Privacy policy
Last updated: October 21, 2026
In case of discrepancy, the French version prevails.
In short: we collect as little as possible, we sell nothing, we use no advertising cookies on this site, and you can see, correct or delete your information at any time.
On this page
- 1. Who we are
- 2. The information we collect
- If you visit this website
- If you request a demo or write to us
- If you join the waiting list
- If you talk to the website’s AI assistant
- If your business subscribes
- 3. Why we use it
- 4. If you have a card from a business
- 5. Who can access it
- 6. Our service providers and where your information is
- 7. How long we keep it
- 8. Security
- 9. Your rights
- 10. Depending on your country
- In Quebec and elsewhere in Canada
- In the European Union and the United Kingdom
- Elsewhere
- 11. Our internal rules
- 12. Our messages
- 13. Cookies
- 14. Incidents
- 15. Age
- 16. Changes
- 17. Contact us
1. Who we are
HoorayPass is a service of Ludolith. This website and the platform are published by 9558-3936 Québec inc., doing business as Ludolith. It is a corporation incorporated in Quebec (Canada), Quebec enterprise number (NEQ) 1181697518. Our person in charge of the protection of personal information answers at [email protected].
2. The information we collect
If you visit this website
Your IP address and your browser’s technical information pass through our security provider, Cloudflare, to protect the site against attacks and bots. We do not measure this website’s traffic. We use no advertising cookies.
If you request a demo or write to us
Your first name, your business name and city or address, your trade, your phone or email, the time that suits you, and whatever you choose to write. If you tick the box, your agreement to receive our news, with the date and the exact text accepted.
If you join the waiting list
Your email, your business name if you give it, your language and the date. We use it for one thing only: to write to you on opening day. Your IP address, truncated, is only used to block abuse.
If you talk to the website’s AI assistant
The assistant is an artificial intelligence: it says so in its first message. We keep your questions, the answers and the pages viewed during the conversation, without your name or contact details, and after removing any email address or phone number you may have typed. We keep them for 30 days, to answer, improve the answers and spot unanswered questions. Your questions are processed by the artificial intelligence provider listed in our subprocessors, without being used to train its models. No decision about you is made automatically: a person can take over at any time.
If your business subscribes
The business’s legal name and address. The names and contact details of people with access (owner, managers), their logins and two-factor authentication. Signed documents: service agreement, data processing agreement, Google authorization, privacy impact assessment. Billing history and our support exchanges. Your payment is processed by Stripe: we never see your full card number.
3. Why we use it
To answer your request and arrange the demo; to provide the service to your business, bill it and help you; to protect the site and platform against fraud; to meet our legal and tax obligations; to send you our news, only if you agreed. We don’t sell or rent any information. We don’t do advertising profiling.
4. If you have a card from a business
When you join a business’s loyalty program, that business is responsible for your information. HoorayPass hosts and processes it on the business’s behalf, following its instructions and under a contract that protects confidentiality. We never use it for ourselves. The business’s policy is on the back of your card, with the “My data” link to view, download or delete your information.
5. Who can access it
The Ludolith team, only as needed for the work, and the service providers below, each for its own service. A reseller or agency only accesses a business’s information if that business gave it a written mandate.
6. Our service providers and where your information is
Our servers are in the Netherlands, in the European Union, and are run by Ludolith. They are subject to the General Data Protection Regulation (GDPR). Our emails leave from our own mail server, in the same place. Some providers are outside Quebec, mostly in the United States. We only give them what their service requires. The table only shows the providers we use today.
| Provider | What for | Where |
|---|---|---|
| Production host | Servers and database, run by Ludolith (9558-3936 Québec inc.) | Netherlands (GDPR) |
| Cloudflare | Proxy, protection, bot protection | Global network, headquarters in the United States |
| Ludolith mail server (Stalwart) | Emails to members and merchants: card link, codes, promotions, service notices | Netherlands (GDPR), on Ludolith's servers |
| Encrypted backup storage, copy 1 | Cloudflare R2: one Restic repository encrypted before upload, in a shared bucket; project-specific prefix and storage credentials shared with server backups | Storage region unconfirmed; no EU jurisdiction restriction established |
| Anthropic (Claude API) | Writing, suggestions, receipt reading, assistant | Processing locations declared by Anthropic; account region unconfirmed |
| Stripe | Collection of card payments selected by businesses; online sales for a business that requested it; billing ledger maintained by HoorayPass | United States, Ireland and other locations declared by Stripe; account locations to confirm |
7. How long we keep it
A demo request that goes nowhere: 12 months at most after our last exchange, then we delete it. A waiting list sign-up: 12 months at most, then we delete it. A conversation with the assistant: 30 days. A subscribed business’s information: for the length of the contract, then as long as tax law requires for invoices. Your consent to our news: until you unsubscribe, then 3 years without your contact details, to prove your choice.
