Privacy Policy

stamp sits between two kinds of people, and we collect different data for each:

• Businesses and their staff — the cafes, salons and shops that sign up to run a loyalty programme, and the owners/managers/staff who use the stamp dashboard.
• End customers — the people who join one of those businesses' loyalty programmes and carry a stamp pass in their Apple or Google Wallet.

Businesses are the data controller for their own end customers' loyalty data — stamp processes it on their behalf, as their data processor, to provide the service. If you're an end customer and want to exercise a data right, the quickest route is usually the business whose card you carry; we'll also action requests sent directly to us.

From businesses and staff: name, email address, password (stored hashed, never in plain text), business name and branding (logo, colours), role/permission level, and — where a business connects their own Passcreator account — their API credentials (encrypted at rest).

From end customers: name and phone number (used to personalise the wallet pass and identify you at the till), and your loyalty activity — points or stamps balance, visit and redemption history. We don't ask end customers for an email address, a password, or to create any kind of account — the wallet pass itself is the account.

From marketing site visitors: if you fill in a form on stamp's marketing site (for example, the spin-to-win prize form), we collect your name, email, phone number, business name and the answer you give us — used to follow up about stamp, nothing else.

Automatically: a session cookie that keeps staff logged in (strictly necessary — the service doesn't work without it), and a small amount of local browser storage used purely to remember things like whether you've already been shown a popup. On stamp's marketing site, if you accept our cookie banner, we also set an analytics cookie (Google Analytics) to see how many people visit and which pages are useful — it isn't set until you accept, and it's never used for advertising or cross-site tracking.

• To provide the service (contract) — running the loyalty programme, issuing and updating wallet passes, letting staff scan and redeem rewards, billing.
• To keep the service secure (legitimate interest) — detecting abuse, rate-limiting login attempts, and investigating problems.
• To follow up with prospective customers (legitimate interest / consent, where required) — for example, emailing someone who claimed a spin-the-wheel offer.
• To meet legal obligations — such as keeping records HMRC or other regulators may require.

We don't sell personal data. We share it only with the third parties that help us run the service:

• Passcreator — issues and updates the Apple/Google Wallet passes themselves, so pass-holder name, phone number and loyalty balance are shared with them.
• Resend — sends transactional emails on our behalf (lead follow-ups, account notifications).
• Vercel — hosts the application, database and uploaded files (like business logos).
• Anthropic — only if a business enables the AI-powered support chat; by default the chat widget answers from a small fixed set of canned answers and nothing is sent to a third party.
• Google — provides analytics (Google Analytics) for stamp's marketing site, only for visitors who accept our cookie banner.

Some of these providers may process data outside the UK. Where that happens, we rely on their own standard contractual safeguards for international transfers.

We keep account and loyalty data for as long as the relevant business account is active, so the service keeps working as expected. If a business closes their account, we'll delete or anonymise their data — including their end customers' — within 12 months afterwards, except where we're required to keep something longer (for example, billing records).

Under UK GDPR, you can ask us to: give you a copy of your data, correct it, delete it, restrict how we use it, or move it elsewhere. You can also object to processing based on legitimate interest. To do any of this, email tapmateuk@gmail.com. If you're not satisfied with our response, you have the right to complain to the UK's Information Commissioner's Office (ico.org.uk).

stamp isn't directed at children, and we don't knowingly collect personal data from anyone under 16.

We'll update this page if what we collect or how we use it changes, and update the date at the top. For significant changes, we'll make a reasonable effort to let affected businesses know directly.

Questions about this policy or your data — email tapmateuk@gmail.com. TapMate LTD, company number 16353666.