Privacy policy
Last updated 14 October 2026
Fidelo makes digital loyalty cards for salons, barbers, nail, spa, massage and facial studios. The cards live in Apple Wallet and Google Wallet on their customers’ phones. This policy explains what personal data we handle, why, on what legal basis, who we share it with, how long we keep it, and what you can ask of us.
1. Who we are
The data controller for this website and for our own business contacts is Fidelo, the service provider named in the imprint. You can reach us at hello@getfidelo.co about anything in this policy. We have not appointed a data protection officer, because the law does not require one for an organisation of our size and activity.
2. Two roles: controller and processor
We handle personal data in two different roles, and the rules differ.
- As controller, for people who visit our website, ask for a demo, talk to us about the service, or are contacted by us as a business prospect, and for the staff of the businesses that use Fidelo.
- As processor, for the customers of a business that uses Fidelo (we call them members). The business decides why and how their members’ data is used, and is the controller. We process that data only on the business’s documented instructions, under a data processing agreement that forms part of our terms. If you are a member and want to exercise your rights, contact the business whose card you hold; we will help them answer you.
3. What we collect and why
| Who | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Website visitors | Pages viewed, buttons clicked, device type (phone, tablet, desktop), approximate country derived from the request, referring page. No names, no cookies for this. | Understanding which pages work and fixing problems. | Legitimate interest, Art. 6(1)(f): running and improving a website with minimal data. |
| People who request a demo | Name, business name, Instagram handle or website, email or phone number, type of business, city and country, and the card design you made in the demo. | Building your demo card, sending you the link, following up about it. | Steps at your request before a contract, Art. 6(1)(b); legitimate interest in answering a business enquiry, Art. 6(1)(f). |
| Business prospects we contact first | Publicly listed business information: business name, public social media profile, public business email or phone, logo and brand colour from the public profile. | Preparing a personalised demo and offering our service to the business. | Legitimate interest in business-to-business outreach, Art. 6(1)(f). You can object at any time and we stop. |
| Demo page visits | That a demo link was opened, which steps of the demo were used, whether the test card was added to a wallet, device type. | Knowing whether the demo was useful and when to follow up. | Legitimate interest, Art. 6(1)(f). |
| Client businesses and their staff | Contact person’s name, business email and phone, billing details, staff logins, a log of who added which stamp and when. | Providing the service, preventing misuse, billing, support. | Contract, Art. 6(1)(b); legal obligation for accounting records, Art. 6(1)(c); legitimate interest in preventing fraud, Art. 6(1)(f). |
| Members (processor role) | A card number, stamp or points balance, visit dates and times, reward redemptions, the device registration needed to update the card (an anonymous device identifier and push token), and only if the business chooses to collect them, a first name, email, phone number or birthday. | Running the business’s loyalty card: adding stamps, unlocking rewards, sending the reminders and messages the business sets up. | Decided by the business as controller. Marketing messages need the member’s consent where the law requires it, which the business is responsible for collecting. |
We do not sell personal data, we do not use it for advertising profiles, and we do not make decisions with legal or similarly significant effects by automated means.
4. Cards in Apple Wallet and Google Wallet
When a member adds a card, it is stored by Apple Wallet or Google Wallet under Apple’s or Google’s own terms and privacy policies. To keep the card up to date and to show notifications, the phone registers with our servers using an identifier generated by Apple or Google. We cannot see the member’s Apple ID or Google account. The card itself holds a card number and a balance, not a name, unless the business has chosen to print one on it.
Notifications are limited by Apple and Google, and members can switch them off for each card in their wallet settings or remove the card at any time. Removing the card stops all updates to that phone.
5. Website, cookies and storage
Our website sets no advertising or tracking cookies, so we do not show a cookie banner. In detail:
- Usage events are recorded on our own servers without cookies and without identifying you.
- Cloudflare Web Analytics, if enabled, counts visits without cookies or fingerprinting.
- The interactive demo keeps your card design in your browser’s local storage so you can come back to it. It stays on your device. A logo you upload in the demo is never sent to us.
- A short-lived counter keyed to your IP address is kept for up to one hour to stop the demo request form from being abused.
- Fonts and photos are loaded from Google Fonts (Google) and from the image services of Unsplash and Pexels. Your browser sends your IP address to those services to download the files, as it does for any website.
6. Who we share data with
We use these service providers, each bound by a contract that limits what they may do with the data:
- Cloudflare, Inc. hosts the website, the database and file storage, and delivers our pages (hosting, security, analytics).
- Apple Inc. and Google LLC store cards in their wallet apps and deliver card updates and notifications.
- Google LLC provides email (Google Workspace or Gmail) and the fonts used on the site.
- Unsplash and Pexels serve the photographs on the website.
- Our booking calendar provider, if you book a call through the link on the site.
- Our accountant and tax adviser, for invoices and statutory records.
We may disclose data to authorities where the law requires it, and to a buyer or successor if the business is sold, under the same protections.
7. International transfers
Some providers above are based in the United States or process data there. Where data leaves the European Economic Area, we rely on the EU–US Data Privacy Framework for certified providers, or on the European Commission’s standard contractual clauses with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
8. How long we keep data
- Demo requests and prospect records: while we are in conversation, and deleted no later than 12 months after the last contact, or sooner if you ask.
- Website and demo usage events: up to 24 months, then deleted or aggregated so they no longer relate to anyone.
- Client business data: for the life of the contract, then 30 days for export, then deleted. Invoices and accounting records are kept for 8 years as Hungarian accounting law requires.
- Member data: as instructed by the business; deleted within 30 days after the business’s contract ends, unless the business asks us to return it first.
- Security logs: up to 90 days.
9. Security
Data is encrypted in transit and stored with our hosting provider in encrypted form. Access is limited to the people who need it to run the service, protected by strong authentication, and logged. Signing keys for wallet cards are kept as secrets outside the code. If a personal data breach puts you at risk, we will tell the supervisory authority and, where required, you, without undue delay.
10. Your rights
Under the GDPR you have the right to access your data, to have it corrected, to have it deleted, to restrict how we use it, to receive it in a portable format, and to object to processing based on legitimate interest, including business outreach. Where we rely on your consent you can withdraw it at any time. Write to hello@getfidelo.co; we answer within one month, usually much sooner, and we do not charge for it.
You can also complain to the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9–11, naih.hu. If you live in another EU country you may complain to the authority there.
11. Customers in the UAE
For businesses and individuals in the United Arab Emirates we also follow Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. The rights described above apply to you in the same way, including access, correction, deletion and objection to direct marketing. Data about you may be processed outside the UAE, by the providers listed in section 6, with the safeguards described in section 7.
12. Children
Our website and service are for businesses. We do not knowingly collect data from children. Businesses using Fidelo must not issue cards to children below the age at which they can consent to such services under local law without a parent’s permission.
13. Changes
We will update this policy when our service or the law changes. The date at the top shows the latest version. If a change matters to how we use your data, we will tell our clients by email before it takes effect.
14. Contact
Questions, requests or complaints: hello@getfidelo.co. Postal and company details are in the imprint.