Privacy Policy
Last updated: 27 April 2026
This page explains, in plain language, what personal data Stamply handles, why, on what legal basis, and what rights you have under the EU General Data Protection Regulation (GDPR) and equivalent laws.
1. Who we are
Stamply (the "Service") is operated from Luxembourg. For matters relating to personal data, you can reach us at support@stamplycard.com. Stamply has not appointed a formal Data Protection Officer; the same email reaches the people responsible for privacy at the company.
2. The two kinds of users
Stamply has two types of users, and the privacy picture is different for each:
- Merchants — restaurants, cafés, bakeries and similar businesses who sign up for an account, configure loyalty cards, and pay for the Service.
- End customers — people who scan a Merchant's QR code to collect stamps. End customers do not create an account and do not log in.
For Merchant data, Stamply is the controller. For end-customer data flowing through a Merchant's loyalty card, the Merchant is the controller and Stamply acts as a processor on their behalf.
3. What we collect from Merchants
| Data | Why | Legal basis |
|---|---|---|
| Name, email, password (hashed) | Account creation and login | Contract |
| Restaurant name, description, logo, reward terms | To display the Merchant's loyalty card to their customers | Contract |
| Subscription plan, billing status | To run the paid service | Contract |
| Payment details | Processed entirely by Stripe — Stamply never sees full card numbers | Contract |
| Support correspondence | To answer your questions | Legitimate interest |
| Server logs (IP address, user-agent, timestamps) | Security, abuse prevention, troubleshooting | Legitimate interest |
4. What we collect from end customers
When a customer scans a Merchant's QR code and uses the loyalty card, we collect only what is needed to make the card work:
| Data | Why | Legal basis |
|---|---|---|
| A device-bound customer identifier (random ID stored locally on the customer's device and on our server) | To remember which card belongs to which device, so stamps survive across visits and across page reloads | Strictly necessary for the service the customer requested |
| Card progress: stamp count, timestamps of each stamp, redemption events | To run the loyalty programme | Strictly necessary |
| Optional: name or email if the customer chooses to "sync" their wallet across devices | To restore cards on a new device | Consent — provided only if the customer enables wallet sync |
| Server logs (IP, user-agent, timestamps) | Security and abuse prevention | Legitimate interest |
Stamply does not use advertising trackers, analytics fingerprinting, or third-party cookies on customer-facing pages. The customer identifier is a single first-party cookie / local-storage token that exists for the sole purpose of running the loyalty card the customer added.
5. Cookies and similar technologies
We use only the cookies and storage items strictly necessary to run the Service:
- A session cookie set by Netlify Identity when a Merchant logs in.
- A first-party identifier on customer devices to bind a loyalty card to a phone, as described above.
- A language preference saved locally so the site remembers EN or FR.
None of these cookies are used for advertising or for cross-site tracking, so a separate cookie consent banner is not required for the strictly-necessary set. If we ever add non-essential cookies (e.g. analytics), we will ask for explicit opt-in first.
6. Who we share data with
Stamply uses a small number of trusted infrastructure providers ("sub-processors") to run the Service. They only process data on our instructions, under contract, and only for the purpose described:
- Netlify, Inc. — hosting, serverless functions, identity, and key-value storage. Data is processed in the EU/US under standard contractual clauses.
- Stripe Payments Europe, Ltd. — payment processing for Merchant subscriptions. Stripe is itself a controller for fraud prevention and regulatory purposes; see Stripe's privacy policy for details.
- Email delivery — transactional emails (signup confirmation, password reset, billing receipts) are sent through our hosting/identity provider.
We do not sell personal data to anyone, and we do not share it with advertisers or data brokers. We may disclose information when legally required (court order, regulatory request) — and only the strict minimum required.
7. International transfers
Some of our sub-processors are based in the United States. Where personal data leaves the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or by an adequacy mechanism (such as the EU–US Data Privacy Framework where applicable).
8. How long we keep data
- Merchant accounts — for as long as the account is active. After cancellation, account data is deleted within 90 days, except for invoices and other records we are legally required to keep (typically 10 years for accounting purposes in Luxembourg).
- Loyalty cards (active) — kept for the lifetime of the card, plus a short period after redemption so customers can see their reward history and we can audit fraud claims.
- Loyalty cards (archived after redemption) — kept for up to 24 months after redemption, then deleted automatically.
- Server logs — kept for up to 90 days, then deleted or anonymised.
- Support correspondence — kept for up to 24 months after the case is closed.
9. Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten"), subject to legal retention obligations.
- Restrict or object to certain processing.
- Data portability — receive your data in a machine-readable format.
- Withdraw consent at any time, where processing is based on consent.
- Lodge a complaint with the Luxembourg supervisory authority, the Commission nationale pour la protection des données (cnpd.public.lu), or with your local supervisory authority.
To exercise any of these rights, write to support@stamplycard.com. We will reply within 30 days.
10. Security
Stamply uses HTTPS for all traffic, encrypted storage at rest with our hosting provider, hashed passwords for Merchant accounts, and access controls so that one Merchant cannot read another Merchant's data. Despite our best efforts no system is perfectly secure; if we ever discover a personal-data breach affecting you, we will notify you and, where required, the supervisory authority within 72 hours.
11. Children
The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you are a parent and believe your child has used a loyalty card and you would like that data deleted, contact us at support@stamplycard.com.
12. Changes to this policy
If we materially change this Privacy Policy we will update the "Last updated" date above and, for Merchants, send a notice by email or in the dashboard. Continued use of the Service after the change means you accept the updated policy.
13. Contact
Questions, complaints, or data-rights requests: support@stamplycard.com.