RepeatOn Privacy Policy

Last updated: 28 September 2026

1. Who we are

RepeatOn is a digital loyalty and customer retention service for local businesses such as cafés, barbers, bakeries and salons. It is provided at getrepeaton.com.

The RepeatOn service is operated by SYNAPAI DIGITAL LTD, a private limited company registered in England and Wales under company number 16844669, whose registered office is at 1b Rollesby Road, Chessington, England, KT9 2BY, United Kingdom. RepeatOn is a trading brand of SYNAPAI DIGITAL LTD, not a separately incorporated company.

In this policy, "RepeatOn", "we", "us" and "our" mean SYNAPAI DIGITAL LTD.

Contact for privacy questions and data-protection requests: hello@getrepeaton.com

2. Who this policy is for

RepeatOn is used by two groups of people, and our role is different for each.

Businesses and their teams. If you create a RepeatOn account for a business, are invited to join one as a member of staff, or subscribe to a paid plan, this policy explains how we use your information. For this information, we are the controller.

Customers of those businesses. If you joined a loyalty programme at a business that uses RepeatOn, that business is the controller of your loyalty information. It decides to run the programme, what rewards to offer and whether to send you reminders. We process that information on the business's behalf and on its instructions, as its processor. For questions about your loyalty card at a particular business, including requests to access or delete your information, please contact that business. We will help the business respond, and if you contact us directly we will pass your request to the business or help you reach it.

RepeatOn Perks members. RepeatOn Perks lets a customer who has confirmed their email address discover benefits offered by other participating businesses. Because we decide how a verified identity is recognised across participating businesses, we are the controller of the information used to operate Perks.

3. Information we collect about businesses and their teams

We do not receive or store your full payment card details. Card payments are handled directly by Stripe.

4. Information we process for businesses about their customers

When a customer joins a loyalty programme run on RepeatOn, the business (through us) collects and stores:

• first name (required), last name (optional) and email address (required);
• preferred language;
• whether the customer agreed to receive reminder emails from the business, when, and the source of that choice;
• the loyalty card: stamps, visits, rewards unlocked and redeemed, and the dates of the first and most recent visit;
• a record of each visit, reward and adjustment, including which member of staff recorded it;
• an estimate of how often the customer usually visits, calculated from their recorded visits;
• a record of any reminder email sent, why it was sent (for example, the number of days since the last visit), and whether it was delivered or led to a later visit;
• if the customer adds the card to Google Wallet, a record that a pass exists and when it was last updated.

Behavioural retention emails (Growth plan). If a business turns on reminders and a customer has agreed to receive them, RepeatOn compares that customer's recent visits with their usual pattern and may send a reminder email on the business's behalf. Customers can unsubscribe using the link in every email. This is an automated process, but it only decides whether to send a reminder email.

Targeted marketing campaigns (Growth plan). A Growth business may choose one of a fixed set of customer groups (for example, customers who have not visited in a while, or who are close to a reward) and send them a one-off marketing message it writes itself. RepeatOn only sends this to customers who have agreed to receive marketing from that business, checked again at the moment of sending, and every message carries the same unsubscribe link as a reminder email. We record which customers a campaign was sent to, which were left out and why (for example, no consent on file), and the delivery outcome (sent, delivered, bounced or reported as spam) — the same records kept for a reminder email. RepeatOn does not track whether a campaign email was opened or clicked.

Advanced analytics and customer segmentation (Growth plan). A Growth business can view aggregated figures about its own customers — how many joined, how many visited, reward activity, and how many are visiting less than usual — calculated from the records described above, over a period the business chooses. It can also group its own customers into named categories (for example, "customers who have not visited recently") to decide who a targeted campaign should reach. Neither feature collects anything beyond what the loyalty programme already records, and neither combines one business's customers with another's.

Multi-location analytics (Growth plan, multi-location accounts only). If a Growth business operates more than one location under a single commercial account, the person who set that account up can view the same aggregated, per-location figures side by side across every location in that account. This uses no information beyond what each location's own analytics already covers, and does not identify or combine individual customers across locations — the figures shown are counts, never customer lists.

We do not sell this information, and we do not use one business's customer information for another business.

5. RepeatOn Perks

If a customer chooses to confirm their email address for Perks:

• we send a one-time confirmation link to the email address already on their loyalty record, valid for 15 minutes;
• we create a Perks identity. Instead of storing the email address again, we store a keyed cryptographic code derived from it, which lets us recognise the same member at different participating businesses without keeping a second copy of the address;
• when a member redeems a Perk, we record which benefit was redeemed, at which business, when, and which member of staff confirmed it.

