Privacy Policy

Last updated: 5 October 2026

This policy explains how Magical Insights LDA, trading as Yalt (“Yalt”, “we”, “us”), handles personal data when you visit yalt.co, contact us, use our business services, or interact with us as a customer or business user. Yalt provides loyalty and customer engagement technology to businesses, including tools for digital loyalty programmes, customer relationship management and marketing communications.

Who is responsible for your data?

Magical Insights LDA is the controller for personal data collected for its own website, enquiries, sales, account administration, billing and business operations. Its business identification number (NIPC) is 517 845 164. Its company address is Rua 1.º de Maio 81, Loja E, Piso 1, 7300-205 Portalegre, Portugal. You can contact us at hello@yalt.co.

When a business customer uses Yalt to run its loyalty programme or communicate with its customers, that business decides why and how its customers’ data is used. The business is the controller for that programme data; Yalt processes it on the business’s behalf and under its instructions, as a processor. The business’s own privacy notice applies to its programme. Contact the business directly to exercise rights relating to that programme. Yalt remains responsible for data it uses for its own purposes, such as operating and securing the service and administering the customer’s account.

Data we handle and why

Depending on how you interact with us, we may handle:

• Website visitors: technical and usage information such as IP address, browser and device details, pages visited, cookie choices and approximate location derived from technical data. We use this to deliver, protect and improve the website and, where permitted, measure its performance.
• People who contact or do business with us: name, business contact details, company, role, enquiry contents, correspondence, account and service administration details, and billing records. We use these to respond, provide and manage services, communicate with customers, and meet legal and accounting obligations.
• Business users and loyalty programme participants: the information a business customer chooses to collect and submit through its Yalt programme. This can include contact details, membership identifiers, transactions, points, rewards, preferences and interactions. The business customer determines the programme data and purposes; Yalt handles it to provide, maintain, secure and support the service under that customer’s instructions.

If you are a member and ask us to delete your Yalt account, our account-deletion information says we process the request within 48 hours. We anonymise your interactions with businesses and may keep the anonymised records for security for up to five years.

Please do not send us sensitive personal data unless it is necessary and the relevant business has a lawful basis to collect it.

Legal grounds

Where data protection law requires a legal basis, we rely on the basis that applies to the particular purpose: taking steps at your request or performing a contract; complying with a legal obligation; our legitimate interests in operating, securing and improving our business, provided those interests do not override your rights; or your consent, for example where consent is required for non-essential cookies or certain communications. You can withdraw consent at any time; this does not affect processing already carried out.

For programme data processed on behalf of a business customer, that customer is responsible for establishing the legal basis for collecting and using the data. Yalt processes that data under the customer’s documented instructions and applicable data processing terms.

Cookies and similar technologies

Our website uses essential technologies to provide its features and may use analytics or other optional technologies according to your choices and applicable law. You can review or change your choices using the cookie preferences control on the website. Blocking essential technologies may affect how the website works. The cookie preference tool describes the categories and examples used on the site.

The website’s cookie information lists Google Analytics cookies `_ga` (up to two years) and `_gid` (one day). Google Tag Manager is configured to deliver website tags. PostHog is configured for website analytics and technical error monitoring, with event ingestion sent to its EU endpoint. Chatwoot provides the website support chat, and SendGrid is configured to deliver service emails. Optional analytics and advertising storage are controlled through the cookie preference tool where required by law.

Who receives data

We may make data available to our personnel and to service providers that help us host, operate, secure, analyse or support our website and services, as well as professional advisers and public authorities where required by law. They may use the data only for their assigned purposes and subject to applicable safeguards. For loyalty programme data, we act on the business customer’s instructions; the customer determines any disclosures to its own partners or recipients.

When a business customer connects a point-of-sale, e-commerce, payment or messaging system to its Yalt programme, we may exchange the relevant programme data with that system as configured by the customer. The customer decides which integrations to use, and the connected provider’s own privacy terms may also apply.

When Yalt processes programme data as a processor, we use it to provide the service under the business customer’s instructions and do not determine independent advertising purposes for that data.

International transfers

If personal data is accessed or processed outside the European Economic Area, we use a transfer mechanism required by applicable law, such as an adequacy decision or appropriate contractual safeguards, and take supplementary measures where needed. Contact us for information about the safeguards relevant to a particular transfer.

How long we keep data

We keep personal data only for as long as needed for the purpose for which it was collected, including service delivery, security, dispute resolution and legal or accounting requirements. For programme data, the business customer’s instructions and our service agreement govern retention and deletion. When the service ends, we return or delete that data as required by the agreement and applicable law, subject to any legal retention obligations. For member account deletion requests, we state that we process the request within 48 hours and retain anonymised interactions with businesses for security for no more than five years.

Your rights

Depending on the circumstances and applicable law, you may ask for access, correction, deletion, restriction or portability of your personal data, object to certain processing, or withdraw consent. To make a request about data Yalt controls, email hello@yalt.co. If your request concerns a loyalty programme run by one of our business customers, contact that business first; we will assist it as required by our agreement and law.

You may also lodge a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), or with the supervisory authority where you live or work. We invite you to contact us first so we can try to address your concern.

Security and children

We use technical and organisational measures designed to protect personal data. No method of transmission or storage is completely secure. Our business services are intended for businesses and are not directed to children. A business customer is responsible for ensuring its programme is appropriate for its audience and complies with applicable law.

Changes and contact

We may update this policy as our services or legal requirements change. The revised version will be posted here with a new “Last updated” date. For privacy questions or requests, contact Magical Insights LDA at hello@yalt.co or at the postal address above.