Privacy Policy

This Privacy Policy describes how Allvia AB, the company operating Stampioo ("Stampioo", "we", "us", or "our"), collects, uses, stores, and protects personal data when you use our services.

Stampioo is a digital loyalty card platform that enables businesses to create and manage digital loyalty cards and loyalty programmes through Apple Wallet and Google Wallet.

Businesses that Stampioo has invited can also sell punch cards, balance cards and memberships to their customers through Stampioo. Buyers pay the business directly, through the business's own Stripe account.

This Privacy Policy applies to:

• Businesses using Stampioo
• Employees and users with access to business accounts
• Customers who join digital loyalty cards through Stampioo
• People who buy cards or subscriptions from businesses that sell through Stampioo
• People who report a product to Stampioo
• Visitors to stampioo.com

We process personal data in accordance with the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679, and other applicable data protection laws.

Allvia AB is the Data Controller for the processing of personal data described in this Privacy Policy.

Contact details:

Allvia AB

Email: support@stampioo.com

Website: https://stampioo.com

If you have any questions regarding this Privacy Policy or the way personal data is processed, please contact us using the details above.

3.1 Allvia AB as Data Controller

Allvia AB acts as the Data Controller for personal data processed in connection with:

• Registration and administration of business accounts
• Login and authentication
• Customer support
• Payments and subscriptions
• Checking the details of businesses that sell through Stampioo, including company registry and VAT number checks
• Selling fees and the monthly selling fees invoices
• Reviewing products, handling product reports and meeting our duties under the EU Digital Services Act
• Communication with users
• Platform security and operations
• Compliance with legal obligations

3.2 Allvia AB as Data Processor

When businesses use Stampioo to manage their own customers' loyalty cards, or to sell cards and subscriptions to their customers, Allvia AB processes personal data on behalf of the business.

In these situations, the business acts as the Data Controller of its customers' personal data, while Allvia AB acts as the Data Processor.

This means that the business is responsible for:

• Determining which data is collected
• Determining why the data is processed
• Ensuring that a valid legal basis exists for the processing
• Informing customers about the processing
• Complying with GDPR obligations

Allvia AB processes such personal data solely for the purpose of providing Stampioo's services in accordance with the business's instructions.

A business that sells through Stampioo is the Data Controller for the details of the people who buy from it. Each such business has a privacy notice for buyers, which Stampioo generates from a template. It's linked from the business's sale pages, the checkout and receipts.

4.1 Business Users

When a business registers with Stampioo, we may collect:

• Name
• Email address
• Telephone number
• Business name
• Company registration number
• Billing information
• Business address
• Business website
• Logos and branding materials
• Loyalty programme settings

This information is used to provide, administer, and improve the service.

When Stampioo turns on selling for a business, we also process:

• The legal name and business structure that Stripe has verified, and the business details that Stripe shares with us, such as the support email, phone number, address, website and branding
• The registration number and VAT number, and the results of our checks. For a sole trader, the registration number can be a personal identity number
• The address, email address and phone number that buyers see
• Whether the business takes part in the process of a consumer complaints body
• Who accepted the selling terms for the business, which version, when, and from which IP address
• The business's rate, selling fees and fee invoices, and our review decisions about its products

Before a business connects to Stripe, we send Stripe details we already have, such as the email address, country, website and business name, so the business doesn't have to type them again.

Buyers see the business's legal name, address and contact details on sale pages and card pages. The registration number and VAT number are shown behind "Seller details", in the sale terms and on receipts. For a sole trader, this can be their personal identity number.

We process these details to perform our agreement with the business, to check who sells through Stampioo, and to keep our own accounts.

4.2 Employees and Business Users

Businesses may grant multiple users access to their account.

For such users, we may process:

• Name
• Email address
• Permission level
• Activity logs related to use of the platform

4.3 End Customers

When an End Customer joins a loyalty programme through Stampioo, a name is required.

When creating a loyalty programme, the business issuing the loyalty card may choose whether the End Customer is also asked to provide additional information, such as:

• Email address
• Telephone number
• Birthday or date of birth

In addition to information entered by the End Customer, Stampioo may process information generated through the use of the loyalty card, including:

• Unique card ID
• Signup date
• Card status
• Number of stamps
• Rewards earned or redeemed
• Visit history
• Loyalty programme activity
• Marketing consent status, such as Yes, No, or Not asked

If marketing consent is enabled by the business, Stampioo may record whether the End Customer agreed to receive offers, promotions, and updates from that business.

End Customers may join a loyalty programme even if they do not agree to receive marketing communications.

4.4 Business Location Information

To enable Apple Wallet and Google Wallet functionality, Stampioo may store:

• Business address
• Latitude
• Longitude

Address information may be processed using Mapbox in order to verify, standardize, and enrich location data.

