Buyer guide · Privacy
GDPR control starts with knowing your responsibilities.
Self-hosting changes who operates the software. It does not replace legal analysis, secure administration, or a clear record of every service that handles personal data.
- Deployment
- Operator-selected infrastructure
- Member controls
- Export and deletion workflows
- Compliance owner
- The operating organization
Short answer
Treat data control as a responsibility.
Reward Loyalty gives the operator control over the installation and data location. The operator still has to identify its controller and processor roles, choose lawful purposes, record consent where required, secure the server, handle access and deletion requests, and account for hosting, mail, analytics, AI, and integration providers. Self-hosting supports a privacy strategy; it does not certify one.
Decision criteria
Map the complete processing chain.
The application, infrastructure, communications, optional services, staff practice, and contracts all belong in the privacy decision.
Data roles
Document who determines the purpose of processing, who runs the installation, and which vendors process data on the operator’s behalf.
Consent and communication
Separate account and loyalty updates from marketing offers, and keep the consent record that supports each channel.
Rights and retention
Set a process for access, export, correction, deletion, dispute handling, and retention across live data, backups, logs, and external systems.
Data map
List every place member data can travel.
The server is one part of the processing chain.
Application and database
Record the hosting region, access policy, encryption, backup location, and administrator responsibilities.
Email and messaging
Treat the selected mail provider as part of the data map and configure member preferences before campaigns begin.
Optional services
Add analytics, AI writing, commerce, webhooks, or other integrations only after reviewing what they receive and why.
Member rights
Test the privacy workflow before launch.
A policy needs a working path inside the product and an operator who can complete the request.
-
1
Review the member privacy page
Confirm the member can inspect business relationships and download the documented data export.
-
2
Test business-level deletion
Verify the effect on cards, points, stamps, vouchers, passes, and history for one business.
-
3
Test account deletion
Confirm the cross-business effect and the one-time-code confirmation.
-
4
Document backup treatment
State how deletion requests interact with backup retention and restore procedures.
Product and operating limits
Know what self-hosting does not settle.
- No software purchase makes an organization GDPR compliant. Deployment, configuration, policy, lawful basis, contracts, staff practice, and security determine the result.
- Self-hosting does not mean “no processors.” Hosting, email, monitoring, analytics, payment, AI, or integration vendors may still process personal data.
- This page explains product controls and operating questions. It is not legal advice, and the operator should obtain advice for its jurisdiction and use case.
Implementation guides
Use current documentation for changing details.
Requirements, interfaces, settings, limits, and release behavior belong in the maintained product documentation.