Privacy policy
Version 2.2 · August 26, 2026This policy describes how Loybox LLC (“Loybox”, “we”) collects, uses, shares and protects personal data when you use our site, the Loybox app, a brand's app or loyalty program built with our platform, or the brand dashboard. We want it to be readable: if anything is unclear, write to us at hola@loybox.com.ar.
1Who we are
Loybox LLC is a company incorporated in the United States of America, with an operating team in Buenos Aires, Argentina. We operate a customer loyalty platform for brands in Argentina, Mexico, Spain and other countries in the region.
2Our two roles
Loybox plays two different roles depending on the context, and knowing which one you are in determines who to address your questions about your data to.
2.1Processor: in the brands' programs
When you take part in a brand's loyalty program (in its online store, in its own app or in its store), the controller of your data is that brand: it decides what the data is used for. Loybox acts as processor: we process your data on the brand's behalf and following its instructions, in order to operate its program. In these cases, the brand's privacy notice is the one that governs, and you can address your requests about your data to the brand or to us: if you write to us, we help the brand respond to you or we respond on its behalf.
2.2Controller: in the Loybox app and on our site
When you create an account in the Loybox app, when you browse loybox.com.ar, when you request a meeting with us from the site or when you are a brand that contracts the platform, the controller is Loybox: this policy is the one that governs directly.
3Data we collect
3.1Registration and identity data
When you create a customer account: username, email, phone number, identity document (DNI or equivalent, when the program requires it to validate purchases), date of birth (for birthday benefits and personalization) and, if you upload it, your profile photo. If you register with Google or Apple, we receive the basic data those services share. If you buy in the store of a participating brand without being registered, a preliminary account may be created from the email of your purchase, which you can claim or delete.
3.2Loyalty program data
Your activity within each program: spending and purchases (amount, date, brand, products), points earned and redeemed, rewards, tier, gift cards and packs, referrals (who invited whom), survey responses, reviews and comments you publish, carts abandoned in the store and your interaction with the communications (sends, opens, clicks, unsubscribes).
3.3Technical and device data
Device identifier, push notification tokens, registration date and last access, and technical usage records (logs) necessary to operate and protect the service. On the site, additionally, browsing and usage data (pages visited, clicks, scrolling and browser data), associated with a random identifier; the detail is in section 12.
3.4Location
If you grant the location permission in the app, we process your coordinates and convert them into an approximate address (country, city, postal code) for proximity-based features and for statistics. You can revoke the permission from your device at any time.
3.5Brand data
From the brands that contract the platform: contact and billing details of the account holder (name, email, phone, identity document, address), details of the brand (name, industry, branches and their location, visual identity), their employees' accounts and operating credentials, and credentials for the integrations they connect (for example, Tiendanube, WhatsApp Business, Clover, Perfit).
3.6Data from third-party sources
When a brand connects its online store, we receive from that platform (for example, Tiendanube) the orders, products and buyer contact details necessary to credit points and operate the program.
3.7Inquiries and meetings
When you book a meeting from the site or write to us, we collect: your first and last name, your email and your phone number; the name and a description of your brand; whatever you tell us about your business (where you sell, with which platform, your approximate sales volume, how you heard about us and what you were looking for); your time zone; and the date and time you choose. We use that data to prepare the meeting, to confirm it and to remind you of it, and for the commercial conversation that follows: the answers about your business help us know which of our products to propose to you. The meeting is recorded in our calendar (Google Workspace, see section 5).
If you add guests to the meeting, we use their emails solely to send them the invitation and the notices for that meeting: we do not write to them for any other reason and we do not add them to any list. By entering them, you represent that you have their authorization to share them with us.
4What we use the data for
We use the data to: operate the loyalty programs (credit points, process redemptions, manage tiers, rewards and referrals); send service communications and, with the corresponding legal basis, commercial communications via WhatsApp, email or push notifications, from which you can always unsubscribe; provide support; answer your inquiries and book, confirm and send reminders for the meetings you request; process brands' payments and billing; prevent fraud and abuse; comply with legal obligations; and analyze the use of the platform and of the site in order to improve them.
Profiling: the platform automatically segments the customers of each program according to their purchase activity (recency, frequency and monetary value) and generates product recommendations and preference profiles. For this we also use artificial intelligence models from external providers (see section 5). These profiles are used to personalize benefits and communications; they do not make decisions with legal effects on you, and you have the right to object to this processing by writing to us or by writing to the brand that runs the program.
Aggregate statistics: from the activity of the programs we produce aggregate statistics (number of members, repeat purchase rates, average order values, redemptions) that we use to operate and improve the product and to publicly communicate the results of the programs on our site, on our social networks and in commercial materials. Those statistics are always aggregate: they do not include your name, your contact details or your individual purchases, and they do not allow you to be identified. The conditions under which we publish a brand's case and the way in which it can object are in section 10 of our terms and conditions.
5Who we share data with
We do not sell personal data. We share data only in these cases:
With the brand of each program: the brand sees and manages the data of its own customers (profile, purchases, points, segments) and can export it; from then on it processes that data under its own responsibility and its own privacy notice. If the brand connects third-party tools to its program (for example, Perfit for email marketing), its customers' data is synchronized with those tools at the brand's instruction.
