We are working on a Lao version for this document.
Privacy Policy
Last updated: 15 September 2026
Version: 2026-09-15
1. Introduction
ReLoop (“ReLoop”, “we”, “us”, or “our”) operates a mobile marketplace that connects consumers with local stores offering discounted surplus food in Vientiane, Lao PDR. Our mission is to help people save money while reducing food waste.
This Privacy Policy (“Policy”) explains how we collect, use, disclose, and protect personal information when you use the ReLoop mobile application (“App”), our website, and related services (collectively, the “Platform” or “Services”).
This Policy applies to:
- Customers — individuals who browse, reserve, and purchase surplus food through the App;
- Partners — businesses and their authorized staff who list surplus food and fulfill orders through the App; and
- Visitors — individuals who visit our website or contact us without creating an account.
Please read this Policy together with our Terms of Service, Partner Agreement (if you are a Partner), and Community Guidelines.
If you do not agree with this Policy, please do not use the Platform.
2. Who is responsible for your information?
The data controller responsible for your personal information is:
LBY Limited
Remote Office
Vientiane, Lao PDR
Email: admin@lbylimited.com
The ReLoop App Store account and listing are under the name Latsanivong Yommalath. The product is operated by LBY Limited.
For questions about this Policy or to exercise your privacy rights, contact us at admin@lbylimited.com.
3. Definitions
| Term | Meaning |
|---|---|
| Customer | A user with a customer account who purchases surplus food from Partners. |
| Partner | A business (e.g. café, bakery, grocery store) registered on the Platform to sell surplus food, and its authorized representatives. |
| Personal information | Information that identifies or can reasonably be linked to an individual. |
| Surplus listing | A product listing for discounted surplus food offered by a Partner. |
| Order | A reservation or purchase of one or more surplus listings, including payment and pickup. |
| Payment proof | A screenshot or image you upload showing a bank transfer for an Order (typically via BCEL One). |
| Service providers | Third parties that process personal information on our behalf (e.g. hosting, maps, email, crash reporting). |
4. Information we collect
The information we collect depends on how you use the Platform and your relationship with us.
4.1 Information we collect from Customers
A. Information needed to use the App
To create an account and use core features, we collect:
| Data | Examples | Why we need it |
|---|---|---|
| Account credentials | Email address, password (stored hashed by our auth provider) | Create and secure your account |
| Profile information | Display name, phone number, address line, city, bio (optional), preferred language (Lao or English), active portal (customer or vendor) | Personalize the App and route you to the correct experience |
| Order information | Items reserved or purchased, quantities, prices in LAK, order status (including awaiting confirmation), pickup codes, pickup windows | Process and fulfill your orders |
| Payment proofs | Screenshots of bank transfers you upload after paying via BCEL One QR — images may show name, partial account details, amount, and time. We do not store your bank login password or card credentials | Confirm payment (reviewed by Reloop staff/ops) and prevent fraud |
| Payment references | Order ID, payment status, gateway label (e.g. manual bank), confirmation timestamps | Reconcile payment and dispute resolution |
| Favorites | Listings you save as favorites | Show your saved listings |
| Reviews and ratings | Star ratings and review text you submit about Partners or listings | Operate marketplace feedback |
| Reports | In-app content or order reports (reason codes and optional free-text details) | Safety, moderation, and support |
| Communications | Messages you send to customer support or via our website contact form | Respond to your requests |
Current payment path: During the pilot, you transfer funds using a BCEL One QR shown in the App, then upload a payment proof. Reloop staff confirm the transfer before the Order is marked paid. Automated payment-provider webhooks (e.g. PhaJay) are not the current confirmation method; they may be introduced later under updated terms.
Legal basis: Performance of our contract with you; compliance with legal obligations; legitimate interests in operating a secure marketplace.
B. Information you choose to provide
You may optionally provide:
- Bio or additional profile details;
- Feedback, survey responses, or support messages;
- Dietary preferences or allergy information only if you voluntarily share them with us or a Partner (e.g. in a support message or report).
We do not require sensitive health information. If you choose to share it, we process it only to handle your specific request.
C. Information collected automatically
When you use the App, we and our service providers may automatically collect:
| Data | Examples | Purpose |
|---|---|---|
| Device and app data | Device type, operating system, app version, unique device identifiers | Security, debugging, and app improvement |
| Diagnostics | Crash logs and limited performance traces (when crash reporting is enabled, e.g. Sentry) | Stability and troubleshooting |
| Log data | IP address, access times, error reports | Security and fraud prevention |
| Push notification token | Device token for push notifications (if enabled) | Send order updates and service messages |
| Device location | GPS or similar device location when you enable location services (balanced accuracy for nearby discovery, maps, and routes) | Show nearby stores, set pins, and estimate travel |
We do not currently operate a separate product-analytics SDK that records every screen tap or session for advertising. Diagnostics are limited to crash and performance reporting when enabled.
