Does LoyaltyLion Work in China? Customer Loyalty Data, PIPL & an Offshore Widget
LoyaltyLion holds your customers' loyalty profiles — names, emails, order history and points — and serves its rewards widget from offshore infrastructure (AWS in the United States), with no mainland-China region. So a China-facing storefront fetches the widget from offshore, and the customer data your China shoppers generate becomes a cross-border transfer under PIPL. A compliance-first look at the two doors.
Does LoyaltyLion work in China?
Whether you can use LoyaltyLion in China turns first on where your customers' loyalty data lives — and whether the widget reaches your shoppers — not on raw speed. LoyaltyLion is a Shopify loyalty and rewards platform that holds customer loyalty profiles — names, emails, order and customer identifiers, and the purchase history a points balance is built from — and serves the rewards widget back to your storefront from its own infrastructure.
LoyaltyLion's own sub-processor list names Amazon Web Services in the United States as its "primary infrastructure provider," with its other sub-processors in the US, Ireland and the EU and no mainland-China region; its privacy policy adds that, by using the Service, you consent to "any transfer, storage or processing of your personal information outside of your country." So the loyalty data your China shoppers generate is held offshore — a cross-border transfer of personal information PIPL governs — and the duty sits with you, the merchant whose storefront collects it. Because the widget is fetched from offshore too, a China-facing storefront can also load it late or only in part. The table below is LoyaltyLion's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your data volumes, your role and how sensitive the data is. Our China team can map your LoyaltyLion exposure with you →
Compliance snapshot
- ! The loyalty widget and its data are served from offshore, so on a China-facing storefront points balances and rewards can load late or not at all
- ! Holds customer loyalty profiles — names, emails, order identifiers and purchase history — and processes them on AWS in the United States
- ! That offshore customer data is a PIPL cross-border transfer; the merchant running the storefront is the handler that carries the duty
- ✕ LoyaltyLion names no mainland-China region — AWS United States is its primary infrastructure, so no in-country data-residency option
- ✓ A compliant, ICP-filed in-country delivery path exists for your storefront — no rebuild, no migration off LoyaltyLion or Shopify
What LoyaltyLion's own documentation says about China
| Fact | Primary source |
|---|---|
| In LoyaltyLion's own words: Amazon Web Services is "a cloud service provider used within LoyaltyLion as the primary infrastructure provider for the LoyaltyLion service," located in the United States. Every sub-processor LoyaltyLion lists sits in the United States, Ireland or the EU; none is in mainland China, so the customer loyalty data LoyaltyLion holds is processed offshore with no in-country region. | LoyaltyLion — Sub-processors, retrieved 2026-10-08 |
| In LoyaltyLion's own words: the information it collects includes "name, address, telephone number, email address, financial information such as payment details and your transactional history," and by using the Service you consent to "any transfer, storage or processing of your personal information outside of your country." No mainland-China location is named, so personal data tied to your China customers is handled offshore. | LoyaltyLion — Privacy policy (§2.3, §3.2), retrieved 2026-10-08 |
| Loyalty data gathered from your China customers and held offshore is a cross-border transfer under PIPL. The handler — you, the merchant whose storefront collects it — must give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| The exposure scales with volume and sensitivity, not with merely installing the app. Under the CAC's March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification; higher volumes, and any sensitive personal information, fall outside that exemption. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). With no mainland-China region on LoyaltyLion, the only way to keep your China customers' loyalty data on Chinese soil is to run that collection and storage on infrastructure inside the mainland — the same place your storefront's ICP-filing question is answered. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a mainland-China storefront, the question worth asking about LoyaltyLion is not how polished the rewards panel looks — it is where the loyalty data behind that panel is kept, and whether the panel reaches your shoppers at all. LoyaltyLion is a Shopify app that runs your points, tiers and rewards program: it collects personal information from your customers — their names and emails, the order and customer identifiers that tie them to purchases, and the transaction history a loyalty balance is computed from — and it both stores that data and serves the widget that renders it from its own infrastructure outside mainland China. Two consequences follow, and LoyaltyLion documents both itself: the customer data your China shoppers generate crosses the border, and the widget that shows their points is fetched from offshore. The first is a compliance exposure; the second is a delivery one.
