Effective October 18, 2026
This Privacy Policy explains how Cloud Civilization, the operator of PointsPlex, based in Ontario, Canada (“PointsPlex”, “we”), handles personal information in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) and other privacy laws that apply.
1. Our two roles
For our own customers and website visitors, we decide how personal information is used and are accountable for it. For a business’s loyalty-program members, the business decides what is collected and why, and we process that information on its behalf as its service provider. If you are a member of a business’s program, that business’s own privacy notice applies, and requests about your information should go to that business first. We will help them respond. PointsPlex is not responsible for how businesses using our Service collect or use their members’ information.
2. What we collect
- Contact and account information: name, business name, email, phone and login details when you sign up, request a demo or use our contact form.
- Billing information: plan, invoices and payment status. Card details are processed by our payment provider and not stored by us.
- Usage and device information: IP address, browser, device, pages viewed and actions in the platform, collected through server logs and cookies.
- Program information (processed for businesses): member names, contact details, purchases, points, tiers, rewards and message engagement that a business sends to PointsPlex from its POS, store or app.
3. Why we use it
To provide, secure and support the Service; to bill accounts; to answer enquiries; to send service and security notices; to improve the product, including through aggregated and de-identified analytics; to meet legal obligations; and, with your consent, to send marketing, which you can unsubscribe from at any time. We do not sell personal information.
4. Consent
We collect, use and disclose personal information with your consent, which may be express or implied depending on the sensitivity of the information and your reasonable expectations, or as permitted or required by law. You may withdraw consent at any time, subject to legal or contractual limits, though this may mean we cannot provide the Service.
5. Cookies
We use essential cookies to run the website and remember your consent choice, and use optional analytics or marketing cookies only with your consent. You can change your choice at any time with the cookie settings button on every page, or through your browser settings.
6. Who we share it with
We share personal information only with service providers who help us run PointsPlex, such as hosting, payment, email, SMS, analytics and support providers, under contracts that require them to protect it and use it only for our purposes. This website loads fonts and scripts from content delivery networks (Google Fonts, jsDelivr and unpkg), which receive your IP address when a page loads. We may also disclose information where required or permitted by law, to protect our rights or users, or to a buyer or successor in a business transaction, subject to this policy.
7. Storage outside Canada
Our service providers may store or process personal information outside Canada, including in the United States. While there, it may be accessible to courts, law enforcement and national security authorities of that country under its laws.
8. How long we keep it
We keep personal information only as long as needed for the purposes above or as required by law. Account information is kept while your account is active and for 30 days after it closes so you can export it, then deleted or de-identified. Billing records are kept as long as tax law requires. Program information is kept or deleted on the instructions of the business that controls it.
9. Security
We use reasonable administrative, technical and physical safeguards, including encryption in transit and access controls, appropriate to the sensitivity of the information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Where a breach creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as the law requires.
10. Your rights
You may ask to access the personal information we hold about you, ask us to correct it, or withdraw consent. Send requests through our contact page; we will respond within 30 days, as PIPEDA requires. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
11. Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal information from children under 16. Businesses must not enrol members below the age their local law allows.
12. Changes
We may update this policy and will post the new version here with a new effective date. For material changes, we will notify account owners by email or in the app.
13. Contact
Privacy questions or requests: Cloud Civilization (PointsPlex), Ontario, Canada, through our contact page.