii controls its customers' personal data. We process those customer records on its behalf to provide the service. Individuals keep their rights over their personal data. If you are a customer of a business using Loyii, contact that business first; we can help it respond to your request.

What we collect and where it comes from

• Applications and accounts: your name, business name, email, phone number, selected plan and features, optional referral code, staff roles, sign-in and security information, settings and support correspondence
• Billing and referrals: invoices, payments, uploaded receipts and the details read from them, subscription history, referral attribution, commission records and payout details where relevant
• Business customers: names, phone numbers or WhatsApp identifiers, contact details, date of birth where provided, communication preferences, loyalty membership, visits, spending and points records, referrals and feedback
• Messages and service records: WhatsApp conversations, photos, voice notes and their transcripts or descriptions, shared locations, delivery information, orders, reservations and related customer or staff notes, where those features are used
• Technical records: internet addresses, browser and device information, request and security logs, audit records, notification subscriptions and service usage, including how many minutes a day each team member is active in the app

Data comes from you, your authorised staff, your customers, connected WhatsApp accounts and other integrations you enable. A business may also import customer records. We receive limited technical data when someone visits our pages or uses the platform.

Why we use personal data

We use account and technical data to review applications, create and protect accounts, provide support, understand how businesses use Loyii, issue invoices, verify payments, operate referrals, investigate misuse and meet legal obligations. We process customer records to run the business's loyalty program, answer and route messages, manage orders and bookings, send service updates and carry out campaigns and automatic messages the business enables.

Where applicable law requires consent, it must be obtained before the relevant processing. If a member is under 18, the business must obtain consent from a parent or guardian where the law requires it. Other processing may be necessary to provide a requested service, carry out a contract, protect the service or comply with law, where that law permits it. Accepting our terms or this policy is not consent to every use of personal data.

Information a form asks for is needed to process an application or provide the relevant feature, unless it is marked as optional. If it is missing, we may be unable to do so. Referral codes and optional profile information are not required unless the particular feature needs them. Do not send passwords, full payment-card details, identity documents or unnecessary sensitive information in messages or uploads.

WhatsApp, AI and payment-receipt checks

When a business connects its WhatsApp Business number, we receive messages, contact identifiers and account or delivery information needed to operate its messaging. We use that data for customer replies, staff handovers, loyalty updates, orders, bookings, reminders and permitted promotions.

AI features send relevant message content and conversation context, business information and uploaded material to external AI services. This includes voice notes for transcription, photos for description, menus and offers for reading, payment receipts for checking, and the searches and questions staff type into the app's AI help. Requests may be routed to an alternative provider if another cannot respond. Staff can review the resulting replies or extracted information.

AI providers' retention and use of submitted content depend on their terms and the service tier in use. Some services, including free tiers, may retain inputs and outputs, allow human review or use them to improve their services and models. We do not promise that all AI processing excludes those uses. Contact us for the current providers and data-handling options before enabling AI for confidential or sensitive material.

AI can make mistakes. Receipt checks assist our team. A check may refuse a receipt that does not seem to match the payment and give the reason, so you can send the right one or contact us. A check does not by itself confirm that money has arrived or make the final payment decision. Customers can ask the business to involve its staff in a conversation.

Marketing choices

Businesses are responsible for obtaining the permissions needed for their messages and respecting opt-outs. Joining a loyalty program or sending a message does not by itself authorise all future promotions. Customers can ask the business to stop marketing or use the opt-out instructions it provides. An opt-out does not necessarily stop service messages that are still lawful and needed, such as a requested booking update. You can ask us to stop Loyii's own promotional communications by emailing us; necessary account, security and billing messages may continue.

Applications

When you sign up with a password, your account opens at once and the sign-up record stays associated with that account. Your password is never kept on the sign-up record or in the form’s browser storage. Pending applications normally expire after 30 days. Approved invitation links normally expire after one day and can be reissued. Applications that never become accounts are removed by our scheduled cleanup once their expiry is more than 30 days in the past. If an application becomes an account, its application record remains associated with that account.

Browser storage and technical data

The application form saves your setup answers and entered contact details in this tab's session storage so a refresh does not lose them; they are gone when you close the tab. Our website keeps two small cookies of its own: one remembers your cookie choice and one remembers the language you chose. If you accept cookies, a referral link's code is also remembered on your device, as explained below. The platform uses cookies and similar storage for sign-in, security and preferences. Blocking or clearing storage can reset these choices or affect sign-in. Our Cookie Policy lists every cookie and item of browser storage and explains how to change your choice.