8. Security
Encrypted connections, limited and logged access, mandatory two-factor authentication for merchants, separation of each business’s data.
Backups are encrypted by Restic before upload to Cloudflare R2. One repository is used, in a bucket shared with server backups, with a project-specific prefix and shared storage credentials. The storage region is unconfirmed; no Canadian or European copy or second independent target is attested.
9. Your rights
At any time, you can ask to see your information or have it corrected. You can also ask to receive a copy in a common format, to withdraw your consent or to have it deleted. Write to our person in charge of the protection of personal information: [email protected]. We reply within 30 days. If our answer does not satisfy you, you can file a complaint with the authority of your country (see the next section).
10. Depending on your country
We apply these rights to everyone, wherever you live. Some laws add more.
In Quebec and elsewhere in Canada
We follow Quebec’s law on the protection of personal information in the private sector. You can file a complaint with Quebec’s Commission d’accès à l’information. Elsewhere in Canada, you can also contact the Office of the Privacy Commissioner of Canada.
In the European Union and the United Kingdom
The GDPR, or its United Kingdom version, also gives you the right to restrict processing and to object to it. We process your information to answer your request, for the contract with your business, for our legal obligations, to protect the site (our legitimate interest) and, with your consent, for our news. You can file a complaint with the data protection authority of your country. In the United Kingdom, it is the Information Commissioner’s Office (ICO).
Elsewhere
If the law of your country gives you other rights, write to us at [email protected]. We respect them.
11. Our internal rules
Our internal rules cover the whole life of your information: who can access it, how long we keep it and how we destroy it. Our person in charge of the protection of personal information enforces them and handles complaints. For a complaint, write to [email protected]. We reply within 30 days.
12. Our messages
We write to answer your request and, if you subscribe, about the service and billing. Our news only goes out with your consent. Every email includes an unsubscribe link that takes effect immediately.
13. Cookies
This site only uses the cookies it needs to work and no advertising cookies.
| Cookie | What it’s for | Duration | Set by |
|---|---|---|---|
NEXT_LOCALE | Remember the language you chose. | Until you close your browser | HoorayPass |
__cf_bm | Tell people apart from bots, to protect the site. | 30 minutes | Cloudflare |
cf_clearance | Remember that an anti-bot check succeeded, so it isn’t repeated on every page. | A few hours at most | Cloudflare |
__Host-hp_acces | Keep the HoorayPass team signed in while we work before opening. For the team only. | 24 hours | HoorayPass |
CF_Authorization | Check the team’s access through Cloudflare Access. For the team only. | Until the team session ends | Cloudflare |
What about analytics?
We do not measure this website’s traffic for now. If we ever do, it will be without cookies, and this page will say so first.
Businesses’ sign-up pages
The sign-up page for a business’s card may use Meta and Google advertising cookies. Two conditions apply: that business turned it on, and you accept in a banner. Declining changes nothing about your card.
Here is the banner as it appears on the sign-up page of a business that turned on ad measurement. Both buttons have the same size and colour. Nothing is saved here.
ExampleTry the banner
Advertising cookies
Café des Habitués would like to use Meta and Google cookies to measure its ads. Declining changes nothing to your sign-up.
Staying in control
You can delete or block cookies in your browser settings. The site will work the same way: the language follows the page address.
14. Incidents
We record every privacy incident in a register. If it presents a risk of serious harm, we notify the Commission d’accès à l’information and the people concerned. If it involves a business’s members, we also notify that business, without delay.
15. Age
This site and our services are meant for merchants. We don’t knowingly collect information about people under 14.
16. Changes
If we make significant changes to this policy, we note it at the top of this page and notify subscribed businesses by email at least 30 days in advance.
17. Contact us
9558-3936 Québec inc., doing business as Ludolith, https://ludolith.com. Email: [email protected]. Privacy: [email protected]. Phone: +1 (263) 378-9160.