Privacy Policy

Last updated on 2026-10-22

This page explains how FaveCard handles personal data on favecard.co (the “Website”) and summarises how we handle it on the FaveCard platform. The full FaveCard Privacy Policy sets out the details for everyone who uses FaveCard: business customers (Part B), loyalty card customers (Part C), website visitors (Part D), your rights (Part E), and international transfers, retention and security (Part F). Sections 2 and 7 below describe the analytics and cookies on the Website itself.

1. General Information

This page applies to the Website operating at: favecard.co

The operator of the Website and the controller of the personal data described on this page is:

Qualityc Łukasz Fryc
Kasinka Mała 472, 34-734 Kasinka Mała, Poland
NIP: 7372138804, EU VAT: PL7372138804
Email: privacy@favecard.co

We process personal data in accordance with the General Data Protection Regulation (GDPR). For loyalty card data, the business that issued the card is the controller and we process the data on its behalf (see section 2).

The Website and the FaveCard platform use personal data for purposes including:

Operating the FaveCard platform (digital loyalty cards for Apple Wallet and Google Wallet)
Providing customer support
Analyzing website traffic and conversion
Communicating with business customers (account-related emails)

Sections B.3 (business customers) and D.2 (website visitors) of the full Privacy Policy list the purposes and their lawful bases; for loyalty card data, see Part C.

2. What Data We Collect

Website Visitors

When you visit favecard.co, the following data may be collected:

Analytics data: If you accept analytics cookies, we use PostHog (PostHog Inc., USA) to record page views and a few events on the Website, such as clicks on sign-up buttons. PostHog also derives an approximate location (for example, your country and city) from your IP address. With the same consent, PostHog also records your visit as a replay: the pages you see, your clicks, scrolling and mouse movements, with anything you type into form fields masked. It adds your clicks and mouse movements to heatmaps of each page. PostHog keeps an identifier in a cookie and in your browser’s local storage so it can recognise your browser on later visits. If you reject analytics cookies or make no choice, PostHog collects nothing from your visit. If you accepted analytics cookies and then sign up, the sign-up link carries your PostHog visitor and session identifiers, so we can see which pages led to the sign-up.
Advertising measurement: The Google tag (Google Ads, ID: AW-17296092581) loads on every page. Until you accept non-essential cookies, it sets no cookies and sends Google only cookieless signals (the page, the time, your browser details, your IP address as with any web request, and your consent choice), which Google uses to estimate conversions in aggregate. If you accept, it also stores identifiers for your browser and for any ad click you came from in _gcl_* cookies and local storage. When you click “Try”, the tag reports a conversion to Google Ads: without your consent as a cookieless signal, with it together with those identifiers (see section 7). Google handles this data as an independent controller under its own terms.
Form data: If you fill out a contact or signup form, the data you provide (name, email, business name) is stored in our systems.

Business Customers (Dashboard Users)

If you create a FaveCard business account, we collect:

Account information (name, email, business name)
Billing information (processed by Stripe — we do not store card details)
Loyalty program configuration (card design, reward rules)
A bot check on the sign-up and waitlist forms (Cloudflare Turnstile): while the form is open, Cloudflare receives your IP address, your browser’s user agent and TLS fingerprint and the page address, to tell a person from a script, and gives the form a one-time token that our server checks with Cloudflare. Nothing you type is sent to Cloudflare. From the check itself we keep only its result (passed, failed, missing token, error or not checked) and a random attempt identifier, not the signals Cloudflare reads; when you sign up, the result is linked in our product analytics to the account you create. Cloudflare processes these signals on our behalf to run the check and, as an independent controller under its Turnstile Privacy Addendum, to improve its bot detection.
A review invitation from Trustpilot after you buy a paid plan: our founder’s thank-you email to you is also sent as a blind copy (BCC) to Trustpilot’s invitation address, so that Trustpilot (Trustpilot A/S, Denmark) can invite you to review FaveCard. Trustpilot receives that email: your email address, your first name (if we have it), your business name and the language of the email. It uses them on our behalf, under its Data Processing Agreement, to send you the invitation. If you write a review, Trustpilot handles it and your Trustpilot account under its own privacy policy.

Part B of the full Privacy Policy describes what we process about business customers, why, and who receives it.

