Privacy policy

1. Controller

Stamp is a platform for digital stamp cards. The controller for data processing on this website and for our customers' accounts is:

[Company name and legal form] [Street and number] [Postcode and city] Deutschland Email: [Contact email]

Section 5 applies to the data of a business's guests.

2. Visiting the website

When you open a page, our server processes technically necessary data: IP address, date and time, the page requested and browser details. To prevent abuse we also limit the number of requests per IP address. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

We use no analytics, advertising or tracking services. Fonts are delivered from our own server, so no connection to Google is made for them.

3. Account, team and enquiries

When you register a business or join a team, we process:

• email address, name and login data
• the business's name and profile, logo and card design
• team role and which team member gave which stamp

This is needed to perform the contract (Art. 6(1)(b) GDPR). Recording who gave a stamp also helps prevent abuse (Art. 6(1)(f) GDPR).

You can also sign in with Google or Apple. For this, the sign-in and sign-up pages load scripts from these providers, which receive your IP address and browser details. If you sign in this way, we receive your account identifier and email address from the provider.

If you write to us or join a waitlist, we process your email address and your request in order to reply (Art. 6(1)(b) or (f) GDPR).

4. Payment

Paid plans are processed through Stripe Payments Europe, Limited (Ireland). Stripe receives the details this requires, in particular your email address and payment data. We do not store card details; we only receive a customer identifier, the plan and the payment status. The legal bases are contract performance and legal obligations (Art. 6(1)(b) and (c) GDPR).

5. Data of the businesses' guests

Guests do not need an account for a stamp card. The business in question is the controller of their data. We process it only on the business's behalf (Art. 28 GDPR). Each business sees only its own guests, and data is not shared between businesses.

We process:

• if you choose to give them: name, phone number and email address
• the card's language
• stamps, rewards and when they happened
• invitations through the referral link, meaning who invited whom
• marketing consent and its time, only if you actively gave it

The card also works without a name or contact details. The legal basis is taking part in the business's loyalty programme (Art. 6(1)(b) GDPR) and, for marketing, your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

For access, erasure or withdrawal, it is best to contact the business. We forward any requests that reach us to the business.

6. Apple Wallet and Google Wallet

If you add a card to Apple Wallet or Google Wallet, the card data goes to Apple Distribution International Ltd. (Ireland) or Google Ireland Limited (Ireland): the business's name and logo, card design, stamp count, rewards, language, QR code and, where applicable, your referral link. Your name and contact details are not on the card. When something changes, such as a new stamp, we update the card through these providers.

Apple and Google are themselves responsible for the use of their wallet apps, and their privacy notices apply. Without a wallet, you can use the card in your browser.

7. Cookies and local storage

We only use technically necessary storage (§ 25(2) TDDDG), which is why there is no cookie banner:

• stamp_rt: keeps you signed in, not readable by scripts
• stamp_session: shows that you are probably signed in, holds no secret
• NEXT_LOCALE: remembers your language
• local storage in the stamping app: sound setting and dismissed install hint

8. Service providers and storage location

We work with these service providers:

• hosting and database: [Hosting provider and country]
• sending email: [Email provider]
• payment: Stripe
• wallet cards: Apple and Google
• sign-in, if you choose it: Google and Apple

We have contracts under Art. 28 GDPR with our processors. Some providers may transfer data to the USA or other third countries. This is based on an adequacy decision of the European Commission or on EU standard contractual clauses.

9. How long we keep data

We keep data for as long as its purpose requires. We keep account data for as long as the account exists. After the contract ends, we delete or anonymise it once it is no longer needed and no legal retention duty applies, for example for invoices.

Businesses can export and delete a guest's data in the dashboard. Deleting removes the name and contact details and voids the card; anonymous counts remain.

10. Your rights

You have the right to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw consent with effect for the future (Art. 7(3) GDPR)

You can also complain to a data protection supervisory authority (Art. 77 GDPR), in particular where you live or where we are based.

The details requested at registration are required for registration; guests do not have to give any personal details. No solely automated decision-making within the meaning of Art. 22 GDPR takes place.

11. Privacy contact and changes

We answer privacy questions at [Contact email]. We update this policy when features, service providers or the law change. The version published here applies.