LoyaltyLion in China at a glance
| What decides it | In LoyaltyLion's own terms |
|---|---|
| Where it runs | Amazon Web Services in the United States is named as the “primary infrastructure provider for the LoyaltyLion service,” with its other sub-processors in the United States, Ireland and the EU. No region is inside mainland China. |
| What it holds | Customer loyalty profiles — a shopper's name and email, the customer and order identifiers behind their points, and the transactional and behavioural history a loyalty balance is built from. |
| Where that data goes | By LoyaltyLion's privacy policy, using the Service means you consent to “any transfer, storage or processing of your personal information outside of your country” — with no mainland-China location named: a cross-border transfer under PIPL. |
| Who carries the duty | The merchant whose storefront collects the data is the personal-information handler PIPL looks to. The China obligations for your shoppers' loyalty data are yours, not LoyaltyLion's. |
| Reaching shoppers | The widget's script and data are fetched from offshore, so on a China-facing storefront a returning customer's points balance and rewards can arrive late or render only partially. Reachability is the delivery half; where the data lives is the compliance half. |
The loyalty widget is served from offshore
LoyaltyLion renders your points balance, tier status and reward prompts by loading its script and data from its own hosts, which run on AWS in the United States. An asset fetched across the border is a fragile link on a China-facing page: it can arrive late, render only in part, or quietly fail while the rest of the storefront looks fine. A loyalty program fails especially quietly — the store loads, checkout works, and the only thing missing is the points balance a returning customer logged in to see, so the retention mechanism stops without anything on the page looking broken. Because we publish no first-party China measurement for LoyaltyLion, we attach no number here and make no claim about any single visit — the structural point stands on its own: an offshore widget is delivery risk you carry on every China page view. That is the delivery half of the question. It is real, but it is not what decides whether you may use LoyaltyLion. That turns on where the data goes.
Your customers’ loyalty data leaves China — and the duty is yours
The data a loyalty program collects is personal information: a shopper’s name and email, the customer and order identifiers tying them to purchases, and the transaction history a points balance is computed from. LoyaltyLion’s own sub-processor list places that data on AWS in the United States as its “primary infrastructure provider,” with its remaining sub-processors in the United States, Ireland and the EU and none in mainland China; its privacy policy adds that, by using the Service, you consent to “any transfer, storage or processing of your personal information outside of your country.” So personal data generated by your China shoppers is held offshore, and the China obligations fall on you — the merchant whose storefront collects it, and the personal-information handler PIPL looks to.
Under China’s Personal Information Protection Law, sending that data out of the country is a cross-border transfer: you must give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. How heavy that duty is scales with how many people’s data you move and how sensitive it is, not with merely installing the app. And if you are a critical information infrastructure operator or a large-volume handler, personal information collected in China has to be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore platform cannot meet.
And the storefront itself has an ICP question
Set apart from LoyaltyLion, the Shopify store the widget lives on is a public-facing site. Delivered to mainland visitors from inside China, that turns on an ICP filing (ICP 备案) tied to a hosting resource physically in the mainland — footing an offshore Shopify storefront does not have. LoyaltyLion neither creates nor removes that requirement; it is worth naming only because a China launch usually has to answer the storefront’s licensing question and the customer-data question in the same breath.
This is a risk map, not a ruling: whether separate consent, a transfer mechanism, in-country storage, an ICP filing, or some combination applies to you depends on what you collect, how much of it, how sensitive it is, and who your users are — settle it with counsel before you launch in China.
Where 21YunBox fits — a compliant overlay, not a migration
You keep LoyaltyLion, and you keep your Shopify store. We add the piece an offshore platform cannot: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing storefront so the loyalty widget and its data reach China shoppers from in-country — no rebuild, no second store, and no move off LoyaltyLion or Shopify. Our China team maps your PIPL cross-border and data-residency exposure against your entity, your data volumes and how sensitive your loyalty data is, then stands up the in-country delivery and, where the law requires it, the in-country storage a lawful China presence needs.
Related reading:
Frequently Asked Questions
Does LoyaltyLion store Chinese shoppers' loyalty data in China?
No. By its own sub-processor list, Amazon Web Services in the United States is LoyaltyLion's primary infrastructure provider, and every listed sub-processor is in the US, Ireland or the EU, with no mainland-China region; its privacy policy says personal information may be transferred, stored or processed outside your country. So the loyalty profiles tied to your China customers — names, emails, order identifiers and purchase history — are held offshore.
Is it against the law to use LoyaltyLion for a China storefront?
Not inherently. The issue is the cross-border transfer of your customers' personal information, which PIPL permits if you — the merchant collecting it — give notice, obtain separate consent and meet one transfer mechanism. Whether you also face a data-localization duty depends on your role and the volume and sensitivity of the personal information you handle. Treat it as a risk to confirm with counsel, not a blanket ban.
Can 21YunBox help make our LoyaltyLion setup compliant in China?
Yes. Our China team can assess your cross-border and data-residency exposure for your data volumes and role, and stand up compliant, ICP-filed in-country delivery in front of your storefront — and, where the law requires your China customers' data to stay on the mainland, in-country storage — with no rebuild and no move off LoyaltyLion or Shopify. Get in touch to work through your specific case.
