1. About this policy
Stampah is operated by Abdelrahman Mahmoud, trading as Stampah. The website is https://stampah.com and the support email is stampahsupport@gmail.com. No postal service address is published in this policy because one has not been supplied for publication.
This policy covers business owners and staff using Stampah, customers joining a participating business’s loyalty programme, visitors to the public website and people who contact support. It describes Stampah’s current implementation and is not a statement that every future feature has been launched.
2. Roles and responsibilities
Stampah’s role depends on the activity. For merchant account administration, subscription and billing administration, platform security, support, legal compliance and related platform operations, Stampah generally decides how and why it uses the relevant information.
For customer loyalty information created through a participating business’s programme, the participating business normally decides why the information is used for that programme and which rewards or customer-facing rules apply. Stampah provides the technical platform. The participating business may therefore be the controller for that programme, while Stampah processes information on its instructions where appropriate. Customers should normally contact the participating business about a shop-specific loyalty request, and may contact Stampah about technical operation or Stampah’s own processing.
The responsible organisation can differ by processing activity. Stampah is not always only a controller or only a processor.
3. Information we handle
Business owners and staff
- Names, email addresses, authentication and account identifiers, account status and role information.
- Business name, category, phone number, address, website and other business contact details entered during setup.
- Programme configuration, including programme descriptions, stamp thresholds, reward names and reward descriptions.
- Brand assets and artwork, including uploaded logos or banner images where the feature is used.
- Stripe customer, price and subscription identifiers, subscription status, invoice or payment status and limited billing metadata.
- Support correspondence and information included in a support request.
Customers and loyalty members
- First name. Email address and phone number are optional fields on the current customer join flow.
- Loyalty membership and card identifiers, the participating programme, the opaque identifier used by the card QR code, and wallet-pass identifiers or status when a wallet pass is used.
- Current stamp balance, visit or stamp transaction history, reward status and redemption activity.
- Information needed to display the browser card and to update a supported wallet pass.
Technical, security and diagnostic information
The application uses Supabase Auth session cookies and may receive request metadata through its hosting and security infrastructure. Depending on the request and provider, this may include IP address, browser or device information, authentication/session information, timestamps, error details and security or diagnostic logs. Sentry is used for error and performance monitoring; its SDK is configured not to collect user identity, cookies, HTTP headers or bodies, URL query parameters, or database query data. Stampah does not currently use an advertising or session-replay service in the application code.
Payments
Stripe handles payment-card information through Stripe-hosted Checkout and billing services. Stampah’s application receives billing identifiers and status information needed to administer access, but the repository does not show Stampah collecting or storing full payment-card numbers or card verification values.
Stampah collects a business address in the business setup form. The checkout code sends the business name to Stripe and does not show Stampah sending its own business address field as a Stripe billing address. Stripe may collect information directly through its hosted payment flow under Stripe’s own terms and privacy notice.
Uploads
Merchants can upload supported business images, such as logos and programme artwork, to Supabase Storage for use in their programme and cards. Merchants must only upload material they have the right to use and must not upload illegal, sexually explicit, abusive, infringing or harmful material. Stampah does not promise that every upload is proactively reviewed before it is processed.
4. Why we use information
- Create and authenticate merchant, manager and staff accounts.
- Operate merchant loyalty programmes, customer cards, QR joining and authorised staff scanning.
- Record stamps, rewards, redemptions and programme activity.
- Display cards in a browser and provide Google Wallet and Apple Wallet passes where the customer chooses an available wallet option.
- Administer Stripe subscriptions, trial status, billing access and billing management.
- Respond to support requests, investigate faults, maintain availability and debug the service.
- Secure the service, prevent fraud or abuse, enforce permissions and protect users and third-party systems.
- Meet legal, tax, accounting and regulatory obligations, and respond to lawful requests.
- Send account, security, billing and other service messages. The current repository does not show a separate marketing email or SMS programme.
5. UK GDPR lawful bases
Where UK data protection law applies, the lawful basis depends on the processing:
- Contract or pre-contract steps: creating and operating a merchant account, providing the paid service and responding to a requested customer card flow.
- Legitimate interests: platform administration, security, fraud prevention, support, fault diagnosis and proportionate service improvement, balanced against people’s rights.
- Legal obligation: accounting, tax, compliance and responding to lawful requests.
- Consent: where the law requires it for an optional activity, such as a future non-essential cookie or optional electronic marketing. Stampah does not use consent as the basis for processing necessary to provide the contracted service.
6. Providers and disclosures
Stampah currently uses the following providers or provider categories:
- Supabase: authentication, database, row-level access controls, Storage for business assets and Supabase Auth’s default shared email-sending service for account verification, invitations and password resets. Stampah has not configured a separate SMTP email provider.
