Privacy Policy

1. Who we are

CoolPoints ("we", "us", "our") provides loyalty programme software for small businesses through coolpoints.co.uk. This policy explains what personal data we collect, why, who we share it with and what rights you have.

We act in two different roles. For information about our own business customers (the shops, cafés, salons and other businesses that sign up), we are the data controller. For information about the customers of those businesses that is recorded in a loyalty programme, the business is the data controller and we act as its processor, following its instructions.

2. What information we collect

• Account information: your name, business name, email address, phone number, chosen plan and password (stored securely, never in readable form).
• Enquiries: the details you give us when you use our contact form, such as your name, email, phone number, business and message.
• Loyalty programme data: if you are a business, the details of your customers that you or your customers enter, such as name, phone number, email, birthday if provided, visits, points, rewards and purchase history.
• Messaging records: whether a person has agreed to receive marketing messages, and the messages sent to them.
• Technical information: basic logs such as IP address, browser type and pages visited, used to keep the service secure and working.

3. How we use your information

We only use personal data where we have a lawful reason to. Our reasons are:

• To provide the service you asked for, including setting up and running your account and loyalty programme (contract).
• To respond to your enquiries and give support (legitimate interests).
• To send service messages, such as account confirmation and important notices (contract and legitimate interests).
• To keep our systems secure, prevent misuse and fix problems (legitimate interests).
• To send you marketing about CoolPoints, only where you have agreed or where the law otherwise allows, and you can opt out at any time (consent or legitimate interests).
• To meet legal and regulatory duties (legal obligation).

4. Businesses and their customers

If you are a business using CoolPoints, you decide what customer data you collect and how it is used. You are responsible for telling your customers about this, having a lawful basis, and only sending marketing messages to people who agreed to receive them.

If you are a customer of a business that uses CoolPoints, please contact that business to exercise your rights over your loyalty data. If you contact us instead, we will pass your request on to the business.

5. Who we share information with

We do not sell your personal data. We share it only with providers that help us run the service, under agreements that require them to protect it:

• Loyalty and point-of-sale platform provider: runs loyalty programmes, rewards, sales and messaging for your business.
• Database and authentication provider (Supabase): stores account and enquiry data.
• Hosting and network provider (Cloudflare): delivers our website securely.
• Email provider (Resend): sends account, confirmation and notification emails.
• Professional advisers, regulators or law enforcement, where we are legally required or need to protect our rights.

6. International transfers

Some of our providers may process data outside the UK. Where they do, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an approved adequacy arrangement, so your data stays protected.

7. How long we keep information

We keep personal data only as long as we need it for the reasons above. Account data is kept while your account is active and for a reasonable period afterwards for legal and accounting reasons. Enquiries are kept for as long as needed to respond and for a limited period after. Businesses can ask us to delete their loyalty programme data when they close their account.

8. How we protect information

We use industry-standard measures, including encrypted connections (HTTPS), access controls, separate service credentials and row-level security in our database. No system is completely secure, so we also limit what we collect and who can see it.

9. Cookies

We use only essential cookies, which keep you signed in and protect your account. We do not currently use advertising cookies or analytics cookies. If that changes, we will update this policy and ask for your consent where the law requires.

10. Marketing messages

We only send marketing messages to people who agreed, or where the law allows. Every marketing email includes an unsubscribe link, and you can reply STOP to opt out of marketing texts where offered. Service messages, such as sign-in emails, are not marketing and may still be sent.

11. Your rights

Under UK GDPR you have the right to:

• be told how your data is used
• access a copy of your data
• have inaccurate data corrected
• have your data erased in certain situations
• restrict or object to some uses of your data
• move your data to another provider (data portability)
• withdraw consent at any time, where we rely on it

12. Complaints

If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

13. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. If we make important changes, we will tell account holders by email or on the website.

Contact us

Questions about this document? Email hello@coolpoints.co.uk or use our contact page.