Privacy policy

Who is responsible

Loya is operated by Christian Hählen, Ahornistrasse 16, 3627 Heimberg, Switzerland, under the Fachbyte brand (fachbyte.com). Please send privacy questions to hello@fachbyte.com.

Each business is responsible for its customers’ data: it decides what to collect and for what purpose. Loya processes this data solely on the business’s behalf and only as needed to provide the service. Loya is responsible for the businesses’ own accounts.

What data is processed

Loya collects only what is needed for appointment booking and customer management:

• Customers of a business: name, email address, phone number, booked appointments, ordered products, stamps and rewards, and an internal note written by the business.
• Team members with backoffice access: name, email address, role in the business and time of last login.
• Business details: name, address, phone number, opening hours, services and prices.
• Website enquiries: name, email address, optional business name and message. We use these details to respond to the enquiry.
• Technical data when accessing the service: IP address and browser identifier. These are attached to the current login so you can recognise which device is signed in.
• When you apply for the Thailand plan, Loya uses the IP address from registration to determine the country and check eligibility. We store the country or the absence of a result, the time and technical reason for the check, the database version, location details and approval status. The country lookup runs on the Loya server; the IP address is neither sent to a geolocation service nor stored separately for this check.

What the data is used for

There is no advertising, sharing with third parties for advertising purposes or profiling. Loya does not analyse visitor behaviour.

• Booking, rescheduling and cancelling appointments, and sending reminders.
• Password-free login: Loya sends a six-digit code to the email address.
• Confirmations, reminders and, if enabled by the business, a thank-you email after the appointment.
• Managing stamp cards and rewards if the business runs a loyalty programme.
• Keeping the software running: identifying errors, preventing abuse and maintaining security.

Where the data is stored

Under Swiss data protection law, Germany is considered to provide an adequate level of data protection. This does not imply recognition under Thai law. The providers listed above act as processors for the database, application and email delivery.

Fachbyte is based in Switzerland. When a business in Thailand uses Loya, its data is therefore also processed outside Thailand. The location of the primary database alone does not rule out international access by support teams or subprocessors; any such transfers must comply with the applicable data protection requirements.

• The primary database is hosted by Supabase in the Zurich, Switzerland region (eu-central-2). It is separate from the application server.
• The application runs on a Hetzner Online GmbH server in Nuremberg, Germany.
• Loya sends emails through a Swiss email provider (hostfactory.ch).

Loya subscription billing

We use Stripe to process payments and manage Loya subscriptions. We send Stripe the business name, the owner account’s email address and a technical business identifier. In Stripe Checkout, you enter your billing name, billing address and payment information. Full card numbers and card security codes are entered directly with Stripe and are not stored by Loya.

Loya stores the link to the Stripe customer and subscription, the price, payment status, paid periods and the effects of cancellation or refunds. These details control portal access. The business’s appointment data and customer records are not sent to Stripe for subscription payment.

Stripe also processes payment data to prevent fraud and fulfil its own obligations. Data may be processed outside Switzerland. Stripe describes recipients, international transfers and retention at https://stripe.com/privacy. Deleting a Loya business does not automatically delete payment and billing records held by Stripe.

How long data is kept

Loya deletes data automatically, without anyone having to remember:

• The content of sent emails is removed after 90 days; only a record that an email was sent remains.
• Backoffice users are logged out after seven days and must log in again.
• A customer portal login remains valid for 30 days.
• When a business is deleted, its data stays in the trash for 30 days and can be restored. It is then permanently removed.
• When someone deletes their personal account, the same happens after 14 days.
• The administrative access log is deleted after 30 days; the business activity log shows the last 10 days.

Cookies

Loya uses only technically necessary cookies: one to keep you logged in and one to remember the last business you opened. Login does not work without them.

Loya uses no advertising cookies or visitor analytics. The linked Stripe payment and management pages use their own technologies and are subject to their own privacy notices.

Your data rights

You may at any time find out what data is stored about you, have it corrected or deleted, and object to its processing.

If you are a customer of a business, contact that business first. It is responsible for your data and can change or delete it directly in the backoffice. If you need further help, contact hello@fachbyte.com.

If you run a business, you can delete your account and business in the backoffice under “My account” — Ownership and account security.

Security

• All connections are encrypted.
• Password-free login: only via a code sent to your own email address.
• Each business can see only its own data. This is enforced by the database itself, not just the interface.
• Loya administrative access to a business is logged and visible in the backoffice while the access is active.

Changes

This policy may change as Loya changes. The version published here applies. Last updated: 24 September 2026.