Privacy policy

Who we are

Loyalty Central ("we", "us") runs loyaltycentral.works, a directory, reports and advice service for people choosing loyalty solutions in Australia and New Zealand, powered by Ellipsis & Co. Our team works from London, Sydney and Auckland, and remotely. This policy explains what personal information we collect, why, who else handles it, and your rights. It follows the Australian Privacy Principles and New Zealand's Privacy Act 2020.

The site has no accounts or sign-in: we only hold what you send us in a form or an email, and what's described under analytics below.

Contact our privacy officer through the contact form at loyaltycentral.works/contact.

What we collect, and why

• Reports: your name, email and the report you asked for, to send you the report.
• Messages: your name, email and anything you write (and company, if you give it), to reply.
• Newsletter: your name, email and market preference, plus the wording you agreed to and when, to send the Monthly Loyalty Market Update. Every form on the site adds you to it: the newsletter sign-ups, the snapshot, report and consultation requests, and the contact form. Each form says so, the first email you get from us says so too, and every email has a link to unsubscribe.
• Automatically: your approximate region (from your time zone) to show local news; and, with the analytics described below, pages you visit, your browser and device.
• With every form you send: your IP address and approximate location, time zone, language, device, browser and screen size, how you reached the site (the referring site, landing page and any campaign tags), the pages you viewed first, and the IDs that connect your submission to the analytics and marketing tools below.
• If our bot check can't confirm a form came from a person, we keep what was sent, marked as possible spam, so we can review it by hand. We don't email you or add you to anything.

Apart from what you choose to send us in a message, we don't collect phone numbers, postal addresses, card details or government identifiers. You can browse the directory, reports and news without giving us anything.

Analytics, cookies and session recordings

• PostHog (product analytics, heatmaps and session recordings) shows us how the site is used, and receives what you send in a form with the form details above. Recordings hide everything you type and your name and email on screen. Once you've given us your email in a form, or clicked a link in one of our emails, PostHog links your activity, including recordings, to that email, and recognises you when you come back.
• HubSpot keeps our contact records, including what you send in a form and the form details above. Its cookie (hubspotutk) lets it link your visits to your contact record once you've given us your email in a form or clicked a link in one of our emails, and recognise you when you come back.
• Google Analytics measures visits. IP addresses are anonymised and advertising features are off.
• We also keep our own record of the pages you view here, with a first-party cookie (lc_vid). It's linked to your email if you click a link in one of our emails, or give us your email in a form (newsletter, report download or contact), so our team can see who is researching solutions. Our email links carry a random code, never your address. We keep it for 12 months after your last visit, or 30 days if we don't know who you are.
• Vercel Web Analytics counts page views without cookies, and Speed Insights measures page speed.
• Your browser also keeps a few settings for this site in local storage: your market (Australia or New Zealand). They stay on your device.
• Cloudflare Turnstile checks forms are used by people, not bots. It reads browser signals and we send it your IP address with the check. Its use is covered by Cloudflare's Turnstile Privacy Addendum: cloudflare.com/en-gb/turnstile-privacy-policy/

Analytics run on every visit. If your browser sends a Global Privacy Control signal, we treat it as declining and don't run them.

Who else handles your information

We share personal information only with the services that run the site, under their own privacy and security commitments, and never sell it. Some are overseas:

• Vercel: hosting. Our servers run in Sydney; Vercel's network is global (United States company).
• Supabase: our database. Sydney, Australia.
• Resend: sends the site's emails (confirmations and report downloads). Sent from Tokyo, Japan (Amazon Web Services); United States company.
• Google Workspace: our team email, where your messages arrive. Global (Google).
• PostHog: analytics and session recordings. European Union.
• Google Analytics: visit measurement. United States.
• Sentry: error reports, without your name or email. European Union (Germany).
• Cloudflare: bot checks. Global network; United States company.
• HubSpot: our contact records, and sends the Monthly Loyalty Market Update. United States company.

How long we keep it

• Newsletter subscriptions: until you unsubscribe.
• Form submissions, including messages and report requests, and records of unsubscribing: 3 years.
• Submissions marked as possible spam: 12 months.
• Error logs and analytics: as long as each service keeps them, typically 30 to 90 days for logs and up to 14 months for analytics.

Your rights

• Unsubscribe: use the link in any newsletter.
• To see, correct or delete your data, or for anything else, use the contact form at loyaltycentral.works/contact. We reply within 30 days.

Keeping it safe

Only our own server can read the database. We test who can see what, keep software up to date, and encrypt data in transit.

If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner (and New Zealand's Privacy Commissioner if you're in New Zealand) as soon as practicable.

Complaints

Use the contact form at loyaltycentral.works/contact and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in New Zealand, the Privacy Commissioner (privacy.org.nz).

Changes

We'll update this page when how we handle personal information changes. Last updated 7 November 2026.