Privacy Policy: Stampeo

1. Introduction

This privacy policy describes how Stampeo (hereinafter "we", "our", or "the Platform"), operated by Harry Viennot, sole proprietor registered in France under SIRET 10477625700016, collects, uses, stores, and protects personal data in connection with its digital loyalty card service.

We are committed to complying with the General Data Protection Regulation (GDPR, EU Regulation 2016/679) and the French Data Protection Act (Loi Informatique et Libertés).

This policy applies to all users of the Platform, whether they are business owners, employees, or end customers holding a loyalty card.

2. Data Controller and Data Processor

2.1 Business Users (owners and employees)

Stampeo acts as the data controller for business account data (registration, authentication, billing).

2.2 End Customers (loyalty card holders)

The business using Stampeo is the data controller for its own customers' data. Stampeo acts as a data processor: we process end customer data solely on behalf of the business and in accordance with its instructions.

Each business chooses what information to collect from its customers (anonymous, email only, first name + email, or custom fields). By default, email and first name are enabled.

2.3 Support access by Stampeo personnel

Authorized Stampeo personnel may, on a strictly limited basis, access a Business User's dashboard for the sole purpose of providing technical or commercial support, debugging a reported issue, or fulfilling a legal obligation. Such access:

• is read-only: no data can be modified, created or deleted during the session;
• may be granted in the context of any business user role (owner, administrator, or scanner), and may be scoped to either a chosen role or a specific named user, in order to faithfully reproduce role-specific issues;
• triggers an automatic email notification to the business owner at session start, regardless of which role or user was targeted;
• is limited to a maximum duration of 60 minutes, after which the session expires automatically;
• is logged for audit: the personnel member's identity, the business concerned, the target user and role, the stated reason, start and end timestamps, the personnel member's IP address, and the pages viewed during the session.

Legal basis: legitimate interest (the operator's interest in providing support and ensuring platform security), balanced against the Business User's interests by the safeguards described above (read-only, time-limited, audited, notified). Support access logs are retained for 24 months (see §8).

3. Data Collected

3.1 Business Users

The website, phone number, and "how you heard about us" fields are collected at signup and stored in an admin-only internal table used for support, outreach, and onboarding analytics. They are not shown to other users of the Platform.

3.2 Employees (Scanners)

These activity metrics are visible to the business owner to give a view of team activity. Stampeo does not use them for its own purposes.

3.3 End Customers

Data collected depends entirely on the configuration chosen by the business. All three identification fields are optional and can be disabled independently:

The birthday is collected as a day and month only. No year is stored, so we hold neither a date of birth nor an age.

Businesses on the Growth and Pro plans may add their own fields to their sign-up form (for example a preference or a size). For each such field the business sets the question and a short line explaining why it is being asked, which is displayed to the customer above the "Get my card" button. The business alone decides what to ask and acts as data controller for those answers; Stampeo stores them as processor on the business's instructions, and applies to them the same retention, anonymization, and deletion rules as every other end-customer field. Businesses are contractually prohibited from using these fields to collect payment or identity-document data, or data falling under Article 9 GDPR (health, religious or philosophical beliefs, racial or ethnic origin, political opinions, trade-union membership, sexual orientation, biometric or genetic data). Deleting a field from the sign-up form also erases every answer already stored for it.

It is possible to configure the Platform in fully anonymous mode (no personal data collected, only a card identifier).

3.4 Technical Data

For all users, we may collect:

• Pass type (Apple Wallet or Google Wallet)
• Device token for pass updates
• Usage data sent to PostHog for our internal product analytics: event name, timestamp, page viewed, visitor IP, and (after a Business account is created) the associated business identifier. No cookies are set and no identifier is persisted to browser storage (see §5)
• Error-monitoring context sent to Sentry on exceptions: user identifier, business identifier, request path, and stack trace (no raw email, no password, no payment data)
• For emails we send to Business Users, engagement events recorded by our email provider (Resend): delivery, open, click (including which link was clicked), bounce, and spam-complaint signals, linked to the recipient's business and user identifier. These are used only to measure and improve our own communications and to maintain list hygiene, never for advertising

4. Third-Party Services

We use the following sub-processors:

Resellers (when applicable)

Stampeo operates an optional reseller program. When a business chooses to be managed by a reseller partner, that reseller is granted full dashboard access to the business they manage (including end-customer data) so they can operate the loyalty program on the business's behalf.

