Privacy Policy

Last updated: June 9, 2026

Pleco ("we") operates a loyalty platform for Apple Wallet and Google Wallet that lets businesses ("Brands") distribute digital loyalty cards and send notifications to their customers ("Cardholders"). This policy explains what data we process, why, and your rights.

Contact: privacy@getpleco.net

1. Our two roles

Data controller: for Brand accounts (staff and administrators), billing, website visitors and prospects.

Data processor: for Cardholder data, which we process on behalf of and under the instructions of the relevant Brand. The Brand remains the controller of its own customers' data. The processing terms are set out in our Terms of Service (Data Processing annex).

2. Data we process

Brand accounts: email address, authentication credentials (managed by our provider Clerk), brand name, language preference.
Cardholders (on behalf of Brands): email, name where provided, points balance, technical pass identifiers (serial number, device tokens required for notifications).
Billing: handled by Stripe. We never store card numbers.
Technical data: server logs (IP addresses, timestamps) required for security and operation.
Shopify orders: if the Brand connects its store, we receive the order information needed to compute points.

3. Purposes and legal bases

Providing the service (performance of contract).
Billing subscriptions (performance of contract, legal obligations).
Securing the platform and preventing abuse (legitimate interest).
Responding to requests and support (legitimate interest, contract).

Notifications to Cardholders are decided by the Brand, which warrants that it has a legal basis to contact its customers.

4. Subprocessors and recipients

Railway (cloud infrastructure)
Vercel (web hosting)
Clerk (Brand account authentication)
Stripe (payments and subscriptions)
Resend (transactional email)
Apple and Google (Wallet pass delivery and notifications)
Shopify (only if the Brand connects its store)

Some providers are located outside the European Union (notably in the United States). Transfers rely on appropriate safeguards: the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, depending on the provider.

5. Cookies

We only use essential cookies: the authentication session (Clerk) and the language preference. No advertising cookies, no third-party trackers. Essential cookies do not require consent.

6. Retention

Account data: for the duration of the contract, deleted within 30 days after.
Cardholder data: per the Brand's instructions; deleted at the latest 30 days after the Brand's contract ends.
Verification codes: 10 minutes.
Billing data: statutory accounting retention periods.
Technical logs: 12 months maximum.

7. Security

Encryption in transit (TLS) and at rest for sensitive secrets (AES-256-GCM), strict per-Brand data isolation, access controls, and logging. No system is infallible; we notify data breaches in accordance with the GDPR.

You have the rights of access, rectification, erasure, restriction, portability and objection. To exercise them: privacy@getpleco.net. If you are a Cardholder, your request may be handled together with the relevant Brand, which is the controller. You may also lodge a complaint with your supervisory authority (in France, the CNIL, cnil.fr).

9. Changes

We may update this policy; the date above is authoritative. For material changes, Brands will be informed by email or through the dashboard.