Privacy Policy

This Privacy Policy describes how Allvia AB, the company operating Stampioo ("Stampioo", "we", "us", or "our"), collects, uses, stores, and protects personal data when you use our services.

Stampioo is a digital loyalty card platform that enables businesses to create and manage digital loyalty cards and loyalty programmes through Apple Wallet and Google Wallet.

This Privacy Policy applies to:

• Businesses using Stampioo
• Employees and users with access to business accounts
• Customers who join digital loyalty cards through Stampioo
• Visitors to stampioo.com

We process personal data in accordance with the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, and other applicable data protection laws.

Allvia AB is the Data Controller for the processing of personal data described in this Privacy Policy.

Contact details:

Allvia AB

Email: support@stampioo.com

Website: https://stampioo.com

If you have any questions regarding this Privacy Policy or the way personal data is processed, please contact us using the details above.

3.1 Allvia AB as Data Controller

Allvia AB acts as the Data Controller for personal data processed in connection with:

• Registration and administration of business accounts
• Login and authentication
• Customer support
• Payments and subscriptions
• Communication with users
• Platform security and operations
• Compliance with legal obligations

3.2 Allvia AB as Data Processor

When businesses use Stampioo to manage their own customers' loyalty cards, Allvia AB processes personal data on behalf of the business.

In these situations, the business acts as the Data Controller of its customers' personal data, while Allvia AB acts as the Data Processor.

This means that the business is responsible for:

• Determining which data is collected
• Determining why the data is processed
• Ensuring that a valid legal basis exists for the processing
• Informing customers about the processing
• Complying with GDPR obligations

Allvia AB processes such personal data solely for the purpose of providing Stampioo's services in accordance with the business's instructions.

4.1 Business Users

When a business registers with Stampioo, we may collect:

• Name
• Email address
• Telephone number
• Business name
• Company registration number
• Billing information
• Business address
• Business website
• Logos and branding materials
• Loyalty programme settings

This information is used to provide, administer, and improve the service.

4.2 Employees and Business Users

Businesses may grant multiple users access to their account.

For such users, we may process:

• Name
• Email address
• Permission level
• Activity logs related to use of the platform

4.3 End Customers

When an End Customer joins a loyalty programme through Stampioo, a name is required.

When creating a loyalty programme, the business issuing the loyalty card may choose whether the End Customer is also asked to provide additional information, such as:

• Email address
• Telephone number
• Birthday or date of birth

In addition to information entered by the End Customer, Stampioo may process information generated through the use of the loyalty card, including:

• Unique card ID
• Signup date
• Card status
• Number of stamps
• Rewards earned or redeemed
• Visit history
• Loyalty programme activity
• Marketing consent status, such as Yes, No, or Not asked

If marketing consent is enabled by the business, Stampioo may record whether the End Customer agreed to receive offers, promotions, and updates from that business.

End Customers may join a loyalty programme even if they do not agree to receive marketing communications.

4.4 Business Location Information

To enable Apple Wallet and Google Wallet functionality, Stampioo may store:

• Business address
• Latitude
• Longitude

Address information may be processed using Mapbox in order to verify, standardize, and enrich location data.

Coordinates may be transferred to Apple Wallet and Google Wallet when a digital loyalty card is created.

Stampioo does not collect or store GPS location data, movement data, or other location information from End Customers' devices.

In order to provide Stampioo's services, Allvia AB uses selected third-party service providers and data processors.

These providers are only permitted to process personal data to the extent necessary to provide their services to Stampioo.

Google Analytics

Stampioo uses Google Analytics to analyze website usage and improve our services.

Google Analytics may process information such as IP addresses, device information, browser information, and usage data.

Google Ads

Stampioo uses Google Ads to measure the effectiveness of our advertising campaigns and to show relevant ads to visitors.

Google Ads may process information such as device and browser information, ad interactions, and usage data. These cookies are only set with your marketing consent.

Hotjar

Stampioo uses Hotjar to better understand how visitors interact with the website and to improve the user experience.