In GDPR terms this creates a controller-to-processor-to-sub-processor chain: the managed business remains the data controller for its own end-customer data, Stampeo acts as the processor, and the reseller acts as a further sub-processor, authorized only for the scope agreed with that business. Reseller arrangements require a signed partnership agreement with the data-handling terms described in the Terms of Service (§9.1). Stampeo may revoke reseller access in case of breach or misuse.

A business that is not managed by a reseller is not exposed to any reseller access.

Transfers Outside the EU

Some of our sub-processors (Stripe, Apple, Google) may transfer data to the United States. These transfers are governed by the EU-US Data Privacy Framework or Standard Contractual Clauses approved by the European Commission. Supabase, OVH, Resend, PostHog, Sentry, and our self-hosted Redis process data exclusively within the EU.

5. Cookies

Stampeo uses PostHog (hosted in the EU) for internal product analytics and audience measurement. PostHog is configured so that no tracking cookies are set and no identifier is persisted to browser storage (cookie, localStorage, or equivalent). Events are scoped to the current browser session and are not re-associated across visits. The visitor's IP address is transmitted to the PostHog server for technical logging and event deduplication, but it is not combined with a persistent identifier, is not used for profiling or advertising, and is not shared with third parties. Hosting is entirely within the European Union.

Under these conditions, Stampeo's audience measurement falls within the consent exemption for strictly necessary audience measurement described in the ePrivacy Directive and CNIL guidelines, and therefore does not require a cookie consent banner.

Strictly necessary cookies may be used for authentication and session management on the business dashboard. These cookies do not require consent.

6. Use of Data

We use collected data to:

• Provide and maintain the digital loyalty card service
• Generate and update wallet passes
• Send loyalty notifications (stamps, rewards)
• Manage accounts, subscriptions, and billing
• Send transactional and operational emails (account confirmation, pass recovery, trial notifications, plan-change confirmations, the notice sent before each yearly subscription renewal, and other billing notifications; see Terms of Service §5.7)
• Produce anonymized statistics for businesses
• Produce aggregate, internal product analytics to understand how the Platform is used across all businesses, detect abuse, and prioritize improvements
• Send Business Users a limited number of lifecycle and marketing emails, subject to the opt-out described in §6.1
• Improve the Platform

We never sell personal data. We perform no cross-business tracking: a customer's data at one business is completely isolated from their data at another.

6.1 Marketing and lifecycle emails to Business Users

Beyond the transactional and operational emails listed above, we send Business Users a limited number of lifecycle and marketing emails: onboarding and activation guidance, re-engagement reminders when an account is created but not yet used, a periodic activity digest, product-update announcements, and win-back messages after cancellation.

• Legal basis: our legitimate interest in helping Business Users get value from the Platform and in promoting features of a service they already use (GDPR Art. 6(1)(f)), relying for prospecting on the business-to-business "soft opt-in" permitted by the ePrivacy Directive and French LCEN Art. L34-5.
• Opt-out: every such email carries a one-click unsubscribe link and a link to a preferences page where Business Users can opt out independently by category: re-engagement, marketing, and product updates. The transactional and operational emails described in Terms of Service §5.7 are excluded from this opt-out because they are required to administer the account.
• To measure and improve these communications we record the engagement events described in §3.4.

This applies only to emails Stampeo sends to its own Business Users. It is separate from the wallet notifications a business sends to its End Customers, which are covered in §7.

7. Notifications

When a customer adds a pass to their wallet, the pass can receive notifications from the issuing business. There are two categories, each with a distinct legal basis.

7.1 Transactional Notifications

Sent automatically in response to customer activity: stamp received, points earned, milestone reached, reward earned, reward redeemed.

• Legal basis: performance of the loyalty service (GDPR Art. 6(1)(b)), on behalf of the business as data controller.
• Content: strictly related to the customer's own loyalty card activity.

7.2 Promotional Broadcasts

Businesses on the Growth and Pro tiers can send broadcast messages to their cardholders (for example: a seasonal offer, a new menu item, a special event). Growth has a monthly quota; Pro is unlimited. The Starter tier cannot send broadcasts.

