Labs Loyalty is a trading name of T‑Minus Labs, a UK-based business ("we", "us", "our"). This policy explains what personal data we collect, why, and what rights you have — whether you're a customer tapping a loyalty card, or a business owner using Labs Loyalty to run your loyalty programme.
Labs Loyalty is operated by George Russell, trading as T‑Minus Labs (sole trader), of 20 Bereweeke Avenue, Winchester, Hampshire, SO22 6BH, United Kingdom. We are registered with the UK Information Commissioner's Office, registration number ZC189833 (registered 5 July 2026).
We are the data controller for the information described in this policy, except where noted below. You can reach us at tminuslabs@gmail.com with any question or request about your data.
When you tap an NFC stand at a participating business, we collect:
We store your phone number in your browser (localStorage) so your card loads instantly on return visits, and on our servers (hosted in the EU via Supabase) so your stamps stay in sync if you use a different device.
Why we process this: to provide the loyalty card service you're actively using — this is our legitimate interest in running the service you've engaged with, and that of the business whose programme you've joined. We don't use your phone number for marketing, and we never sell it to anyone.
Who sees it: the business you tapped in at can see your stamp progress and your phone number masked to the last 4 digits (e.g. ••• ••• 4821) to run their programme — they don't see your full number. We use the following sub‑processors, none of which use your data for their own purposes:
International transfers: where a sub-processor is based outside the UK (for example, Resend operates from the US), we rely on the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses to ensure your data stays protected to UK GDPR standards regardless of where it's processed.
Security measures: your data is encrypted in transit (HTTPS) and at rest, access to our database is restricted using row-level security so a business can only ever see its own customers' data, and dashboard access is protected by a PIN stored as a secure hash rather than plain text.
How long we keep it: your data is kept until whichever of these happens first — you delete it yourself, the business closes their Labs Loyalty account, or the card has had no activity for 24 months (at which point we treat it as abandoned and remove it).
Your rights: you can delete your data at any time directly from your loyalty card — look for the "Delete my data" option. This immediately and permanently removes your phone number, visit history, and any redemptions tied to it from our systems.
When you sign up to Labs Loyalty, we collect your business name, location, email address, and a PIN (stored as a secure hash, never in plain text) to protect access to your dashboard. We use your email to send you account-related messages — such as a welcome email — via Resend. We keep this information for as long as your account is active, and for a reasonable period afterwards to meet accounting and legal obligations, before deleting it.
In this relationship, you are the data controller for your customers' phone numbers and visit data, and T‑Minus Labs acts as your data processor, handling that data only to provide the service on your behalf. See our Terms of Service for the data processing terms that apply to this relationship.
We don't use tracking or advertising cookies. The only browser storage we use is functionally necessary — remembering your phone number so your card works — and falls under the "strictly necessary" exemption in UK privacy law, meaning we don't need to show you a cookie banner for it.
Depending on your relationship with us, you may have the right to:
To exercise any of these, email tminuslabs@gmail.com. Customers can also self-serve deletion directly from their loyalty card.
If you're unhappy with how we've handled your data, you also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
We'll update this page if how we handle data changes, and update the date at the top. For material changes, we'll aim to notify business owners directly by email.
T‑Minus Labs — tminuslabs@gmail.com