Coordinates may be transferred to Apple Wallet and Google Wallet when a digital loyalty card is created.

Stampioo does not collect or store GPS location data, movement data, or other location information from End Customers' devices.

4.5 Buyers

When someone buys a card or a subscription from a business that sells through Stampioo, the business is the Data Controller for the buyer's details, and Stampioo processes them on the business's behalf.

Before paying, the buyer fills in "Your details". The name on the card and an email address are always required. Depending on the product, the business may also ask for:

• Telephone number
• Address
• Birthday
• Agreement to receive offers, promotions and updates from the business, with an unticked checkbox. We record the answer for each channel collected: email, and SMS when a phone number is given
• Confirmation of age, when the product has an age limit

We also process:

• The buyer's request to start using the card right away, the version of the sale terms they accepted and the wording of any consent, with the time
• Order details, such as the product and its version, the price, the VAT, the date and an order number
• Payment details from Stripe, such as the name on the payment, the payment method and, for cards, the card brand and the last four digits
• The card, such as its ID, the private link to the card page, what's left on it, when it expires, and its uses, check-ins and visits, with time and place
• Subscription details, such as status, renewal dates, failed payments and cancellations
• Refunds, cancellations within the cancellation period, and disputes
• The language of the pages the buyer used

Stampioo does not store complete payment card details.

Details from checkouts that were never paid are deleted after 24 hours.

After a payment, we copy the buyer's name, phone number and address to the business's own Stripe account. The business sees buyers' details in its customer list and can export them where its plan allows.

4.6 People Who Report a Product

Anyone can report a product from its sale page or card page. The report goes to Stampioo, not to the business. Allvia AB is the Data Controller for reports.

When you report a product, we process:

• The reason you choose and the details you write
• Your email address, if you give it, so that we can tell you what we decide
• A one-way coded (hashed) version of your IP address, to stop misuse of the form

We use reports to review products and to meet our legal duties under the EU Digital Services Act. We don't give your name or email address to the business, unless it's strictly necessary.

In order to provide Stampioo's services, Allvia AB uses selected third-party service providers and data processors.

These providers are only permitted to process personal data to the extent necessary to provide their services to Stampioo.

Google Analytics

Stampioo uses Google Analytics to analyze website usage and improve our services.

Google Analytics may process information such as IP addresses, device information, browser information, and usage data.

Google Ads

Stampioo uses Google Ads to measure the effectiveness of our advertising campaigns and to show relevant ads to visitors.

Google Ads may process information such as device and browser information, ad interactions, and usage data. These cookies are only set with your marketing consent.

Meta (Facebook and Instagram)

Stampioo uses the Meta Pixel to measure the results of our advertising on Facebook and Instagram and to show relevant ads to visitors.

The Meta Pixel may process information such as device and browser information, visited pages, ad interactions and clicks to sign up. It is only loaded with your marketing consent. Meta Platforms Ireland Ltd. is responsible for its own processing, and data may be transferred to the USA under the EU-US Data Privacy Framework.

Hotjar

Stampioo uses Hotjar to better understand how visitors interact with the website and to improve the user experience.

Hotjar may collect information regarding user behavior, clicks, page interactions, and technical information about the device used to access the website.

Supabase

Stampioo uses Supabase for database management, authentication, and storage of information required to provide the service.

This may include:

• Business accounts
• Loyalty cards
• Customer data
• Stamps and rewards
• System settings

Netlify

Stampioo uses Netlify to host the Stampioo website, the dashboard and the servers that run the service.

When you visit the website or use the service, Netlify may process technical information such as:

• IP address
• Browser and device information
• The pages and services requested

Netlify may process this information in the United States. These transfers rely on the EU–US Data Privacy Framework and the European Commission Standard Contractual Clauses (SCCs).

Stripe

Stampioo uses Stripe for payment processing and subscription management.

When payments are processed, Stripe may handle information such as:

• Name
• Billing information
• Payment information
• Transaction information

Stampioo does not store complete payment card details.

Payment information is processed in accordance with Stripe's own terms and privacy policy.

When a business sells through Stampioo, buyers pay on the business's own Stripe account. Stripe verifies the business and its representatives, processes buyers' payments and subscriptions, and pays out to the business, under Stripe's own terms and privacy policy.

Stripe shares with Stampioo the business's legal name, business structure, public business details and branding, and the payment, refund, dispute and subscription events that we need to deliver cards.

Microsoft 365

Stampioo uses Microsoft 365 for email communication and administration.

This may involve processing:

• Email addresses
• Communication history
• Support requests
• Administrative messages

Stampioo also uses Microsoft 365 to send emails to buyers on behalf of businesses that sell through Stampioo, such as cards, receipts, sale terms, confirmations and reminders. These emails are sent in the business's name.

