About this policy
Stampah is a digital loyalty-card service for businesses. Stampah is operated by Abdelrahman Mahmoud, trading as Stampah, with contact address abdelrahman.w.mahmoud@gmail.com.
When a business creates a programme, it may also decide how customer information is used. In that situation the business may be the controller for its customer programme and Stampah acts as its service provider.
Information we handle
Merchant and staff accounts
We handle names, email addresses, password-related authentication records, roles, business relationships and account status needed to create and secure merchant, manager and authorised staff accounts. We also handle business details entered by a merchant, such as business name, category, phone, address, website and branding assets.
Customer loyalty information
When a customer joins, the join form collects a first name. The join service also supports optional email and phone fields. We handle programme and membership relationships, QR/pass identifiers, stamp balances, rewards earned or redeemed and related activity timestamps so the card can work and the business can administer its programme.
Technical, security and support information
Supabase authentication and the hosting platform may process IP address, device/browser information, request information and security logs as part of delivering, protecting and troubleshooting the service.
Why we use information
We use information to provide accounts and loyalty cards, authenticate users, enforce business and staff permissions, issue and update Google Wallet passes, record stamps and rewards, respond to support requests, prevent abuse, maintain security, and meet legal obligations where applicable.
Our lawful basis depends on the context: performance of a contract or steps requested before a contract for merchant accounts; legitimate interests in operating, securing and supporting the service; consent where the law requires it; and legal obligation where applicable. Businesses should provide their own programme notices where they determine the purposes of customer processing.
Service providers
We use Supabase for authentication, database and storage; Vercel for hosting; and Google services for Google Wallet functionality.
These providers may process information in countries outside the UK. Where UK data protection law requires a restricted transfer safeguard, we will use an appropriate lawful transfer mechanism.
Retention
We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing Stampah’s services, maintaining loyalty memberships and transaction records, protecting the security and integrity of the platform, resolving disputes, and complying with legal obligations.
The period for which we retain information depends on the type of information, why we process it, whether an account or loyalty membership remains active, and any applicable legal or operational requirements. When personal information is no longer required, we will delete or anonymise it in accordance with our retention practices.
Your rights
UK data protection law may give you rights to access, correct, erase or restrict use of your information, object to some processing, and receive certain information in a portable format. Contact abdelrahman.w.mahmoud@gmail.com; we may need to verify your identity and may refer a programme request to the relevant business.
You can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.
Changes and contact
We may update this policy as the service changes. Questions can be sent to abdelrahman.w.mahmoud@gmail.com.