Privacy Policy

Last updated: 21 July 2026 · In accordance with Regulation (EU) 2016/679 (GDPR)

1. Data controller

The controller of your data is «RETAIL MANAGEMENT SOLUTIONS ΜΙΚΕ» (Single-Member P.C.), with registered offices at Grammou 73, 15124 Marousi, Greece, Tax ID (ΑΦΜ) 801291892 and General Commercial Registry (ΓΕΜΗ) no. 153674701000, which operates the mAI Loyalty platform. Contact for personal-data matters: privacy@mailoyalty.com.

2. What data we collect

• Account details: name, email and/or mobile number, language.
• Loyalty programme data: points, earn/redeem transactions, signup gifts, membership cards.
• Optional profile details: delivery addresses, date of birth, profile photo — only if you enter them.
• Technical data: basic logs kept for the security and operation of the service.

3. Purposes and legal bases

• Operation of the loyalty programme and your account (performance of a contract).
• Sending one-time passcodes (OTP) and service messages by email or SMS (performance of a contract).
• Issuing a digital card for Apple Wallet / Google Wallet (performance of a contract).
• Marketing communications only with your consent. You may withdraw it at any time by writing to privacy@mailoyalty.com.
• Analysis of loyalty data and generation of personalised offers using artificial-intelligence systems (legitimate interest). No decisions concerning you are made solely by automated means.
• Compliance with legal obligations and establishment of claims (legitimate interest / legal obligation).

4. Recipients — processors

We use trusted providers that process data on our behalf under data-processing agreements (Article 28 GDPR):

• Hosting and database (Supabase, Vercel, Render)
• Website hosting (Cloudflare)
• Ordering servers managed by us (MyOrder service)
• Email delivery (Resend) and SMS delivery (Twilio)
• Artificial-intelligence processing for analysis and offer generation (OpenAI)
• Technical error logging for the security and stability of the service (Sentry, servers within the EU)
• Digital wallet cards (Apple Wallet, Google Wallet)
• Image hosting (Cloudinary)
• Sign-in with a Google, Apple or Facebook account — only if you choose social login

Some of the above providers may process data outside the European Economic Area. In those cases the transfer takes place under the European Commission's Standard Contractual Clauses (Article 46 GDPR).

5. Partner stores

The loyalty programme operates in cooperation with member stores. Each partner store has access only to the data concerning its own programme: your membership details, your points and your reward-transaction history at that specific store. It does not see your activity at other stores.

For processing the store carries out for its own purposes within its programme (e.g. designing its own offers and perks, or statistical analysis of its clientele), the store acts as a data controller for its own use. The roles, obligations and safeguards are governed by a contract between the platform and each partner store, in accordance with the GDPR.

Marketing communications relating to partner stores are sent through the platform and only if you have given the relevant consent, which you can withdraw at any time.

In addition, a specific store may send you its own marketing communications (e.g. email or SMS) only if you have given separate consent specifically for that store. In that case the store acts as controller for its communications and must offer an opt-out in every message; you can also withdraw the consent at any time via the app or at privacy@mailoyalty.com.

6. Retention period

Data is retained for as long as you keep an account. When you delete your account, your personal details (name, email, mobile, date of birth, photo) are deleted and your login credential is removed. Where a transaction history exists, it is retained in anonymised form for accounting purposes and can no longer be linked to you. Data we are required to keep by law is excepted.

7. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw consent. You can delete your account directly from within the app, in your profile. For any other right, write to us at privacy@mailoyalty.com. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).

8. Security

We apply appropriate technical and organisational measures: encrypted transmission (TLS), encryption of data at rest, role-based access control at the database level (row-level security), data minimisation, and logging of change, deletion and export actions on personal data. The logs do not store the personal data itself, only which field changed, by whom and when; they are kept for 24 months.

9. Changes

Any material changes to this policy will be announced through the app or by email.