Passwordless sign-in
A one-time 6-digit code by e-mail, valid for 10 minutes, with a limited number of attempts. The response is the same for existing and non-existing addresses.
Customer data security is built into the solution from day one, not added later. Law No. 195/2024 on personal data protection (Moldova) defines the shopper's rights, and Synngate Loyalty takes into account the requirements of Legea nr. 195/2024: consents, data export and deletion. The store's lawyer agrees the policy texts and program rules.
How data is protected
Protected session
The session is not accessible to page scripts and travels only over HTTPS. The database stores only a fingerprint of the token, and requests are protected against forgery.
Own data only
A customer sees only their own card, receipts and bonuses. This is enforced on the server, not in the interface.
PIN protection
Attempt limits per card, account, address and across the system make a PIN impossible to guess.
Strict browser rules
The app does not call third-party sites: fonts, images and code are our own.
Images without metadata
Uploaded images are re-encoded, and camera data and geotags are removed.
Cabinet on the internal network
The marketer cabinet is reachable only from the internal network, with sign-in by a platform account.
Action log
Sign-in events and cabinet actions are written to a log.
Shopper rights
- Download your own data with one button
- Delete the account: data is anonymized
- Separate consents: service messages and "Offers and news"
- Advertising consents are off by default
- A list of your devices and a notice of sign-in from a new one
Mailings go only to those who gave consent.
Checks
Protection is verified by hundreds of automated checks, including attack scenarios: guessing codes and PINs, attempts to see another person's data.
Staff access
Roles and rights
Rights are granted by role and action: who can view customers, who can change rules.
A key for every point
The till API is bound to the point of sale: one store's key does not work in another.
Exchange logs
Incoming API requests and exchanges with external systems are recorded, so a disputed receipt can be traced.
What stays with you
- The privacy policy and program rules inside the app
- A person responsible for personal data in the company
- The data retention period and how customer requests are handled
- A list of staff with access to the center and the cabinet
Hosting
In our cloud
- You run no servers of your own. We fix the hosting parameters in the contract.
On your server
- Windows or Linux, PostgreSQL or SQL Server database. The data stays in your infrastructure.
We do not replace legal advice. Check the policy, consents and retention period with a lawyer.
Frequently asked questions
Does the solution comply with Law 195/2024?
The solution takes into account the requirements of Legea nr. 195/2024: consents, data export and deletion. A legal assessment for your company is given by a lawyer.
Does the customer have a password?
No. Sign-in uses a one-time e-mail code, so there is nothing to forget or steal.
Who sees customer data?
Staff with rights in the center and the cabinet. Their actions are logged.