What businesses can see. A business sees Perks redeemed at that business. It does not receive the member's list of other businesses, and participating businesses do not share customer lists with each other.

The Perks directory is public and shows only information a business chose to publish: its name, category, benefit, conditions and, if provided, a public address and postcode. It does not use your location, and it does not show distances.

6. Google Wallet

Customers can add a loyalty card to Google Wallet where Google Wallet is available on their device. If a customer adds a loyalty card to Google Wallet, we send Google the information needed to display the pass: the business's programme details and branding, the stamp balance and an opaque code for the barcode. We do not send Google the customer's name or email address. Google's use of information in Google Wallet is governed by Google's own privacy policy. Apple Wallet is not available.

7. Cookies and similar technologies

RepeatOn uses only cookies that are needed to provide the service. We do not use advertising or analytics cookies.

8. Our lawful bases

9. Who we share information with

We use the following service providers. They process information on our instructions.

Account emails such as sign-up confirmation and password reset are sent by Supabase's own mail service, as part of the Supabase row above.

We may also disclose information if required by law, to protect our rights or users' safety, or as part of a sale or reorganisation of our business, in which case we will tell you.

10. International transfers

Some of our providers process information outside the UK. In particular, the RepeatOn application currently runs on Vercel servers in the United States (Washington, D.C. region), and Stripe, Resend and Google are headquartered in the United States.

Our database, authentication and file storage provider, Supabase, hosts RepeatOn's data in the European Union (Ireland).

11. How long we keep information

We keep personal information only for as long as we need it for the purpose it was collected for, or as the law requires. We apply these principles:

• Business and staff account information is kept while it is needed to provide the Service. When a trial ends or a subscription is cancelled, the account becomes read-only and information is not deleted at that point.
• When a business account is formally closed, personal information that is no longer needed enters a documented deletion or anonymisation process.
• Loyalty customer information — profile, visits, rewards and redemptions — is not kept indefinitely without an identified operational or legal purpose. Loyalty history is kept as an append-only record so that balances are accurate and auditable; where it must be removed, the person is anonymised in it rather than the history being rewritten.
• Deletion requests that are valid are carried out, unless a legal obligation or a legitimate record-keeping requirement means specific information must be kept. In that case we keep only that information, and tell you why.
• Financial and accounting records are kept for the period required by UK tax and accounting law.
• Marketing consent history is kept only as long as needed to show that consent was handled lawfully.
• Unsubscribe and suppression records may keep the minimum information needed to make sure a person who opted out is not sent marketing again, including after other information about them is deleted.
• Automated reminder and targeted campaign records are kept for a documented purpose — for example delivery confirmation, frequency limits and complaints handling — and not indefinitely without justification.
• Security and audit records are kept for a limited, documented security purpose.
• Perks confirmation links expire after 15 minutes.

12. Your rights

Under UK data protection law you have the right to:

• be informed about how your information is used;
• access a copy of your information;
• have inaccurate information corrected;
• have information deleted in some circumstances;
• restrict or object to some processing;
• data portability in some circumstances;
• withdraw consent at any time, where consent is relied on — for reminder emails and marketing campaigns, use the unsubscribe link in any email. We then stop sending you marketing and keep only the minimum record needed to make sure it stays that way.

To make a request — access, correction, deletion, objection or any other right — email hello@getrepeaton.com. Business users and Perks members can contact us directly. Customers of a business can contact that business, which controls their loyalty information, or us; if you contact us, we will pass your request to the business or help you reach it, and support it in responding.

We will respond within one month, which may be extended in limited circumstances. We may need to confirm your identity first. Requests are handled by our team: there is no self-service deletion tool. A deletion is carried out by removing or anonymising your information, subject to the retention principles in section 11.

13. Complaints

If you have a concern about how we handle your information, please contact us first at hello@getrepeaton.com. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.

14. Security

We use encryption in transit, access controls that separate each business's information at the database level, hashed credentials, signed and short-lived customer codes, and audit records of staff actions. No system is perfectly secure, and we will notify affected users and the ICO of a personal data breach where the law requires it.

15. Children

RepeatOn is intended for businesses and their adult customers.

16. Changes to this policy

We will post any changes on this page and update the "Last updated" date. If a change materially affects how we use your information, we will tell business account holders by email before it takes effect.