• Legal basis: the business's legitimate interest in marketing to its existing customers (GDPR Art. 6(1)(f)), combined with the "soft opt-in" permitted by the ePrivacy Directive (Art. 13(2)) and French LCEN Art. L34-5. This exemption from prior explicit consent applies because (a) the customer's contact happened in the course of a service (installing the business's loyalty pass), (b) the message concerns similar products or services from the same business, and (c) a simple, free opt-out is available with every message (see 7.3).
• Scope, strictly first-party. A business may use broadcasts only to reach its own cardholders about its own products, services, or offers. Broadcasts may not be used for third-party advertising, cross-business promotion, data sharing, or content unrelated to the business's own offering. These restrictions are written into the Terms of Service §8 and breach of them is grounds for suspension. They are what keeps the soft opt-in exemption intact.

7.3 Opting Out

Each pass exposes a per-pass notification toggle in Apple Wallet and Google Wallet. Turning it off is the single, industry-standard opt-out and is legally sufficient for both transactional and promotional messages on that pass. This is the same control used by every major wallet-based loyalty program.

Because the wallet OS exposes a single toggle per pass, disabling notifications disables both transactional and promotional messages for that pass. This is a limitation of the wallet medium, not a choice by Stampeo. A customer who wishes to stop only promotional messages can either: ask the business to exclude them from future broadcasts (businesses are required by the Terms of Service to honor such requests), or remove the pass from their wallet.

7.4 Business Obligations

Businesses using broadcasts must publish their own privacy notice to their customers, stay within the first-party scope above, and honor opt-out requests received through any channel (verbal, email, in person) by excluding the customer from future broadcasts or revoking the pass. These obligations are detailed in the Terms of Service §8.

8. Data Retention

The 24-month retention for support access logs is set to allow security-incident investigation while remaining proportionate to its purpose, in line with CNIL guidance on security logging.

When a Business account becomes inactive, we retain its data for up to 12 months to allow reactivation, sending two email warnings before permanent deletion. On deletion, Business-account personal data is deleted and End Customer personal data is irreversibly anonymized; anonymized statistics may be retained. Billing records are kept for 10 years as required by law.

9. Pass Deletion by End Customers

When a customer removes their pass from their wallet:

• Their identifying data (email, first name, phone number) is anonymized upon request
• Their visit history is retained in anonymized form for the business's statistics
• Customers can request complete data deletion by contacting the relevant business or Stampeo directly

10. User Rights

Under the GDPR, you have the following rights:

• Access: obtain a copy of your personal data
• Rectification: correct inaccurate data
• Erasure: request deletion of your data
• Restriction: restrict processing of your data
• Portability: receive your data in a structured format
• Objection: object to processing of your data

Business users and employees: contact us at contact@stampeo.app.

End customers: contact the business managing your loyalty card first. You may also reach us at contact@stampeo.app.

10.1 Right to object to support access

Business Users may, by written request to contact@stampeo.app, ask that no support access (§2.3) be granted to their account outside of an explicit support ticket they have opened. This option is offered as a contractual courtesy and does not affect cases where access is required by law, by a court order, or by an imminent security incident on the Platform.

We respond to all requests within 30 days. If you have a complaint, you may file it with the CNIL (French data protection authority): www.cnil.fr.

11. Security

We implement technical and organizational measures to protect your data:

• Encryption in transit (TLS/HTTPS)
• Passwords hashed with secure algorithms
• Restricted and controlled database access
• Data isolation between businesses (multi-tenant architecture)
• Hosting within the EU (Supabase Ireland, OVH France)
• Per-business Apple Pass signing certificates, encrypted at rest with AES-256-GCM

In the event of a personal-data breach, Stampeo will notify the CNIL within 72 hours of discovery and the affected controllers (or, where applicable, data subjects) as required by GDPR Articles 33–34.

12. Minors

The Platform is not intended for persons under 16 years of age. We do not knowingly collect data from minors under 16. Business accounts are restricted to persons aged 18 or older.

13. Changes

We may update this privacy policy. In case of substantial changes, Business users will be notified by email. The last update date is shown at the top of this document.

14. Contact

• Email: contact@stampeo.app
• Data Controller: Harry Viennot, Stampeo
• SIRET: 10477625700016
• Address: 20 rue Marcel Paul, Bat. D Apt. 133-B, 94800 Villejuif, France