Legal basis: Legitimate interests in operating, securing, and improving the Platform; your consent where required (e.g. location, push notifications).
D. Information from third-party sign-in
You may create an account or sign in with email and password, Google, or Apple. If you use Google or Apple, that provider may share information such as your name and email address according to your settings with that provider. We do not receive your third-party password. Facebook sign-in is not offered.
Legal basis: Your consent and performance of our contract with you.
4.2 Information we collect from Partners
A. Information needed to operate a Partner account
| Data | Examples | Why we need it |
|---|---|---|
| Business information | Store name, business address, map pin (lat/lng), Google Place ID (if set), store hours, approval status | List your store on the Platform and display it to Customers |
| Contact information | Name, email, phone number of the account owner or authorized staff | Account management, support, and order notifications |
| Listing content | Titles, descriptions, prices in LAK, quantities, pickup windows, photos of surplus food, logo/banner images | Publish and manage surplus listings |
| Order and fulfillment data | Incoming orders, pickup confirmations, revenue summaries | Operate the vendor side of the marketplace |
| Payment and settlement references | Payout-related records as applicable in the pilot | Reconcile transactions and support Partners |
Legal basis: Performance of our Partner Agreement; legitimate interests in operating the Platform.
B. Information collected automatically
Same categories as in Section 4.1(C) apply to Partner accounts, including device data, diagnostics, and push tokens for new-order alerts. Partners may use the device camera in-app to scan a Customer pickup QR code; camera frames from that scan are not uploaded to our servers.
4.3 Information we collect from Visitors
When you use our website contact form, we collect your name (optional), email, subject, and message. That content is emailed to us via our email delivery provider (Resend).
4.4 Information we collect from all users
- Support and correspondence — records of emails, in-app messages, reports, and complaints;
- Legal and compliance — records needed to comply with law, resolve disputes, and enforce our terms;
- Consent records — timestamps showing acceptance of terms and privacy policy (e.g.
terms_accepted_at,terms_version).
5. How we use personal information
We use personal information to:
- Provide the Services — register accounts, display listings, process orders, review payment proofs, confirm payment, and enable pickup;
- Communicate with you — send transactional messages (order confirmations, payment approved, pickup codes, account notices) and, with consent where required, marketing messages;
- Operate the marketplace — approve Partners, moderate content and reports, prevent fraud, and enforce our policies;
- Improve and develop the Platform — troubleshooting, diagnostics, and new features;
- Ensure security — detect abuse, unauthorized access, and technical issues;
- Comply with law — respond to lawful requests and maintain records required by applicable regulations;
- Protect our rights — establish, exercise, or defend legal claims.
We do not use your personal information for automated decision-making that produces legal or similarly significant effects without appropriate safeguards and notice where required by law.
6. How we share personal information
We share personal information only as described below.
6.1 Between Customers and Partners
When you place an Order, we share information necessary to fulfill pickup, such as:
- Your first name or display name;
- Order details (items, quantity, pickup window);
- Pickup verification code (to the Partner only).
We do not share your bank login credentials or full payment-proof images with Partners. Partners receive confirmation that payment was completed after Reloop confirms the transfer.
6.2 Service providers
We use trusted third parties to help us operate the Platform. They process personal information only on our instructions and for the purposes described in this Policy. Categories include:
| Provider type | Examples of processing | Location (typical) |
|---|---|---|
| Cloud hosting and database | Account storage, orders, listings, payment-proof files | Singapore (Supabase) |
| Authentication | Sign-in, session management (email, Google, Apple) | As configured with Supabase Auth |
| File storage | Listing, store, and payment-proof images | As configured with Supabase Storage |
| Maps and geocoding | Address geocode, reverse geocode, routes | Google Maps Platform (via our Edge Functions) |
| Manual bank confirmation | Staff review of payment proofs; bank transfer via BCEL One | Lao PDR (ops) / customer’s bank app |
| Crash and error reporting | Crash logs and diagnostics (when enabled) | As configured (e.g. Sentry) |
| Push notifications | Delivering device notifications | Apple / Google push infrastructure |
| Transactional email | Auth emails; website contact form delivery | As configured (e.g. Resend; Supabase Auth email) |
A current list of material subprocessors is available on request at admin@lbylimited.com.
Future payment gateways: If we enable automated providers (e.g. PhaJay) later, we will update this Policy and share transaction status with those providers as needed to process payment.
6.3 Legal and safety reasons
We may disclose information if we believe in good faith that disclosure is necessary to:
- Comply with applicable law, regulation, legal process, or governmental request;
- Enforce our terms and policies;
- Protect the rights, property, or safety of ReLoop, our users, Partners, or the public.