- Vercel: application hosting, delivery and deployment-platform logs or request metadata.
- Stripe: hosted Checkout, subscriptions, invoicing and the customer billing portal.
- Google: Google Wallet pass creation and updates, and Google OAuth sign-in for business users who choose that option. A pass can contain the customer’s name, programme and business details, stamp and reward status, an opaque card QR identifier and configured programme artwork. Google and Supabase process the authentication information needed to complete sign-in.
Apple: Apple Wallet pass issuance and update services. Pass data may include the customer’s name, programme and business details, stamp and reward status, an opaque card QR identifier and configured programme artwork. Apple may also process pass and device-registration information under its own terms and privacy notice. Availability depends on supported devices and service configuration.
Sentry: error and performance monitoring. Diagnostic events may include exception details, stack traces, release/environment information and technical request context. The SDK is configured to omit user identity, cookies, HTTP headers and bodies, URL query parameters and database query data.
Information may also be disclosed where required by law, to protect rights, users or platform security, or as part of a genuine sale, restructuring or transfer of the Stampah business, subject to appropriate safeguards.
Stampah does not currently share personal information with advertising networks or sell personal information.
7. International transfers
Some providers may process information outside the UK. Stampah will rely on a recognised safeguard where UK data protection law requires one, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another legally permitted transfer mechanism. The exact location and provider arrangements can change and should be checked with the relevant provider notices.
8. Retention
We retain account and programme data while the account is active. When deletion is accepted, the business and customer-facing programme are disabled immediately; cleanup of stored data and connected services is queued and retried if a provider is unavailable. Technical/security records, support correspondence and billing records may be retained as needed for security, dispute handling, legal, tax and accounting obligations. Backups expire through the relevant provider’s normal rotation and are not restored to active use without reapplying deletion records. We do not yet publish fixed day-count periods for each category; we use these criteria and will provide the applicable period on request.
Verified business owners can request deletion from Account → Danger Zone. Any active Stripe subscription is cancelled before the deletion request is accepted; if Stripe cancellation cannot be completed, the deletion request is not accepted. Cleanup of Storage and other connected services then runs asynchronously. Customers can delete loyalty data from an individual card, which removes that membership only and does not silently delete unrelated programmes.
Customers who need complete identity erasure across programmes, and anyone who cannot use the relevant self-service control, should email stampahsupport@gmail.com. Stampah may need to verify identity or authority and may retain limited information for legal, accounting, fraud-prevention, security or dispute purposes. Stripe independently retains records under its own legal and contractual retention rules; Stampah does not claim to erase Stripe’s independent records immediately.
Stampah does not edit protected backups record by record. Deleted data may remain temporarily until the provider’s normal backup lifecycle expires. The deletion queue and terminal account state are restored with the database where possible and are reapplied after a supported restoration before data returns to ordinary active use.
9. Security
We use reasonable technical and organisational measures designed to protect personal information. The implementation includes authentication, business-scoped authorisation and row-level access policies, restricted server-side credentials, HTTPS for data in transit, trusted payment processing through Stripe and application logging for security and diagnosis. No service can guarantee absolute security.
10. Children
Merchant account owners and staff users must be aged 18 or over and legally capable of agreeing to the Terms. The product documentation does not currently establish a final rule for whether customers under 18 may join a participating business’s programme. Stampah does not collect a date of birth or operate a parental-consent workflow. Participating businesses must apply any customer-age rule that is appropriate for their own programme and legal obligations.
11. Your rights
Subject to legal limitations, UK data protection law may give you rights to:
- access your personal information;
- correct inaccurate or incomplete information;
- request erasure;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive information in a portable format where applicable; and
- withdraw consent where processing relies on consent.
Email stampahsupport@gmail.com with your request and enough information for us to understand which account, programme or card it concerns. We aim to respond without undue delay and within one calendar month, unless the law allows more time; if an extension applies, we will explain it within that first month. We may need to verify identity or authority. A request about a participating business’s loyalty programme may need to be referred to that business, which may be the relevant controller.
Self-service merchant deletion and programme-specific customer deletion are available as described above. Complete Stampah customer identity deletion is not a one-click action because the current card architecture does not provide a reliably authenticated cross-merchant customer identity. Use the support email for that request. Deletion may be limited by legal, security, fraud-prevention, backup or dispute-resolution needs.
You can complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint. You may contact Stampah first, but you do not have to wait a fixed period before complaining to the ICO.
12. Changes and contact
We may update this policy when the service, providers or legal requirements change. The date at the top shows when this version was last updated. Questions and privacy requests can be sent to stampahsupport@gmail.com.
Stampah’s current public support page is available at /support. See also the Terms and Conditions and Cookie Policy.