Hotjar may collect information regarding user behavior, clicks, page interactions, and technical information about the device used to access the website.

Supabase

Stampioo uses Supabase for database management, authentication, and storage of information required to provide the service.

This may include:

• Business accounts
• Loyalty cards
• Customer data
• Stamps and rewards
• System settings

Stripe

Stampioo uses Stripe for payment processing and subscription management.

When payments are processed, Stripe may handle information such as:

• Name
• Billing information
• Payment information
• Transaction information

Stampioo does not store complete payment card details.

Payment information is processed in accordance with Stripe's own terms and privacy policy.

Microsoft 365

Stampioo uses Microsoft 365 for email communication and administration.

This may involve processing:

• Email addresses
• Communication history
• Support requests
• Administrative messages

Mapbox

Stampioo uses Mapbox for address management and location-related functionality.

When a business registers its location, address information may be processed by Mapbox in order to:

• Verify address information
• Standardize address formatting
• Retrieve geographic coordinates

Mapbox may return:

• Address information
• Latitude
• Longitude

This information may be stored by Stampioo to support features related to digital loyalty cards.

Apple Wallet

Stampioo uses Apple Wallet and Apple Push Notification Service (APNs) to:

• Deliver digital loyalty cards
• Update card information
• Deliver notifications
• Manage rewards and loyalty features

When a loyalty card is added to Apple Wallet, Apple may generate technical identifiers used to keep the card updated.

Apple processes certain information in accordance with its own privacy policies and terms.

Google Wallet

Stampioo uses Google Wallet to:

• Deliver digital loyalty cards
• Update card information
• Deliver notifications
• Manage loyalty programme features

Google processes certain information in accordance with its own privacy policies and terms.

Some of our service providers may process personal data outside the European Economic Area (EEA).

Where such transfers occur, Allvia AB ensures that appropriate safeguards are in place in accordance with the GDPR, including:

• European Commission Standard Contractual Clauses (SCCs)
• The EU–US Data Privacy Framework
• Other legally approved transfer mechanisms

Stampioo uses cookies and similar technologies to ensure that the website and platform function properly, improve the user experience, and analyze how our services are used.

These technologies may be used to:

• Manage user logins
• Maintain user sessions
• Improve security
• Prevent abuse
• Measure and analyze website usage
• Improve functionality and user experience

Stampioo uses, among others, the following analytics services:

• Google Analytics for website analytics and statistics
• Google Ads for advertising measurement and remarketing
• Hotjar for user behavior analysis, heatmaps, and user experience improvements

These services may use cookies and similar technologies to collect information about how the website is used.

The information collected may include, for example, IP address, browser type, device information, visited pages, and usage patterns.

For more information about how these services process personal data, please refer to the respective provider's privacy policy.

Personal data is used to:

• Provide and operate Stampioo
• Create and manage digital loyalty cards
• Manage stamps, rewards, and customer activities
• Process customer information entered when joining a loyalty programme
• Record marketing consent status where marketing consent is enabled
• Display customer information, loyalty activity, and consent status to the issuing business
• Enable CSV export features where available
• Provide customer support
• Process payments and subscriptions
• Communicate with users
• Protect the platform against abuse and fraud
• Comply with legal obligations
• Improve the functionality and security of the service

Allvia AB never sells personal data to third parties.

Customer data is not shared between businesses using Stampioo.

Each business only has access to its own customers' data.

Automatic Notifications

Stampioo may automatically send notifications to digital loyalty cards when, for example:

• A stamp is awarded
• A reward is earned
• A reward is redeemed
• Card information is updated

These notifications form part of the normal operation of the service.

Promotional Campaigns

Businesses may send manual notifications to their loyalty card holders through Stampioo.

Examples of such communications include:

• Promotions
• Special offers
• Product announcements
• Events
• Seasonal offers

Businesses may also target specific customer segments, including:

• All customers
• New customers
• Active customers
• Inactive customers
• Loyal customers
• Customers with available rewards

Businesses may only use Stampioo to communicate with their own customers regarding their own products, services, and offers.