6.4 Business transfers
If ReLoop is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any change in controller or material change to this Policy where required by law.
6.5 We do not sell your personal information
We do not sell personal information to data brokers. We do not share personal information with third parties for their independent marketing without your consent.
7. International data transfers
ReLoop is based in Lao PDR. Our technology infrastructure may process and store personal information in countries outside Lao PDR, including Singapore, where our database and application hosting providers operate, and other regions used by maps, crash reporting, or email providers.
When we transfer personal information across borders, we implement appropriate safeguards, such as:
- Contractual data protection terms with service providers;
- Technical security measures (encryption in transit, access controls);
- Collecting your consent at account registration, where required under applicable Lao data protection law.
By creating an account and using the Platform, you acknowledge that your information may be processed outside Lao PDR as described in this Policy.
8. Retention
We retain personal information only as long as necessary for the purposes described in this Policy, unless a longer period is required or permitted by law. Periods below are operational defaults for the pilot and subject to counsel review.
| Data category | Typical retention |
|---|---|
| Account and profile | While your account is active, plus a reasonable period after deletion for backup and legal compliance |
| Orders and payment records | As required for tax, accounting, and dispute resolution (often several years), including payment-proof images linked to Orders |
| Closed Partner store rows | May remain when linked to order history (foreign keys); marketing contact/location/logo data removed; public listings and store reviews removed (ADR 0009) |
| Support communications | Up to 24 months after resolution, unless needed for disputes |
| Logs and diagnostics | Up to 12 months or shorter where feasible |
| Consent records | For the life of the account plus applicable statutory period |
Account and store deletion: You may delete your account in the App (Customer → Manage Account) or by emailing admin@lbylimited.com. Partners may delete their store in the App without deleting their login; the same Auth user may continue as a Customer. Some information may be retained in anonymized or aggregated form, or where we have a legal obligation to retain it (e.g. order history, receipt labels).
9. Security
We implement technical and organizational measures designed to protect personal information, including:
- Encryption of data in transit (HTTPS/TLS);
- Access controls and row-level security on application data;
- Restricting production secrets and privileged payment-confirmation tools to secure server environments (not in the mobile app);
- Limiting payment-proof access to authorized ops staff and systems;
- Monitoring for unauthorized access and security incidents.
No method of transmission or storage is completely secure. If you believe your account has been compromised, contact admin@lbylimited.com immediately.
10. Your rights and choices
Depending on applicable law in Lao PDR and other jurisdictions that may apply to you, you may have the right to:
| Right | How to exercise it |
|---|---|
| Access | Request a copy of personal information we hold about you |
| Correction | Update inaccurate information in the App profile or contact us |
| Deletion | Delete your account in the App, or request deletion by email, subject to legal retention requirements |
| Withdraw consent | Where processing is based on consent (e.g. marketing, optional location), withdraw consent in device or app settings |
| Object or restrict | Object to certain processing based on legitimate interests, where applicable |
| Complaint | Lodge a complaint with a relevant data protection authority |
In-app deletion: Prefer Customer → Manage Account → Delete account, or Vendor → Manage Account → Delete store. You may also email admin@lbylimited.com with the subject line “Privacy Request”. We may need to verify your identity before responding. We will respond within a reasonable time as required by applicable law.
Device permissions: You can control camera, photo library, location, and notification permissions in your device settings. Some features may not work without required permissions (e.g. uploading listing photos or payment proofs; scanning a pickup QR). Scanning a customer pickup QR uses the camera in-app and does not upload camera frames.
Marketing: You may opt out of promotional messages by following unsubscribe instructions or contacting us. You will still receive transactional messages related to orders and your account.
11. Children
The Platform is not directed to anyone under 18 years of age (or the age of majority in Lao PDR, if higher). We do not knowingly collect personal information from children. If you believe a minor has provided us personal information, contact admin@lbylimited.com and we will take steps to delete it.
12. Third-party links and services
The Platform may link to third-party websites or payment flows (e.g. your bank app for BCEL One). Those third parties have their own privacy policies. We are not responsible for their practices. We encourage you to review their policies before providing information to them.
13. Changes to this Policy
We may update this Policy from time to time. When we make material changes, we will:
- Update the “Last updated” date and version number;
- Notify you through the App, email, or another reasonable method; and
- Where required, seek your renewed consent.
Your continued use of the Platform after the effective date of an updated Policy constitutes acceptance of the changes, except where applicable law requires otherwise.
14. Contact us
LBY Limited
Remote Office, Vientiane, Lao PDR
Email: admin@lbylimited.com
This document should be read together with the Terms of Service. A Lao language version should be published alongside this English version before public launch.