Privacy Policy

1. Who we are

Revoila SAS (“we”, “us”, “our”) operates Revoila (the “Service”), a platform that lets you join participating merchants’ loyalty programs and carry your memberships as passes in Apple Wallet or Google Wallet. This policy explains how we collect and process your personal data when you enroll in a program, use your pass, or sign in to the member portal.

For each program you join, the participating merchant is a separate, independent data controller for its own use of your data (for example, to run its rewards). This policy covers the processing carried out by Revoila SAS as operator of the platform.

2. Information we collect

Information you provide when you enroll or update your profile:

• Your first and last name and your email address (always required).
• Your phone number and date of birth — only when the merchant’s program requires them.
• The wallet you choose (Apple Wallet or Google Wallet). To pre-select the right one, your browser type is read on your device; it is not used to track you.

Information created when you use the Service:

• Your loyalty activity: enrollments, stamp, points, and cashback balances, rewards earned or redeemed, and a record of each scan or transaction (date and time, store location, and the staff account that performed it).
• The store, QR poster, or NFC tag through which you enrolled.
• The status of your wallet pass (installed or removed) and, for Apple Wallet, the device registration and push token that Apple provides so your pass can be kept up to date.
• Your language preference and, if you sign in to the member portal, the time of your last activity.

Information we do not collect:

• No payment or banking details — you never pay through Revoila. Any purchase or paid program is settled directly with the merchant.
• No passwords — signing in works through secure links sent to your email address.
• No tracking of your device’s location. Location-based wallet features (such as your pass appearing when you are near a store) run entirely on your device, under Apple’s or Google’s control; we never receive your location.
• No third-party advertising or analytics trackers, and we do not store your IP address in your profile.

3. How we use your information

• To create and manage your membership, and to issue and update your wallet pass.
• To record your loyalty activity and calculate your balances and rewards.
• To deliver messages about the programs you have joined as notifications on your wallet pass — including automated messages configured by the merchant, such as a birthday offer, a reminder after a period without a visit, or an alert when you are close to a reward.
• To personalize those messages (for example with your first name or your current balance).
• To sign you in to the member portal by sending secure links to your email address, and to show you your cards and the programs available to you.
• To provide merchants with statistics about their own programs (such as member counts and visit trends).
• To secure, maintain, and improve the Service, and to comply with our legal obligations.

4. Legal bases for processing

Where the GDPR applies, we rely on: the performance of a contract, to provide your membership, your pass, and the member portal; your consent, where required (for example for optional information), which you may withdraw at any time; our legitimate interests in securing and improving the Service and in providing merchants with statistics about their own programs; and legal obligations to which we are subject.

5. One profile across programs

Your Revoila member profile is a single record identified by your email address. If you join programs from several merchants, the same profile is reused, and details you provide during a later enrollment (such as a phone number) may complete it. Each merchant only has access to your information in connection with its own programs — a merchant never sees your memberships or activity with other merchants.

6. How we share your information

• The merchant whose program you join receives your identity and contact details (including your phone number and date of birth, where collected), your balances, and your visit and transaction history for its own programs, so it can operate them.
• Apple and Google, when a pass is added to Apple Wallet or Google Wallet, subject to their respective privacy policies.
• Service providers that process data on our behalf under contract — such as hosting and infrastructure providers, our email delivery provider (for sign-in links and pass emails), and cloud storage.
• Authorities, where required by law.

We do not sell your personal data, and we do not share it for third-party advertising.

7. Cookies

The Service uses only strictly necessary, first-party cookies: two secure session cookies that keep you signed in to the member portal. They expire after at most 30 days, or when you log out. We use no advertising or analytics cookies and no tracking pixels — which is why no cookie banner is shown.

8. International transfers

Where your data is transferred outside your country or the European Economic Area, we put in place appropriate safeguards (such as the European Commission’s standard contractual clauses).

9. Data retention

We keep your personal data for as long as your membership is active, and thereafter only for as long as necessary for the purposes described in this policy or as required by law. After that, we delete it or irreversibly anonymize it.

10. Your rights

Subject to applicable law, you have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to its processing, and to withdraw your consent at any time.

When you ask us to delete your data, we irreversibly anonymize your profile: your name, email address, phone number, and date of birth are removed, and your passes are deactivated. De-identified activity records (such as transaction counts) may be retained so that merchants’ statistics remain accurate.

To stop receiving a program’s wallet notifications, simply remove its pass from your wallet, or contact us. You may also lodge a complaint with your data protection authority — in France, the CNIL. To exercise any of these rights, contact us using the details below.

11. Security

We protect your personal data with appropriate technical and organizational measures, including encrypted connections (HTTPS), access controls, and the separation of each merchant’s data. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

12. Children

The Service is not directed to children below the age of digital consent in their country without the involvement of a parent or guardian. We do not knowingly collect their data without it.

13. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where required by law, brought to your attention by other appropriate means.

14. Contact

For privacy questions or to exercise your rights, contact Revoila SAS at help@revoila.app, or by post at 16 Rue Cuvier, 69006 Lyon, France.