Legal

Privacy Policy

Effective Date: June 1, 2026  ·  Last Updated: October 8, 2026  ·  Version 1.1

1. Who We Are

Lucky Stop Rewards is a loyalty platform operated by Cliff Industries on behalf of Lucky Stop convenience store locations throughout the United States. Cliff Industries is the data controller for purposes of this Privacy Policy.

2. What This Policy Covers

This policy applies to anyone who uses the Lucky Stop Rewards mobile app or the associated web admin portal at admin.luckystop.cliffindus.com, including customers, employees, store managers, and administrators.

3. Information We Collect

When you register

• Phone number: used to verify your identity via OTP and as your account identifier
• Full name: displayed on your account and transaction records
• Age confirmation: you confirm you are 18 or older (and 21 or older before age-restricted offers are shown)
• Birthday (optional, month and day only, no year): used for birthday-month promotions
• App language: English or Spanish, so notifications and promotions reach you in your language

When you use the app

• Transaction history: purchases, credit balances, and redemptions
• Location (optional): used to show your nearest Lucky Stop location; only collected while the app is open and only if you grant permission
• Receipt photos: uploaded by employees to verify transactions; stored securely
• Device token: used to send you push notifications
• Promotions and challenges: which promotion applied to a purchase, the extra cashback it paid you (for promotions with a daily limit), and your challenge progress
• Hot food orders: the items you order for pick-up, any note, the store and the order status
• Referrals: your invite code, who invited you and whom you invited, and the bonuses paid. The other person sees only your first name and last initial

4. How We Use Your Information

• To operate your loyalty account and calculate cashback credits
• To process and verify in-store transactions
• To send you push notifications about offers, order status, and account activity
• To show relevant store locations near you
• To decide which promotions you can use: some are only for a tier and up, new customers, customers who have not visited in a while, or your birthday month. This is worked out inside Lucky Stop from your tier, purchase dates and birthday month, and is never shared with advertisers
• To track challenges and credit their rewards
• To detect and prevent fraud
• To generate store-level analytics for store managers and administrators

5. How We Share Your Information

We do not sell your personal information. We share data only with:

• Lucky Stop store operators: store managers can see transaction history for their location
• Firebase (Google): phone number verification (to confirm a code request comes from the real app, it may use a silent push to your iPhone, Google Play Integrity on Android, or a reCAPTCHA check)
• Expo: push notification delivery, through Apple and Google
• Cloudinary: secure storage for receipt photos and promotional images
• Render / Neon: backend hosting and database infrastructure
• Cloudflare: domain name service and network protection
• Vercel: hosting for the admin portal (staff only)
• Resend: email delivery (account recovery emails)
• Anthropic: suggested Spanish translations of promotion text for our staff; it never receives customer information

All third-party providers are contractually required to process data only as directed by us and to maintain appropriate security standards.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, your personal information is deleted within 30 days. Transaction records are anonymised and retained for billing integrity purposes.

7. Your Rights

• Access: request a copy of the data we hold about you
• Correction: update inaccurate information via your profile settings
• Deletion: delete your account at any time via Profile → Delete My Account, or without the app as described on Delete your account
• Opt out of notifications: disable push notifications in your device settings at any time

8. Children's Privacy

Lucky Stop Rewards is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will delete their account promptly.

9. Security

All data is transmitted over HTTPS. Phone numbers and sensitive fields are encrypted at rest. Receipt photos are stored in a private cloud bucket not accessible to the public. We conduct periodic security reviews of our infrastructure.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date above and notify active users via push notification or in-app message if the changes are material.

11. Contact Us

If you have any questions, requests, or concerns about this Privacy Policy or your personal data, please contact us: