All guides
10 min read
Updated July 29, 2026
Most failed loyalty programs fail in the setup, not the running — a model that does not fit the business, or an earn rate chosen before anyone worked out what it costs. This guide walks the decisions in the order that keeps you out of those traps, with the Canada-specific privacy basics you need before you collect a single phone number. It is general information, not legal advice.
Before choosing any mechanics, name the problem. Do you need customers to visit more often, spend more per visit, come back after a first purchase, or simply stop drifting to a competitor? These call for different designs, and a program built to reward big baskets will do nothing for a frequency problem.
Write the goal in one sentence — "get first-time customers to a second visit", "increase weekday lunch traffic", "keep our top 10% engaged". Every later decision gets measured against that sentence. A program without a stated goal defaults to a generic discount, which is the most expensive kind.
Punch / visit-based ("buy nine, get one free"): dead simple, instantly understood, ideal for cafes and quick-service where frequency is the goal. The limitation is that it cannot express spend — a $3 order and a $30 order earn the same stamp.
Points ("earn one point per dollar"): flexible and the most common. Rewards spend as well as frequency and lets you run bonuses and campaigns. Slightly more to explain, and you have to set the point value carefully.
Tiers ("Silver, Gold, VIP"): layers status onto points to recognise your best customers. Works when the top tier is reachable by your best 5–10% and carries a benefit people actually want. Overkill for a small or new program.
Coalition (shared points across a network of merchants): gets you in front of customers who already hold a balance earned elsewhere. Best when your constraint is new customers rather than retention. The trade-off is less unilateral control over the economics and value that flows between merchants.
This is the step programs most often get wrong. Do not start by picking a nice-sounding rate like "one point per dollar" and hoping. Start from the discount rate your margins can absorb — say you can comfortably give back 2% — and work backwards to the mechanics that produce it.
If one point is worth $0.01 (the Sopoints value, and a common one), then a 2% giveback means two points per dollar. If you want to run a punch card, decide what the free item costs you and how many visits should earn it, then check that the implied discount rate is one you can sustain permanently, because that is what it becomes. Set the rate this way and the cost is a decision; set it the other way and the cost is a surprise you discover at the end of the quarter.
One more guardrail: make the first reward reachable early — two or three visits, or a low point threshold. A first reward that takes eight visits loses most customers before the program does any work.
A loyalty program means collecting personal information, which puts you inside PIPEDA — the federal privacy law covering commercial activity across most of Canada — plus provincial laws in Alberta, British Columbia and Quebec, and CASL for any marketing messages you send. You do not need a compliance department, but you do need to get a few things right from day one.
Collect the minimum: a phone number or email is enough to run a program. Skip address, gender and full date of birth — for birthday rewards, ask for month and day only, never the year.
Get meaningful consent at enrolment: the customer should understand what you collect and why, in one plain sentence, not a phone number silently typed into a terminal.
Keep marketing consent separate from program consent: joining the program is not consent to receive promotional texts. CASL requires a distinct, timestamped opt-in you can demonstrate.
Know your retention and deletion story: be able to export and fully delete a customer record on request, not just deactivate it. Confirm your platform can do this before you commit.
Pick the enrolment method that adds the least friction at the till — phone number, QR scan or NFC tap. Anything that takes more than about 20 seconds will quietly stop being offered by staff.
Decide whether you need a POS integration. Without one, staff enrol and award manually; with one (Square and Lightspeed are supported by Sopoints today, with Clover, Toast and Shopify on the roadmap), points accrue automatically and the program survives busy shifts.
Train staff on the one-sentence pitch and the one-sentence privacy answer ("we track your points to your phone number, nothing else"). Frontline confidence drives enrolment more than any poster.
Set up your first automated touch — a birthday offer or a win-back message to lapsed customers — so the program does work without ongoing effort.
Soft-launch to existing regulars first. They are the easiest enrolments and give you a working program to show newcomers.
Write the reward terms plainly on a card or screen: how to earn, what a point is worth, when rewards unlock, and any expiry (a long inactivity window is fine; aggressive expiry generates complaints that cost more than the liability it saves).
Ignore enrolment counts and points issued — those are vanity metrics that go up whether or not the program works. Two numbers tell you the truth.
The first is repeat visit rate among enrolled customers compared with unenrolled ones. If enrolled customers do not visit more often, your program is a discount, not a loyalty program, and something in the design needs to change. The second is redemption rate. If almost nobody redeems, the reward is too far away to motivate anyone, and you are carrying a liability that buys you no loyalty. Watch those two, adjust the earn rate and reward thresholds against them, and let the rest of the dashboard be background noise.
The free plan needs no credit card and no hardware — the fastest way to find out whether a loyalty system works for your business is to run one for a month.
SoPoints
Universal loyalty rewards that work everywhere. Join the coalition and start earning points today.
No pages available
PCI-DSS
SAQ A
GDPR
Compliant
CCPA
Compliant
OWASP
Secured
NIST CSF
Aligned
© 2025 SoPoints. All rights reserved.
Made with ❤️ for merchants and customers