For these emails, Microsoft 365 may process:

• Email addresses and names
• The content of these emails
• Delivery information, such as whether an email was delivered or bounced

Bolagsverket and other company registries

When a business in Sweden sets up selling, we check its registration number with the Swedish Companies Registration Office (Bolagsverket). This confirms that the company name matches the name that Stripe has verified. We receive the registered name and whether the company is active. In other countries, we use the company registry for that country where we have one.

VIES

We check VAT numbers with the European Commission's VAT Information Exchange System (VIES). VIES tells us whether a number is valid and, where the country provides it, the registered name.

Intercom

Stampioo uses Intercom for customer support and service messages to businesses that use the Stampioo dashboard.

Intercom may process information about dashboard users, such as:

• Name and email address
• Organisation name, subscription plan and role
• Language setting
• Messages and support conversations

Intercom stores this information in the United States. This transfer relies on the EU–US Data Privacy Framework.

Mapbox

Stampioo uses Mapbox for address management and location-related functionality.

When a business registers its location, address information may be processed by Mapbox in order to:

• Verify address information
• Standardize address formatting
• Retrieve geographic coordinates

Mapbox may return:

• Address information
• Latitude
• Longitude

This information may be stored by Stampioo to support features related to digital loyalty cards.

Apple Wallet

Stampioo uses Apple Wallet and Apple Push Notification Service (APNs) to:

• Deliver digital loyalty cards
• Update card information
• Deliver notifications
• Manage rewards and loyalty features

When a loyalty card is added to Apple Wallet, Apple may generate technical identifiers used to keep the card updated.

Apple processes certain information in accordance with its own privacy policies and terms.

This also applies to cards that buyers buy from businesses through Stampioo.

Google Wallet

Stampioo uses Google Wallet to:

• Deliver digital loyalty cards
• Update card information
• Deliver notifications
• Manage loyalty programme features

Google processes certain information in accordance with its own privacy policies and terms.

This also applies to cards that buyers buy from businesses through Stampioo.

Some of our service providers may process personal data outside the European Economic Area (EEA).

Where such transfers occur, Allvia AB ensures that appropriate safeguards are in place in accordance with the GDPR, including:

• European Commission Standard Contractual Clauses (SCCs)
• The EU–US Data Privacy Framework
• Other legally approved transfer mechanisms

Stampioo uses cookies and similar technologies to ensure that the website and platform function properly, improve the user experience, and analyze how our services are used.

These technologies may be used to:

• Manage user logins
• Maintain user sessions
• Improve security
• Prevent abuse
• Measure and analyze website usage
• Improve functionality and user experience

Stampioo uses, among others, the following analytics services:

• Google Analytics for website analytics and statistics
• Google Ads for advertising measurement and remarketing
• Meta Pixel for advertising measurement on Facebook and Instagram
• Hotjar for user behavior analysis, heatmaps, and user experience improvements

These services may use cookies and similar technologies to collect information about how the website is used.

The information collected may include, for example, IP address, browser type, device information, visited pages, and usage patterns.

For more information about how these services process personal data, please refer to the respective provider's privacy policy.

Personal data is used to:

• Provide and operate Stampioo
• Create and manage digital loyalty cards
• Manage stamps, rewards, and customer activities
• Process customer information entered when joining a loyalty programme
• Record marketing consent status where marketing consent is enabled
• Display customer information, loyalty activity, and consent status to the issuing business
• Enable CSV export features where available
• Provide customer support
• Process payments and subscriptions
• Deliver cards and subscriptions that businesses sell, send receipts, and handle cancellations, refunds and disputes on the business's behalf
• Check the details of businesses that sell, and calculate and invoice selling fees
• Review products and handle product reports
• Communicate with users
• Protect the platform against abuse and fraud
• Comply with legal obligations
• Improve the functionality and security of the service

Allvia AB never sells personal data to third parties.

Customer data is not shared between businesses using Stampioo.

Each business only has access to its own customers' data.

Automatic Notifications

Stampioo may automatically send notifications to digital loyalty cards when, for example:

• A stamp is awarded
• A reward is earned
• A reward is redeemed
• Card information is updated

These notifications form part of the normal operation of the service.

Promotional Campaigns

Businesses may send manual notifications to their loyalty card holders through Stampioo.

Examples of such communications include:

• Promotions
• Special offers
• Product announcements
• Events
• Seasonal offers

Businesses may also target specific customer segments, including:

• All customers
• New customers
• Active customers
• Inactive customers
• Loyal customers
• Customers with available rewards

Businesses may only use Stampioo to communicate with their own customers regarding their own products, services, and offers.

The following uses are prohibited:

• Third-party advertising
• Sale or sharing of customer data
• Unrelated mass communications
• Marketing on behalf of other businesses

Disabling Notifications

Users may disable notifications for a specific loyalty card at any time through Apple Wallet or Google Wallet.