Cloudflare hosts the landing page and provides its bot check and request protection. It receives technical information such as your internet address and browser details to deliver pages, detect abuse and produce traffic statistics. It also uses information from the bot check to improve its bot detection, under its own privacy terms. Our application endpoints use internet addresses to limit requests. Links to social networks or other external services take you to services with their own privacy practices.

Referral links and referrer accounts

If you arrive through a referral link, we remove the referral code from the visible page address. If you accept cookies on our site, we also remember the code on your device for up to 60 days and use it to fill the optional referral field on the application form. If you reject cookies, or have not chosen, the code is kept only while that page is open and is not stored. The code is included in an application only if you submit the form with it. The initial page request can still contain the code in its address and technical logs. You can stop us remembering it at any time with Cookie settings in the footer, or by clearing this site's data in your browser. See our Cookie Policy.

If you apply with a referral code, or we link a referrer to your business, that referrer can see your business name, account and referral status, attribution date and the commission records connected to it. Those records include payment amounts used to calculate commission, dates, rates and reversal reasons. They cannot use their referrer account to view your customers, messages, contact details or purchased features. A referral code does not change your price.

Who receives data

Authorised staff at your business can access records according to their permissions. Authorised Loyii personnel can access records for support, maintenance, billing and security. Services involved in operating Loyii include WhatsApp and Meta, hosting and backup providers, email delivery, browser push-notification services, Cloudflare's page delivery and bot protection, error monitoring where enabled and the AI services described above. The information each receives depends on the feature used.

We may also disclose information where required by law or reasonably necessary to investigate fraud, protect people or establish or defend legal claims. Referrers receive only the information described above. We do not sell personal data or share it with anyone for their advertising.

Processing outside Malaysia

Hosting, messaging, email, backup, notification, error-monitoring and AI services may process or store data outside Malaysia. Protections and access rules can differ between countries. Applicable law may require an appropriate transfer condition, safeguards or consent before a transfer. A business using Loyii must give its customers the required notices and obtain any necessary permissions. Contact us for information about current providers and processing locations; this policy does not mean that all data remains in Malaysia.

How long data stays

We keep account and service records while needed to provide the service, support the business, maintain security or meet legal and accounting requirements. Trial expiry, moving to Free and a billing pause do not themselves delete records.

Closing an account archives it and stops access. Archived account data is kept for at least 90 days for recovery and export. After that our team can permanently delete it; there is no automatic deletion on day 90. Contact us to arrange an export and deletion date. We handle requests required by privacy law separately, and may retain records needed for legal obligations or disputes.

Deleting live records does not immediately remove earlier backup copies. Our normal backup rotation retains recent daily copies and older monthly recovery copies for up to 12 months. The most recent recovery copy may remain longer until replaced. External services can have their own retention periods. Ask us about a particular record or deletion request.

Removing a member's profile

An authorised business owner can erase the identifying fields in a member's profile. This removes profile details such as the name, phone number, WhatsApp identifiers, email and birthday, disables marketing consent and stops that card working. Any outstanding member credit or pending payment must be settled first.

This action keeps the points and visit history and does not automatically erase personal data contained in messages, bookings, orders, staff notes, audit records or backups. Those records need separate review. We do not treat all remaining records as anonymous simply because the profile was erased. Contact the business or us about a broader deletion request.

Your rights and requests

Subject to applicable law, you may request access to and correction of personal data, withdraw consent, limit certain processing, stop direct marketing and request transfer of your data where the right to portability applies. You can also ask us to review whether data should be deleted. Some records must be retained or cannot be supplied where doing so would breach another person's rights or a legal restriction.

Email hello@loyii.app, describe the request and identify the relevant business or account. We may need to verify identity and authority before responding, and will explain any applicable limit, lawful fee or reason we cannot fulfil the request. We respond within the time required by applicable law. Business owners can request an account export on any plan; individual customer requests are handled with the business that controls the data.

If you are dissatisfied with our handling of a Malaysian privacy matter, you can complain to the Personal Data Protection Commissioner of Malaysia. Other rights or complaint routes may apply where you live.

Security and incidents

We use encrypted connections, access controls and account-security measures to protect personal data. Owners must use two-step sign-in. No service can guarantee absolute security. If we become aware of a personal-data breach, we investigate and notify affected businesses, individuals or authorities as required by applicable law. Report suspected misuse or a security concern to hello@loyii.app.

Changes and contact

We update this policy when our practices change and show the revision date above. For material changes affecting account holders, we will provide an appropriate notice. Where a new use requires consent, a policy update alone does not supply it. For questions, requests or complaints, contact hello@loyii.app.