Privacy with a velvet rope.

Scope and who is responsible

This Privacy Notice explains how Grayston Technologies, the operator of Loyalure (“Grayston,” “Loyalure,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information through the Loyalure websites, installable member web application, and business workspaces that link to this Notice.

Grayston is responsible for account, platform, security, support, and service-operation data. Participating venues are independent businesses responsible for the guest information they collect and use for their own admission, hospitality, offers, events, VIP service, and legal obligations. When a venue's notice or instruction applies, contact that venue about its practices; Grayston will route verified requests when appropriate.

Information we collect

Depending on how you use Loyalure, we collect:

• Account data: email address, authentication events, session and multi-factor status, and account identifiers.
• Profile data: display name, locale, time zone, discreet-mode choice, and an optional phone number provided as VIP contact information.
• Eligibility data: your 21+ affirmation and, if recorded by authorized door staff, that a physical ID check occurred. Loyalure does not need a copy of your ID for the pilot.
• Membership and activity data: venue memberships, attribution source, check-ins, points ledger entries, tier, rewards, referrals, RSVPs, waitlists, VIP requests, and inbox activity.
• Preference and consent data: legal-document acceptances, email and push choices, suppression status, notification subscriptions, and consent history.
• Device and technical data: browser or app type, operating system, IP-derived security signals, timestamps, correlation identifiers, service-worker state, device registrations, and diagnostic events.
• Business-user data: organization and venue assignments, role, permission, MFA status, approvals, exports, support access, audit actions, and integration activity.
• Support and privacy data: messages you send us, request type, identity-verification state, and records needed to complete and audit the request.

Sources of information

We receive information directly from you; automatically from your browser, device, and use of Loyalure; from venues and their authorized staff; from authentication, communications, hosting, security, and support providers; and from referral or campaign links you choose to open. We do not purchase data-broker profiles for the pilot.

How we use information

We use personal information to:

• create and secure accounts, verify authorization, and maintain tenant boundaries;
• provide memberships, check-ins, wallets, tiers, rewards, referrals, events, RSVPs, VIP requests, and inbox features;
• deliver essential account messages and consented email or push communications;
• operate Door, Venue, Media, Sponsor, and Control workflows with purpose-limited access;
• prevent replay, abuse, fraud, unauthorized access, and violations of law or policy;
• measure aggregate service performance, campaign outcomes, and sponsor proof of play;
• respond to support, export, deletion, security, and legal requests;
• debug, maintain, improve, and document the Service; and
• comply with law, enforce agreements, resolve disputes, and protect people and the platform.

Loyalure does not use member data to make decisions about credit, employment, housing, insurance, health care, or other legally significant opportunities.

How information is disclosed

We disclose information only as reasonably necessary:

• To your venues: authorized staff receive the member and activity data needed for their assigned loyalty, event, VIP, door, campaign, support, or compliance work.
• To service providers: vetted providers support hosting, database, authentication, storage, error monitoring, email, push, and similar operations under contractual and technical restrictions.
• To sponsors: sponsors receive aggregate reporting and proof of play, not member profiles, contact details, memberships, or individual activity through Loyalure's sponsor surface.
• For legal and safety reasons: we may respond to lawful process or protect rights, safety, security, and platform integrity.
• During a business transaction: information may transfer in a merger, financing, acquisition, reorganization, or sale, subject to appropriate confidentiality and applicable law.
• At your direction: we may disclose information when you ask us to or give valid consent.

No sale or cross-context advertising

Loyalure does not sell personal information for money. For the pilot, Loyalure also does not share personal information for cross-context behavioral advertising or use third-party advertising trackers to profile members across unrelated services. If those practices ever change, we will update this Notice and provide any choices required by law before the change applies.

Email, push, and phone data

Essential account, privacy, and security messages may be sent as needed to provide the Service. Marketing email or push notifications are sent only when enabled for the venue, supported by the provider, and permitted by your recorded choice. You may unsubscribe from marketing email, disable push in Loyalure or device settings, and change preferences in the member privacy center. A marketing opt-out does not stop essential service messages.

Loyalure v1 does not use phone OTP or SMS marketing. A phone number provided for VIP contact is optional and is not permission for automated calls or texts. Marketing content and notification previews are designed to be discreet and non-explicit.

Cookies and local device storage

Loyalure uses essential cookies and browser storage for authentication, security, preferences, app installation, service-worker caching, and reliable operation. The Door workspace may use encrypted IndexedDB for a bounded offline queue of signed-token check-ins. Offline Door mode does not cache member phone or name lookup results. We do not use the pilot Service for third-party behavioral advertising.

Retention

We retain personal information only as long as reasonably needed for the purposes above, including to keep an account active, fulfill a venue relationship, complete a verified request, maintain security and fraud records, reconcile transactions, enforce agreements, and meet legal obligations. Retention depends on the record type, sensitivity, operational need, applicable limitation period, and legal requirements.

Points, consent, audit, and provider-event histories are append-only to preserve integrity. When deletion applies, direct identifiers are deleted or de-identified while the minimum non-identifying record needed for security, reconciliation, legal compliance, or proof of consent may be retained. Backups age out under controlled schedules.

Your privacy rights

Loyalure provides authenticated tools to access and correct profile information, control optional communications, request a portable export, and request deletion. Depending on where you live, law may also give you rights to know, access, correct, delete, obtain a copy of, or restrict certain uses of personal information, and to appeal a denied request. We will honor applicable rights and may voluntarily extend practical controls more broadly.

Submit a request in the member privacy center or email us. We may verify your identity, account control, venue relationship, and request scope. Authorized agents must provide proof of authority, and we may confirm the request with you. We will not discriminate against you for exercising a privacy right. If we deny a request, we will explain why and provide an appeal path when required.

Security and incident response

We use organizational, technical, and physical safeguards designed for the nature of the information, including tenant isolation, row-level authorization, least-privilege roles, mandatory MFA for privileged users, encrypted transport and storage, short-lived signed QR tokens, replay detection, audit trails, provider isolation, and protected backups. No service can guarantee absolute security.

If an incident affects personal information, we will investigate, contain, document, and notify affected people and authorities when required by applicable law. Report suspected security issues through support without sending secrets or unnecessary personal data.

Discreet and sensitive-context use

A venue membership or visit may reveal personal preferences. Loyalure therefore offers discreet mode, generic notification previews, purpose-limited staff access, and strict sponsor isolation. Adult-entertainment venues are excluded from native discovery and native deep links; eligible members can access their full venue experience through the installable web app. Users should still consider who can access their device, browser, email account, and notification history.

Age restriction and minors

Loyalure is a 21+ service and is not directed to children or teenagers. We do not knowingly collect personal information from anyone under 21. If you believe a person under 21 has created an account or provided personal information, contact us so we can investigate and delete it as appropriate.

Processing location

The pilot is offered in the United States, initially in Ohio. Information is processed in the United States and in other locations where our service providers operate. When required, we use contractual and other safeguards for transfers. Do not use the pilot from a jurisdiction where the Service or this processing is unlawful.

Changes to this Notice

We may update this Notice to reflect changes in the Service, providers, or law. We will publish the new version and effective date. We will provide reasonable notice of material changes and record a new acknowledgement or consent when required. Prior acceptances remain tied to the exact version accepted.

Contact and appeals

Contact Grayston Technologies at jforster@graystontechnologies.com or through the support center. Identify the venue, if relevant, and state whether your message is a privacy request, appeal, or security concern. Do not include passwords, one-time codes, full government ID numbers, or unrelated personal data.