The following uses are prohibited:

• Third-party advertising
• Sale or sharing of customer data
• Unrelated mass communications
• Marketing on behalf of other businesses

Disabling Notifications

Users may disable notifications for a specific loyalty card at any time through Apple Wallet or Google Wallet.

Once notifications are disabled, both automatic notifications and promotional campaigns may no longer be delivered for that loyalty card.

Allvia AB retains personal data only for as long as necessary to provide Stampioo's services, comply with legal obligations, or protect our legitimate interests.

Retention periods vary depending on the type of data involved.

Business Accounts

Personal data associated with an active business account is retained for as long as the account remains active.

If a subscription is cancelled or an account is closed, the associated data will generally be retained for up to 60 days. This allows for account reactivation, administrative handling, and the orderly termination of the service.

After this period, the data will be permanently deleted or anonymized unless longer retention is required by law.

End Customers

Personal data associated with loyalty cards is retained for as long as the issuing business uses Stampioo and has a legitimate need for the data in connection with its loyalty programme.

If the business closes its account, the associated customer data will be subject to the same deletion process as the business account.

Billing Information

Billing records and accounting documentation may be retained for the period required by applicable accounting and tax laws.

Technical Logs

Security logs, system logs, and technical logs may be retained for a limited period in order to:

• Detect abuse
• Investigate incidents
• Ensure platform stability
• Protect users and systems

Such logs are generally retained for no longer than 12 months unless specific circumstances require a longer retention period.

When a customer removes a digital loyalty card from Apple Wallet or Google Wallet, the card can no longer be used.

Stampioo may mark the card as removed within its systems in order to:

• Prevent incorrect registrations
• Maintain data quality
• Enable accurate reporting and statistics

Historical information may be retained in anonymized or aggregated form where permitted by applicable law.

Where the GDPR or other applicable data protection laws apply to the processing of your personal data, you have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion of personal data
• Request restriction of processing
• Object to certain processing activities
• Request data portability where applicable

Business Users

Business Users may contact Stampioo directly to exercise their rights.

End Customers

If you are a customer of a business using Stampioo, we recommend that you first contact the relevant business, as that business is generally the Data Controller for your personal data.

Stampioo may assist the business in handling such requests where necessary.

We aim to respond to requests without undue delay and within the timeframes required by applicable law.

To provide technical support and troubleshooting, Stampioo may introduce features in the future that allow authorized personnel to obtain limited access to business accounts.

If such functionality is implemented, access will:

• Be limited to legitimate support purposes
• Be handled only by authorized personnel
• Be logged and documented
• Be limited to the information necessary to resolve the relevant issue

Stampioo will not use such access for commercial purposes or to analyze customer data beyond what is necessary for support, security, or operation of the service.

Allvia AB implements technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration.

These measures include, among others:

• Encrypted communication through HTTPS/TLS
• Access controls and permission management
• Secure authentication mechanisms
• Protected databases
• Ongoing security updates
• Logging of security-related events

Despite these safeguards, no internet-based service can guarantee absolute security. We continuously work to improve the protection of our systems and users' data.

Stampioo is not intended for individuals under the age of 18 with respect to the registration and administration of business accounts.

We do not knowingly collect personal data from minors in violation of applicable law.

Businesses using Stampioo are responsible for ensuring that their use of the platform complies with applicable laws and regulations.

Allvia AB may update this Privacy Policy from time to time.

Where significant changes are made, users will be informed through appropriate channels, such as email or notices within the platform.

The latest version of this Privacy Policy will always be available on the Stampioo website.

The date of the most recent update is displayed at the top of this document.

If you have any questions regarding this Privacy Policy or the processing of personal data, you may contact us at:

Allvia AB

Email: support@stampioo.com

Website: https://stampioo.com

If you believe that the processing of your personal data violates applicable data protection laws, you also have the right to lodge a complaint with the relevant data protection authority within the European Union.