Privacy notice
This notice covers the Stampwell app, the web pages on stampwell.app and the loyalty cards shops issue through them. It explains what we collect, why, who sees it and what you can ask us to do. We follow the Data Privacy Act of 2012 (Republic Act No. 10173), its implementing rules and the rules of the National Privacy Commission.
1. Who we are
Stampwell is a loyalty card service for shops in the Philippines. Shops run stamp cards, coupons, discounts and memberships from the Stampwell app, and their customers keep the cards in Apple Wallet, Google Wallet or on a web page.
Our role depends on whose data it is:
- Shop owners and staff. Stampwell is the personal information controller for your account data.
- Customers of a shop. The shop is the controller of your data. Stampwell is the shop's personal information processor: we hold and use your data on the shop's behalf, only to run its loyalty program. You can contact the shop or us about it.
Our Data Protection Officer can be reached at support@stampwell.app.
2. What we collect
If you hold a shop's card
- Your name and mobile number. A shop needs both to give you a card.
- Any extra details the shop asks for, such as email or birthday.
- Your consent to this notice, and whether you want promos from the shop.
- Your card activity: stamps, rewards, redemptions, visit dates and the branch.
- Ratings and comments you leave after a visit.
- Photos of a receipt or product, if the shop asks staff to take one before stamping.
If you run or work at a shop
- Your name and sign-in details from Apple, Google or your mobile number.
- The businesses, branches, cards and designs you set up, including logos.
- What you do in the app, such as stamps given and rewards redeemed, with the time, branch and staff member.
- A token that lets us send notifications to your phone.
- Your plan and subscription status. Apple or Google handle payment; we never see card or bank details.
Technical data
Our servers keep error logs and use your IP address to block abuse, such as too many signups from one place. We store IP addresses, devices and phone numbers used for these checks only as one-way hashes. The "Shops near you" map can use your location if your browser asks and you allow it; the location stays in your browser and we never receive it.
3. Why we use it
| What we do | Legal basis |
|---|---|
| Issue your card, count stamps and rewards, and update it in your wallet | Your consent when you sign up, and providing the service you asked for |
| Let the shop send you promos | Your consent, which you can withdraw any time |
| Run shop accounts, plans and support | Our contract with the shop |
| Prevent fraud and spam, such as repeat signups, fake feedback and unusual staff activity | Our legitimate interest, and the shop's, in a service that works fairly |
| Meet legal duties | Compliance with the law |
We don't sell personal information and we don't use it for advertising.
5. Where it's stored
We store data in Google Cloud's Singapore region. Apple, Google and RevenueCat may also process it in other countries, including the United States. We only use providers that are bound by contract to protect it.
6. How long we keep it
- Customer data stays until you or the shop deletes it, or the shop's account is deleted.
- Proof photos are deleted automatically after the period the shop sets, 90 days by default.
- Feedback stays with the shop and isn't linked to your name. We file it under a one-way code so the shop can't match it to your visit.
- Customer exports and posters a shop downloads are deleted from our servers 15 minutes after they're made.
- Abuse checks such as signup counts expire on their own.
- Shop accounts stay until the owner deletes them. Deleting an account removes its businesses, cards, customers and staff access. Apple, Google and RevenueCat keep purchase records under their own policies.
7. Your rights
Under the Data Privacy Act you can:
- be told how your data is used;
- see the data we hold about you;
- have it corrected;
- object to its use, or withdraw consent;
- have it deleted or blocked;
- get a copy in a format you can take elsewhere;
- claim damages, and complain to the National Privacy Commission.
How to use them
- Customers. Every card has a "Delete my data" link on the back. You can leave one shop, or every shop that uses Stampwell after we text a code to your number. To stop promos, tell the shop or email us.
- Shop owners and staff. Edit your details in the app. Owners can delete their account in Settings.
- Anyone. Email support@stampwell.app. We may ask you to confirm the data is yours before we act.
If you aren't happy with our answer, you can complain to the National Privacy Commission.
8. Security
Data is encrypted on the way to our servers and while stored. Each shop can reach only its own data, and staff only what their role allows. Apps and web pages can't read the database directly; every request goes through server code that checks who is asking. No system is perfectly secure. If a breach puts your data at risk, we'll tell you and the National Privacy Commission as the law requires.
9. Children
Shop accounts are for adults running a business. Shops shouldn't sign up customers under 18 without a parent's or guardian's consent.
10. Changes
We'll update this notice when what we collect or how we use it changes, and change the effective date above. We'll tell shop owners before a significant change takes effect.
11. Contact
Questions or requests about your data: support@stampwell.app.