Privacy Policy

Who we are

Stampify provides digital loyalty cards for local businesses. This policy explains what data we handle when a business uses Stampify and when a customer collects stamps.

Data we collect

• Business accounts: name, email address, and a hashed password. Business profile details you enter, such as business name, type, logo, colour, city, address, and phone number.
• Loyalty cards: a randomly generated card code and token, the campaign the card belongs to, stamp counts, and reward history. Cards are not linked to a customer name, email address, or phone number.
• Orders (QR menu): when a guest orders through a business's QR menu: the items, prices and time; the name or nickname the guest enters; a phone number only if entered; notes; the table if ordered at one; and, if the guest's phone holds a stamp card of that business, a link to that card. A salted hash of the IP address is kept to stop floods of fake orders. No e-mail address, postal address, payment data or location is collected.
• Technical data: IP address and browser user agent, used for session security and to rate-limit abuse.

How we use it

• To operate loyalty programmes and keep stamp counts accurate.
• To authenticate business accounts and staff.
• To detect and limit fraudulent or abusive stamping.
• To process subscription payments where a paid plan is chosen.
• To pass a guest's order to the business and show the guest its status.

Storage on your device

A customer's loyalty card token is stored in their browser's local storage so the card reopens on the same device. A session cookie is used to keep business users signed in. No advertising or third-party tracking cookies are used.

On a QR menu, the cart stays in the browser's local storage on the guest's phone until the order is sent, and a functional cookie remembers the chosen menu language.

Sharing

We do not sell personal data. Data is shared only with service providers needed to run the product, such as hosting, database, and payment processing, and only to the extent required to provide the service.

Retention and your rights

Business account data is kept while the account is active. Depending on where you live you may have the right to access, correct, export, or delete your data. Contact us to make a request.

For orders, the name, phone number, notes and card link are deleted 30 days after the order and the IP hash after 7 days; what was ordered, when and for how much is kept as the business's sales record. For order data the business is the controller; we process it on the business's behalf.

Contact

Questions about this policy can be sent to the support contact listed on our website.