Privacy notice

Who is responsible

Stampade provides loyalty-card software to businesses. There are two distinct relationships:

• For business accounts (owners, managers, cashiers), Stampade decides how that data is used and is the controller.
• For loyalty customers, the business running the loyalty program decides what to collect and why. That business is the controller; Stampade processes the data on its instructions.

What is collected

Loyalty customers — only what the program needs:

• First and last name, if given (both optional).
• An email address or a phone number — at least one, so a lost card can be recovered.
• Whether marketing messages were opted into, and when consent was given.
• Loyalty activity: stamps earned, rewards earned and redeemed, with the date, the location, and which staff member recorded it.

No payment card details are collected from loyalty customers, because the software never takes their payments. No location tracking, no advertising identifiers, and no third-party analytics or advertising trackers are used.

Business accounts: name, email address, hashed password, and a record of actions taken in the dashboard (for security and support).

Cookies

One strictly necessary cookie is used to keep a signed-in session. It contains a random identifier, not personal data. There are no advertising or analytics cookies, which is why you are not being shown a cookie banner.

How data is shared

Loyalty data is visible only to the business that collected it. Businesses cannot see each other's customers or activity.

Data may be processed by:

• The hosting and database providers running this installation.
• The transactional email provider, where email is configured and used.
• Apple, Google or Samsung, but only if a customer chooses to add their card to that wallet. In that case the card contents — business name, program name, stamp progress and an opaque card code — are sent to that provider. This only happens on the customer's action.

Data is never sold.

What is in the QR code

A loyalty card's QR code contains only a random card code. It contains no name, email address, phone number or purchase history. Anyone scanning it learns nothing about the cardholder.

How long data is kept

Loyalty records are kept while the business's account is active, so customers do not lose progress. When a customer asks to be erased, identifying details are overwritten and the remaining transaction record is anonymous — this keeps the business's totals accurate while removing the person from them.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your data, to object to processing, and to withdraw marketing consent at any time.

For a loyalty card, ask the business you gave your details to — they control that record, and their dashboard can export or erase it. If you cannot reach them, contact us at support@stampade.com and we will help route the request.

Security

Passwords are hashed with a memory-hard algorithm and never stored in readable form. Sessions are stored as hashes, so a database copy does not yield usable logins. Access is role-based and enforced on the server. Loyalty history is append-only, so it can be audited rather than quietly edited.

No system is perfectly secure, and we do not claim otherwise. Security issues can be reported to support@stampade.com.

Changes

If this notice changes materially, the version number above changes and businesses are notified. The version a customer agreed to is recorded with their consent.