Loyalty Card End Customers

If you are an end customer who installed a digital loyalty card, the business that issued your card is responsible for your card data, and FaveCard processes it on that business’s behalf. The Customer Privacy Notice explains the details. To see that business’s version, open it from its card signup form, or read the template at my.favecard.co/legal/customer-privacy.

3. Data Protection

We protect personal data with technical and organisational measures, including encryption in transit (TLS 1.2 or higher) and at rest in Google Cloud, role-based access limited to what each person needs, multi-factor authentication for administrative access, and backups. Section F.3 of the full Privacy Policy lists them.

4. Hosting and Infrastructure

The Website (favecard.co) is hosted on Netlify (Netlify Inc., USA).

The FaveCard platform (dashboard, API, data storage) runs on Google Cloud Platform (Firebase/Firestore), with its database in EU regions (the Netherlands and Belgium).

These providers may log server-level data (IP addresses, request timestamps, URLs) for technical reliability purposes.

5. Your Rights

We keep personal data only as long as we need it for the purposes set out in the full Privacy Policy, or longer where the law requires it. Section F.2 of the full Privacy Policy lists the retention periods.

You have the right to:

Access your personal data
Have inaccurate data corrected
Have your data erased
Restrict the processing of your data
Receive your data in a portable format
Object to processing based on legitimate interests, and at any time to direct marketing
Withdraw your consent at any time, without affecting processing that took place before

To exercise your rights, write to privacy@favecard.co. We answer within one month; in complex cases we may take up to two more months, and we tell you so within the first month (section E.1 of the full Privacy Policy).

You may lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority in your EU/EEA country.

6. Third-Party Services

The third-party services we use include:

Service	Purpose	Cookies	Location
PostHog	Website analytics, visit recordings and heatmaps (only with your consent)	Yes	USA
Google Ads (Google tag)	Advertising measurement	Yes (only with your consent)	USA
Stripe	Payment processing	Yes (on checkout)	Ireland (EU) / USA
Firebase / Google Cloud	Platform hosting and data storage	Session cookies	EU / USA
Resend	Transactional emails (account verification, billing)	No	USA
Cloudflare Turnstile	Bot check on the sign-up and waitlist forms	No	USA (global network)
Trustpilot	Review invitation after you buy a paid plan	No	Denmark (EU)

The full list of FaveCard’s sub-processors is at my.favecard.co/legal/subprocessors.

For transfers of data outside the European Economic Area, we rely on an adequacy decision (for certified US recipients, the EU–US Data Privacy Framework) or on the EU Standard Contractual Clauses. Section F.1 of the full Privacy Policy explains this.

We do not sell your personal data to third parties.

7. Cookies

When you first visit our Website, a cookie consent banner is displayed. Analytics and advertising cookies are not set until you give your consent. This applies globally to all visitors.

The legal basis for analytics and advertising cookies is your consent (Art. 6(1)(a) GDPR, ePrivacy Directive Art. 5(3)).

We use the following categories of cookies:

Essential (always active):

Session management (after login)
Language preferences
Cookie consent preferences (cc_cookie, expires after 182 days)

Analytics & Advertising (requires your consent):

PostHog website analytics, visit recordings and heatmaps (ph_* cookie and local storage)
Google Ads conversion tracking (_gcl_* cookies, and click data in local storage)
These cookies help us understand how visitors use the Website and measure the effectiveness of our advertising campaigns

Cookie	Purpose	Duration
`_gcl_*`	Google Ads conversion tracking	90 days
`ph_*`	Recognises your browser for PostHog analytics	1 year
`cc_cookie`	Stores your cookie consent preferences	182 days

We use Google Consent Mode v2 to respect your cookie choices. When you reject non-essential cookies, the Google tag sets no cookies and sends only cookieless signals, which Google uses to model conversions in aggregate.

PostHog collects nothing until you accept analytics cookies. If you later withdraw your consent, PostHog stops collecting and its cookies are deleted.

7.3 Managing Your Preferences

You can change your cookie preferences at any time by:

Clicking “Cookie Preferences” in the website footer
Using your browser’s cookie settings

Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

8. Changes to This Page

We may update this page from time to time. The date at the top shows the last revision. The full Privacy Policy explains how we announce changes to it.

9. Contact

For privacy-related questions: