This document is a draft for the Vientiane pilot. It requires review by qualified legal counsel in Lao PDR before you rely on it.
Privacy Policy
Last updated: 28 June 2026
Version: 2026-06-01
1. Introduction
ReLoop (“ReLoop”, “we”, “us”, or “our”) operates a mobile marketplace that connects consumers with local stores offering discounted surplus food in Vientiane, Lao PDR. Our mission is to help people save money while reducing food waste.
This Privacy Policy (“Policy”) explains how we collect, use, disclose, and protect personal information when you use the ReLoop mobile application (“App”), our website (if any), and related services (collectively, the “Platform” or “Services”).
This Policy applies to:
- Customers — individuals who browse, reserve, and purchase surplus food through the App;
- Partners — businesses and their authorized staff who list surplus food and fulfill orders through the App; and
- Visitors — individuals who visit our website or contact us without creating an account.
Please read this Policy together with our Terms of Service, Partner Agreement (if you are a Partner), and Community Guidelines.
If you do not agree with this Policy, please do not use the Platform.
2. Who is responsible for your information?
The data controller responsible for your personal information is:
[ReLoop Company Legal Name]
[Street Address]
Vientiane, Lao PDR
Email: privacy@reloop.la
For questions about this Policy or to exercise your privacy rights, contact us at privacy@reloop.la.
3. Definitions
| Term | Meaning |
|---|---|
| Customer | A user with a customer account who purchases surplus food from Partners. |
| Partner | A business (e.g. café, bakery, grocery store) registered on the Platform to sell surplus food, and its authorized representatives. |
| Personal information | Information that identifies or can reasonably be linked to an individual. |
| Surplus listing | A product listing for discounted surplus food offered by a Partner. |
| Order | A reservation or purchase of one or more surplus listings, including payment and pickup. |
| Service providers | Third parties that process personal information on our behalf (e.g. hosting, payments, analytics). |
4. Information we collect
The information we collect depends on how you use the Platform and your relationship with us.
4.1 Information we collect from Customers
A. Information needed to use the App
To create an account and use core features, we collect:
| Data | Examples | Why we need it |
|---|---|---|
| Account credentials | Email address, phone number (if used for sign-in), password (stored hashed by our auth provider) | Create and secure your account |
| Profile information | Display name, preferred language (Lao or English), role selection (customer) | Personalize the App and route you to the correct experience |
| Order information | Items reserved or purchased, quantities, prices in LAK, order status, pickup codes, pickup windows | Process and fulfill your orders |
| Payment references | Order ID, transaction reference, payment status from our payment provider — we do not store your full bank or card credentials | Confirm payment and prevent fraud |
| Communications | Messages you send to customer support | Respond to your requests |
Legal basis: Performance of our contract with you; compliance with legal obligations; legitimate interests in operating a secure marketplace.
B. Information you choose to provide
You may optionally provide:
- Profile photo or preferences (e.g. favorites, when available);
- Feedback, survey responses, or support messages;
- Dietary preferences or allergy information only if you voluntarily share them with us or a Partner (e.g. in a support message).
We do not require sensitive health information. If you choose to share it, we process it only to handle your specific request.
C. Information collected automatically
When you use the App, we and our service providers may automatically collect:
| Data | Examples | Purpose |
|---|---|---|
| Device and app data | Device type, operating system, app version, unique device identifiers, crash logs | Security, debugging, and app improvement |
| Usage data | Screens viewed, features used, taps, session duration, search and browse activity | Improve the Platform and user experience |
| Log data | IP address, access times, error reports | Security and fraud prevention |
| Push notification token | Device token for push notifications (if enabled) | Send order updates and service messages |
| Approximate location | Coarse location derived from IP or device settings (if you enable location services) | Show nearby stores and listings |
Legal basis: Legitimate interests in operating, securing, and improving the Platform; your consent where required (e.g. location, push notifications).
D. Information from third-party sign-in (if enabled)
If you choose to sign in with a third-party service (e.g. Google, Facebook, or Apple), that service may share information such as your name and email address according to your settings with that provider. We do not receive your third-party password.
Legal basis: Your consent and performance of our contract with you.
4.2 Information we collect from Partners
A. Information needed to operate a Partner account
| Data | Examples | Why we need it |
|---|---|---|
| Business information | Store name, business address, store hours, business category, approval status | List your store on the Platform and display it to Customers |
| Contact information | Name, email, phone number of the account owner or authorized staff | Account management, support, and order notifications |
| Listing content | Titles, descriptions, prices in LAK, quantities, pickup windows, photos of surplus food | Publish and manage surplus listings |
| Order and fulfillment data | Incoming orders, pickup confirmations, revenue summaries | Operate the vendor side of the marketplace |
| Payment and settlement references | Payout-related records as applicable in the pilot | Reconcile transactions and support Partners |
Legal basis: Performance of our Partner Agreement; legitimate interests in operating the Platform.
B. Information collected automatically
Same categories as in Section 4.1(C) apply to Partner accounts, including device data, usage data, and push tokens for new-order alerts.
4.3 Information we collect from all users
- Support and correspondence — records of emails, in-app messages, and complaints;
- Legal and compliance — records needed to comply with law, resolve disputes, and enforce our terms;
- Consent records — timestamps showing acceptance of terms and privacy policy (e.g.
terms_accepted_at).
5. How we use personal information
We use personal information to:
- Provide the Services — register accounts, display listings, process orders, facilitate payment through third-party providers, and enable pickup;
- Communicate with you — send transactional messages (order confirmations, pickup codes, account notices) and, with consent where required, marketing messages;
- Operate the marketplace — approve Partners, moderate content, prevent fraud, and enforce our policies;
- Improve and develop the Platform — analytics, troubleshooting, and new features;
- Ensure security — detect abuse, unauthorized access, and technical issues;
- Comply with law — respond to lawful requests and maintain records required by applicable regulations;
- Protect our rights — establish, exercise, or defend legal claims.
We do not use your personal information for automated decision-making that produces legal or similarly significant effects without appropriate safeguards and notice where required by law.
6. How we share personal information
We share personal information only as described below.
6.1 Between Customers and Partners
When you place an Order, we share information necessary to fulfill pickup, such as:
- Your first name or display name;
- Order details (items, quantity, pickup window);
- Pickup verification code (to the Partner only).
We do not share your full payment credentials with Partners. Partners receive confirmation that payment was completed.
6.2 Service providers
We use trusted third parties to help us operate the Platform. They process personal information only on our instructions and for the purposes described in this Policy. Categories include:
| Provider type | Examples of processing | Location (typical) |
|---|---|---|
| Cloud hosting and database | Account storage, orders, listings | Singapore (Supabase) |
| Authentication | Sign-in, session management | As configured with our hosting provider |
| File storage | Listing and store images | As configured with our hosting provider |
| Payment processing | Payment links, transaction status, webhooks | Lao PDR / as operated by PhaJay, BCEL, or successor providers |
| Crash and error reporting | Crash logs and diagnostics | As configured (e.g. Sentry) |
| Push notifications | Delivering device notifications | As configured with app platform providers |
| Email / SMS (if used) | Verification and service messages | As configured |
A current list of material subprocessors is available on request at privacy@reloop.la.
6.3 Legal and safety reasons
We may disclose information if we believe in good faith that disclosure is necessary to:
- Comply with applicable law, regulation, legal process, or governmental request;
- Enforce our terms and policies;
- Protect the rights, property, or safety of ReLoop, our users, Partners, or the public.
6.4 Business transfers
If ReLoop is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any change in controller or material change to this Policy where required by law.
6.5 We do not sell your personal information
We do not sell personal information to data brokers. We do not share personal information with third parties for their independent marketing without your consent.
7. International data transfers
ReLoop is based in Lao PDR. Our technology infrastructure may process and store personal information in countries outside Lao PDR, including Singapore, where our database and application hosting providers operate.
When we transfer personal information across borders, we implement appropriate safeguards, such as:
- Contractual data protection terms with service providers;
- Technical security measures (encryption in transit, access controls);
- Collecting your consent at account registration, where required under applicable Lao data protection law.
By creating an account and using the Platform, you acknowledge that your information may be processed outside Lao PDR as described in this Policy.
8. Retention
We retain personal information only as long as necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.
| Data category | Typical retention |
|---|---|
| Account and profile | While your account is active, plus a reasonable period after deletion for backup and legal compliance |
| Orders and payment records | As required for tax, accounting, and dispute resolution (often several years) |
| Support communications | Up to [24] months after resolution, unless needed for disputes |
| Logs and analytics | [12] months or shorter where feasible |
| Consent records | For the life of the account plus applicable statutory period |
You may request account deletion as described in Section 10. Some information may be retained in anonymized or aggregated form, or where we have a legal obligation to retain it.
9. Security
We implement technical and organizational measures designed to protect personal information, including:
- Encryption of data in transit (HTTPS/TLS);
- Access controls and row-level security on application data;
- Restricting production secrets and payment credentials to secure server environments (not in the mobile app);
- Monitoring for unauthorized access and security incidents.
No method of transmission or storage is completely secure. If you believe your account has been compromised, contact support@reloop.la immediately.
10. Your rights and choices
Depending on applicable law in Lao PDR and other jurisdictions that may apply to you, you may have the right to:
| Right | How to exercise it |
|---|---|
| Access | Request a copy of personal information we hold about you |
| Correction | Update inaccurate information in the App profile or contact us |
| Deletion | Request deletion of your account and associated personal information, subject to legal retention requirements |
| Withdraw consent | Where processing is based on consent (e.g. marketing, optional location), withdraw consent in device or app settings |
| Object or restrict | Object to certain processing based on legitimate interests, where applicable |
| Complaint | Lodge a complaint with a relevant data protection authority |
To exercise these rights, email privacy@reloop.la with the subject line “Privacy Request”. We may need to verify your identity before responding. We will respond within a reasonable time as required by applicable law.
Device permissions: You can control camera, photo library, location, and notification permissions in your device settings. Some features may not work without required permissions (e.g. uploading listing photos requires camera or photo access for Partners).
Marketing: You may opt out of promotional messages by following unsubscribe instructions or contacting us. You will still receive transactional messages related to orders and your account.
11. Children
The Platform is not directed to children under 13 years of age (or the minimum age required in Lao PDR). We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact privacy@reloop.la and we will take steps to delete it.
12. Third-party links and services
The Platform may link to third-party websites or payment flows (e.g. your bank app for BCEL One / OnePay). Those third parties have their own privacy policies. We are not responsible for their practices. We encourage you to review their policies before providing information to them.
13. Changes to this Policy
We may update this Policy from time to time. When we make material changes, we will:
- Update the “Last updated” date and version number;
- Notify you through the App, email, or another reasonable method; and
- Where required, seek your renewed consent.
Your continued use of the Platform after the effective date of an updated Policy constitutes acceptance of the changes, except where applicable law requires otherwise.
14. Contact us
[ReLoop Company Legal Name]
[Street Address], Vientiane, Lao PDR
- Privacy: privacy@reloop.la
- General support: support@reloop.la
- Legal: legal@reloop.la
This document should be read together with the Terms of Service. A Lao language version should be published alongside this English version before public launch.