With providers that render services to us (processors and sub-processors), under contracts that limit the use of the data to the provision of the service: cloud infrastructure and storage (Google Cloud; Amazon Web Services for sending emails and for backups), meeting scheduling and video calls (Google Calendar and Google Meet, from Google Workspace: that is where the meetings in section 3.7 are recorded and where the invitations are sent from), push notifications (Google Firebase), WhatsApp messaging (Meta), SMS verification (Twilio), geocoding (Mapbox), error monitoring (Sentry), site usage analytics (PostHog, see section 12), payment processing (Mercado Pago, Stripe), online store and point of sale integrations (Tiendanube, Clover) and artificial intelligence models for the segmentation, the recommendations and the profiles of the programs (OpenAI and Google), to which the minimum necessary data is sent and which do not use that data to train their models in accordance with their enterprise terms.
Publicly, in the success stories we publish: of the brands that use the platform we publish their name, their logo, their industry, the link to their store and aggregate metrics of their program, with real data taken from the platform. We never publish personal data of that brand's customers: no names, no contact details, no individual purchases. The figures are always aggregate and do not allow any person to be identified. If a case includes the name, the position, the photo, the voice or a quote of a person from the brand's team, we do so with their consent, which they can withdraw at any time by writing to hola@loybox.com.ar. Published cases remain online until the brand or the person requests their removal.
With authorities, when a law, regulation or valid request requires it, and in the event of a corporate reorganization, with the corresponding confidentiality safeguards.
6International transfers
Our main infrastructure is in Google Cloud data centers in Chile, and some providers process data in the United States (email sending, error monitoring, artificial intelligence models, site usage analytics and backups). When we transfer data to countries without a level of protection declared adequate by your jurisdiction, we do so with recognized contractual safeguards (for example, standard contractual clauses) and data processing agreements with each provider.
7How long we keep the data
We keep your data while your account is active or for as long as the relationship with the brand of your program lasts. If you delete your account, we erase your profile and your associated activity. We retain only what a legal obligation requires of us, such as the records of commercial communications sent (up to 5 years, in accordance with Argentine data protection regulations) and billing records for the applicable tax periods, in addition to data that is already anonymized or aggregated and does not allow you to be identified.
We keep the data from inquiries and meetings (section 3.7) as a record of the commercial relationship, and we delete it if you ask us to: the rights in section 8 apply just as they do to the rest of your data. The emails of the guests to a meeting remain solely in the event for that meeting.
When a brand ends its relationship with Loybox, it can export its program's data; once a reasonable period has elapsed, we delete or anonymize it, with the same legal exception.
8Your rights
You have the right to access your data, rectify it, update it, request its erasure and object to certain processing, including profiling for marketing purposes. Where the law provides for it, you can also request its portability and its restriction. You can exercise them free of charge by writing to hola@loybox.com.ar from your account email, or through the means available in the app: account deletion is available in the application itself and erases your profile in accordance with section 7. If the program belongs to a brand, you can also address that brand (see section 2).
Argentina: the rights of access, rectification and erasure are governed by Law 25.326. The Agency for Access to Public Information, the supervisory body for Law 25.326, has the power to handle the complaints and claims filed in relation to non-compliance with personal data protection rules.
Mexico: you can exercise your rights of access, rectification, cancellation and objection (ARCO) under the Federal Law on the Protection of Personal Data Held by Private Parties, through the same channels indicated above.
Spain and the European Union: we process your data on the legal bases of the GDPR (performance of the contract or of the program in which you take part, your consent for commercial communications and for location, and our legitimate interest in the security and improvement of the service). In addition to the rights above, you can withdraw your consent at any time and file a complaint with the Spanish Data Protection Agency (aepd.es) or the authority of your country.
9Communications and how to unsubscribe
We send two types of messages: the service ones (for example, account confirmations, verification codes, redemption notices, and the confirmations and reminders for a meeting you booked, which go by email to all the guests and by WhatsApp only to the phone number you left when booking) and the commercial ones from the programs (campaigns, recommendations, cart reminders, review requests). You can unsubscribe from the commercial ones at any time: from the app's notification preferences, by replying on the channel through which the message reached you or by writing to hola@loybox.com.ar. Service messages are necessary to operate your account and do not require that unsubscription.
10Minors
Our services are not directed to children under 14 years of age and we do not deliberately collect their data. If you believe that a minor has provided us with personal data, write to us at hola@loybox.com.ar and we will delete it.
11Security
We apply technical and organizational measures to protect the data: encryption in transit, passwords stored as hashes, role-based access control, logging of administrative access to user accounts and daily backups. No system is infallible: if a security incident affecting your data were to occur, we will notify those affected and the authorities when the law requires it.
12Cookies and analytics
The site and the applications use cookies and similar technologies that are strictly necessary to function (for example, keeping you signed in).
The site also uses a first-party analytics cookie (provided by PostHog) that assigns a random identifier to your browser and is shared between loybox.com.ar and its subdomains. With it we measure which pages are visited, what is clicked, how far people read and where they reach the site from, and we record browsing sessions to understand where the site is confusing; in those recordings, what you type into the forms is masked and its content is not recorded. This analytics data does not include your name or your contact details, is not used for advertising and is not shared with advertisers. If you later create an account in the brand dashboard, your previous path through the site may be associated with that account, in order to measure where the businesses that sign up come from.
We tell you about this with a notice when you visit the site. You can block or delete these cookies from your browser settings without the site ceasing to work, and you can object to this processing by writing to us at hola@loybox.com.ar.
13Changes to this policy
We may update this policy. If the change is significant, we will communicate it by email or within the app with reasonable advance notice, and we will ask for your consent again when necessary. The version in force and its date appear at the top of this page.
14Contact
If you have questions or concerns about this privacy policy or about your data, contact us at hola@loybox.com.ar.