Reporting a problem
Found something? Please tell us.
Write to info@easyloyalty.co.uk with enough detail for us to reproduce it. If it is sensitive, say so in the first line and we will find a better channel before you send the detail.
What you can expect: an acknowledgement within two working days, an assessment within five, and we will tell you when it is fixed.
We will not take action against you for reporting a flaw in good faith, and we will credit you if you would like us to.
In return, we ask that you:
- test only against your own account or a demo programme, never against a real shop's members;
- do not access, change or keep anybody else's data, and stop as soon as you have confirmed the problem;
- do not run anything that degrades the service for the shops using it;
- do not use social engineering, or go after our suppliers or our staff; and
- give us a reasonable chance to fix it before telling anybody else.
Those are the usual terms and they exist to protect a shopkeeper's customers rather than to protect us from embarrassment.
If something goes wrong
We have a written incident response process. It sets out what counts as an incident, how quickly each severity is handled, what gets contained first, what is preserved as evidence, and who is told in what order.
Our commitment to a shop using Valence Easy Loyalty: if personal data we hold on your behalf is involved, we will tell you without undue delay and, where reasonably practicable, within 24 hours of becoming aware of it.
That number is not arbitrary. As the controller of your customers' data, you have 72 hours to report a qualifying breach to the Information Commissioner's Office, and you cannot start until we have told you. Our 24 hours is what makes your 72 possible.
We will tell you what is known and what is not, rather than waiting for a complete picture, and we will give you everything you need to make your own report, including help with the wording if that is useful.
The process document itself is operational rather than published: it names where systems and credentials are kept. A shop using Valence Easy Loyalty can ask for a copy, and the data protection agreement provides for that.
How the data is protected
Getting in
- There are no passwords. Signing in uses a one time code or a passkey, so there is nothing to reuse, guess or leak.
- Staff are named individuals with defined roles rather than a shared login, and removing somebody revokes their sessions and passkeys.
- Member searches are recorded: who looked, when, and the search term as a fingerprint. Results are never stored, and no route returns a whole membership.
At rest
- Encrypted in transit and at rest.
- A member's contact address is separately encrypted, with a key derived per shop, so the same person at two programmes produces two unrelated values.
- Opening one requires a stated purpose from a fixed list, enforced in code rather than by policy.
- Backups are encrypted and held separately.
What we do not hold
- No card or payment details. No payment passes through us.
- No street addresses. There is no field for one.
- Nothing extra from an online order: the delivery address, the shopper's IP address, order notes and gift messages are discarded, and a test fails if any of them survives.
In your browser
- No analytics, no advertising pixel, no tag manager, no embedded fonts and no content delivery network.
- Every file comes from us, so using Valence Easy Loyalty makes no request to any other company.
How we build
- Automated tests gate every deployment, including tests written specifically to prove the protections above. A deployment is refused if any of them fails.
- The honest test of a safeguard is to break it deliberately and watch the test fail, and that is how these are written.
- Two third party software libraries in the whole product, one to talk to the database and one for passkeys. Less code from elsewhere is less to go wrong.
Last updated 22 September 2026.