Once notifications are disabled, both automatic notifications and promotional campaigns may no longer be delivered for that loyalty card.

Allvia AB retains personal data only for as long as necessary to provide Stampioo's services, comply with legal obligations, or protect our legitimate interests.

Retention periods vary depending on the type of data involved.

Business Accounts

Personal data associated with an active business account is retained for as long as the account remains active.

If a subscription is cancelled or an account is closed, the associated data will generally be retained for up to 60 days. This allows for account reactivation, administrative handling, and the orderly termination of the service.

After this period, the data will be permanently deleted or anonymized unless longer retention is required by law.

End Customers

Personal data associated with loyalty cards is retained for as long as the issuing business uses Stampioo and has a legitimate need for the data in connection with its loyalty programme.

If the business closes its account, the associated customer data will be subject to the same deletion process as the business account.

Buyers

Details from checkouts that were never paid are deleted after 24 hours.

Other details about buyers are kept on the business's behalf while the business sells through Stampioo and the card can still be used, and afterwards for as long as the business needs them. Records of sales, refunds and fees are kept for as long as accounting and tax laws require.

Businesses That Sell

An organisation can't be closed while selling is on. Selling turns off once no card that the business has sold still holds value. The 60-day period described under "Business Accounts" starts only then.

Product Reports

The email address of the person who reported a product, and the hashed version of their IP address, are deleted 90 days after the report is resolved.

Billing Information

Billing records and accounting documentation may be retained for the period required by applicable accounting and tax laws.

Contact Enquiries

Enquiries submitted through the contact form are retained for up to 24 months, after which they are permanently deleted.

Technical Logs

Security logs, system logs, and technical logs may be retained for a limited period in order to:

• Detect abuse
• Investigate incidents
• Ensure platform stability
• Protect users and systems

Such logs are generally retained for no longer than 12 months unless specific circumstances require a longer retention period.

When a customer removes a digital loyalty card from Apple Wallet or Google Wallet, the card can no longer be used.

A card bought from a business keeps its value if it's removed from the wallet. It can be added again from its card page.

Stampioo may mark the card as removed within its systems in order to:

• Prevent incorrect registrations
• Maintain data quality
• Enable accurate reporting and statistics

Historical information may be retained in anonymized or aggregated form where permitted by applicable law.

Where the GDPR or other applicable data protection laws apply to the processing of your personal data, you have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion of personal data
• Request restriction of processing
• Object to certain processing activities
• Request data portability where applicable

Business Users

Business Users may contact Stampioo directly to exercise their rights.

End Customers

If you are a customer of a business using Stampioo, we recommend that you first contact the relevant business, as that business is generally the Data Controller for your personal data.

Stampioo may assist the business in handling such requests where necessary.

Buyers

If you bought a card or a subscription, contact the business that you bought from first. It's the Data Controller for your details, and its privacy notice for buyers explains how to reach it.

You can change your name, phone number, address and marketing choices yourself on your card page.

People Who Report a Product

Contact Stampioo using the details in the "Contact Information" section.

We aim to respond to requests without undue delay and within the timeframes required by applicable law.

To provide technical support and troubleshooting, Stampioo may introduce features in the future that allow authorized personnel to obtain limited access to business accounts.

If such functionality is implemented, access will:

• Be limited to legitimate support purposes
• Be handled only by authorized personnel
• Be logged and documented
• Be limited to the information necessary to resolve the relevant issue

Stampioo will not use such access for commercial purposes or to analyze customer data beyond what is necessary for support, security, or operation of the service.

Allvia AB implements technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration.

These measures include, among others:

• Encrypted communication through HTTPS/TLS
• Access controls and permission management
• Secure authentication mechanisms
• Protected databases
• Ongoing security updates
• Logging of security-related events

Despite these safeguards, no internet-based service can guarantee absolute security. We continuously work to improve the protection of our systems and users' data.

Stampioo is not intended for individuals under the age of 18 with respect to the registration and administration of business accounts.

We do not knowingly collect personal data from minors in violation of applicable law.

Businesses using Stampioo are responsible for ensuring that their use of the platform complies with applicable laws and regulations.

Allvia AB may update this Privacy Policy from time to time.

Where significant changes are made, users will be informed through appropriate channels, such as email or notices within the platform.

The latest version of this Privacy Policy will always be available on the Stampioo website.

The date of the most recent update is displayed at the top of this document.

If you have any questions regarding this Privacy Policy or the processing of personal data, you may contact us at:

Allvia AB

Email: support@stampioo.com

Website: https://stampioo.com

If you believe that the processing of your personal data violates applicable data protection laws, you also have the right to lodge a complaint with the relevant data protection authority within the European Union.