Privacy Policy

Who We Are

Stampello is run by ALFABET ENTERPRISE SRL (CUI 45502473), Str. Podului 23, Oradea, Bihor, Romania. We are the controller of the personal data described here, under the EU General Data Protection Regulation (GDPR). You can reach us at contact@stampello.app.

Information We Collect

We collect information you provide when you use Stampello:

• Account information — your name and email address when you sign up. If you sign in with Google, we also store a link to your Google profile picture.
• Cards without an account — if you collect stamps without an account, we store your stamp cards and random card tokens. A cookie on your phone, stampello_cards, holds those tokens for up to one year, so the cards stay yours. If you add a card to Apple or Google Wallet, a second cookie holds a random device ID for up to one year. When you open a link to a card, a third cookie holds it for five minutes while you confirm adding it. These cookies are strictly necessary, and we don't ask for your name or email.
• Sign-in cookies — if you have an account, cookies keep you signed in. If you sign up as a business, one more cookie remembers that for ten minutes while you finish signing up. These are strictly necessary too.
• Business information — if you register as a merchant, your business name and, if you add them, a logo, description, address, phone number and website. These are your shop's public profile: anyone can see them, so customers can find and join your cards.
• Loyalty activity — stamps collected, redemptions, and interactions with stamp cards. The shop records these when it scans your card.
• Technical data — your IP address, which we hold in memory for a few minutes to limit how often requests can be made. If you add a card to a wallet, we store a scrambled form of the device ID cookie above, so a pass goes back to the phone that installed it. If you add a card to Apple Wallet, we also keep the push token Wallet gives us and a scrambled form of Wallet's ID for your device, so we can update the pass.

How We Use Your Information

• Providing and operating the Stampello loyalty platform.
• Sending account emails, such as a welcome message when you sign up and a link when you reset your password.
• Generating aggregated analytics for merchants about their stamp card performance.
• Showing each shop its own customers: the stamps and rewards on its cards and, if a card is saved to an account, the customer's name.
• Improving the service, fixing bugs, and developing new features.

Legal Basis

• Contract — to run your account and provide Stampello to your business or to you as a customer, including account emails.
• Legitimate interests — to keep the service secure and prevent abuse, to keep stamp cards on your phone when you collect stamps without an account, to keep the wallet passes you add up to date, to show a shop the names on its own customers' saved cards, and to fix and improve the service.
• Legal obligation — to keep records the law requires us to keep.

We don't send marketing and don't use analytics or advertising trackers, so nothing here relies on your consent.

Your right to object: you can object at any time to processing based on our legitimate interests. Write to us and we will stop, unless we have compelling grounds that override your interests or need the data to establish or defend legal claims.

Third-Party Services

These providers process data on our behalf, only to run Stampello, and are bound by their own privacy policies:

• Supabase hosts our database and the logos businesses upload, and handles sign-in, including password-reset emails.
• Vercel, our website host, runs the site and sees the usual web request data, such as your IP address.
• Resend delivers our other emails.
• Google, for signing in with Google. The sign-in button loads from Google as soon as you open our login or sign-up page, before you click anything. Google then receives your IP address and the page you're on and, if you're signed in to Google in that browser, can recognise your Google account. It receives your account details from us only if you choose to sign in with it. If you do, your profile picture is loaded from Google whenever you use the app.
• Apple and Google, if you add a card to Apple or Google Wallet. We build the pass ourselves from the card's code, the shop's name and logo, the card name, the reward and your stamp count, and Apple or Google store it; Google Wallet keeps it in your Google account. The code on the pass is what the shop scans: anyone with a photo of it could be handed your reward, but it can't take your card. The link on the back of the pass can, as it puts the card on another phone, so keep it to yourself. Your phone contacts Stampello to install and update the pass. On an iPhone, Wallet gives us a push token, and when the pass changes we send Apple's push service an empty notice addressed to it; on Android we send the updated pass to Google. We don't send Apple or Google your name or email.

We never sell your personal information, and we never share it with anyone for their marketing.

Transfers Outside the EEA

Some of these providers may process data outside the European Economic Area; Vercel and Google, for example, are US companies. When they do, the transfer is covered by a European Commission adequacy decision (such as the EU–US Data Privacy Framework) or by the Commission's Standard Contractual Clauses. Write to us for a copy of the safeguards that apply.

Data Security

We take reasonable measures to protect your information. All data is encrypted in transit and our database enforces strict access controls: each account can only read its own data, a shop sees only its own customers' names and stamps, and a shop's public profile is the only thing anyone else can read about it. However, no method of transmission or storage is 100% secure.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the service. If you ask us to delete your account, we will remove your personal data within 30 days, except where we are required to retain it by law.

• Cards without an account are kept for as long as the shop keeps that stamp card, so your stamps are still there if you come back. To have one deleted sooner, email us a screenshot of the card's code (tap “Show my code” on the card) and we will delete it.
• If a shop's account is deleted, its stamp cards and every customer's card, stamps and rewards on them are deleted with it.

Your Rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and associated data.
• Export your data in a portable format.
• Ask us to restrict how we use your data.
• Object to processing based on our legitimate interests.

To exercise any of these rights, contact us at the email below. We reply within one month.

You can also complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), dataprotection.ro, or to the authority where you live in the EU.

Other Things You Should Know

• Where your data comes from — from you; from the shops you visit, which record your stamps and rewards when they scan your card; or from Google (your name, email and a link to your profile picture) if you sign in with Google.
• What we need — nothing, to collect stamps without an account. An account needs your name and email, and a business account also needs the business name. Without them we can't create the account.
• No automated decisions — we don't make decisions about you by automated means, including profiling.
• Data protection officer — we haven't appointed one; write to us at the address below.

Children's Privacy

Stampello is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us so we can remove it.

Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will tell you by email or through a notice on the platform before they take effect.

Contact Us

If you have questions about this privacy policy or your data, reach out to us at contact@stampello.app.