Privacy Policy
This policy explains what personal information Loyalty AM Group Inc. ("Redeem," "we," "us") collects when you use our website and services, how we use and protect it, who we share it with, and the choices and rights you have. By using Redeem, you agree to the practices described here.
Who we are
Redeem is operated by Loyalty AM Group Inc., a Delaware corporation. We provide loyalty-points optimization services — we analyze and value your points and give you step-by-step guidance on how to earn, hold, and redeem them. You always carry out the actions yourself, in your own accounts. We never book, transfer, or redeem on your behalf, and we never log in to or act inside your accounts. For any privacy question or request, contact us at hello@loyaltyamgroup.com. Loyalty AM Group Inc. is the data controller responsible for your personal information.
Information we collect
We collect information you provide, information generated as you use the service, and limited technical data:
- Account & contact information — name, email address, and the login credentials managed by our authentication provider.
- Loyalty & financial-profile information — the credit cards you hold, loyalty program balances, estimated annual card spend, home airport, travel goals, and redemption history, all provided by you and entered manually. We do not connect to, log into, or import from your loyalty, card, or bank accounts. This is used solely to provide the service.
- Payment information — handled by our payment processor (Stripe). We do not store your full card number; we receive a customer identifier and subscription status.
- Communications — messages, booking requests, and support correspondence you send us.
- Technical data — IP address, browser type, and basic usage/log data used for security, rate limiting, and diagnostics.
We do not sell your personal information, and we do not earn commissions from airlines, hotels, card issuers, or booking platforms.
How we use your information
- To provide, operate, and improve the loyalty optimization service you signed up for.
- To compute portfolio valuations, recommendations, and travel outcomes from your holdings.
- To process your subscription and manage billing.
- To communicate with you — account setup, advisory updates, statements, and support.
- To secure the service — authentication, fraud/abuse prevention, and rate limiting.
- To meet legal, tax, and accounting obligations.
Legal bases (EEA/UK users)
Where GDPR or UK GDPR applies, we process personal data on the bases of: performance of our contract with you (to deliver the service); our legitimate interests (to secure and improve the service); your consent (where required, e.g. certain communications); and compliance with legal obligations.
How we share your information
We share personal information only as needed to run the service, and never for others' independent marketing:
- Service providers (sub-processors) — see Section 06.
- Not for transactions on your behalf — you carry out your own bookings, transfers, and redemptions in your own accounts, so we do not pass your data to airlines, hotels, or booking platforms to transact for you.
- Legal & safety — where required by law, regulation, legal process, or to protect the rights, property, or safety of Redeem, our clients, or others.
- Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this policy.
Sub-processors we rely on
We use a small set of reputable providers to operate the service. Each processes data only on our instructions:
- Supabase — database, authentication, and storage.
- Vercel — application hosting and delivery.
- Stripe — payment processing and subscription billing.
- Resend — transactional email delivery.
- Anthropic — the AI assistant feature. Prompts you submit to the assistant may be processed to generate responses; do not enter information you do not wish to be processed by it.
- Upstash — rate-limiting infrastructure.
- Sentry — error monitoring and diagnostics. Technical error reports (which may include limited context such as the affected page and a user or account identifier) are processed to detect and fix problems.
- Vercel Analytics — privacy-friendly, aggregate usage analytics to understand how the service is used. It does not use tracking cookies or build cross-site profiles of you.
Data retention
We keep your personal information for as long as your account is active and as needed to provide the service. After you close your account, we delete or de-identify your personal data within a reasonable period, except where we must retain certain records to comply with legal, tax, or accounting obligations, or to resolve disputes and enforce our agreements.
Your rights & choices
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. California residents have rights under the CCPA/CPRA, including the right to know and to delete, and the right not to be discriminated against for exercising them — note that we do not sell or "share" personal information as those terms are defined.
To exercise any right, email hello@loyaltyamgroup.com. We will verify your request and respond within the timeframe required by applicable law. You may also delete most of your data directly by closing your account.
How we protect your information
We use industry-standard safeguards: encryption in transit, access controls and row-level security on our database, scoped server-side access checks, rate limiting, and least-privilege handling of credentials. No method of transmission or storage is perfectly secure, but we work to protect your information and to promptly address any issues. We will notify affected users and regulators of a data breach where required by law.
Cookies & similar technologies
We use strictly necessary cookies and local storage to keep you signed in and to operate core functionality. We do not use advertising or third-party cross-site tracking cookies. You can control cookies through your browser settings, though disabling essential cookies may prevent you from signing in.
International data transfers
We and our sub-processors may process and store data in the United States and other countries. Where we transfer personal data internationally, we rely on appropriate safeguards (such as standard contractual clauses) as required by applicable law.
Children
Redeem is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.
Changes to this policy & how to contact us
We may update this policy from time to time. Material changes will be posted here with a revised effective date, and where appropriate we will notify you. Continued use of the service after an update constitutes acceptance of the revised policy.
Questions or requests: hello@loyaltyamgroup.com · Loyalty AM Group Inc., a Delaware corporation.