Privacy Policy

Who we are

Stempy is a trading name of Kalakriti Limited, a company registered in England and Wales with company number 14990971. In this policy, "Stempy", "we", "us", and "our" mean Kalakriti Limited trading as Stempy.

If you are a customer of a shop that uses Stempy, the shop is the controller of your loyalty data and Kalakriti Limited acts as its processor. For data we collect directly (for example when you book a demo), Kalakriti Limited is the controller.

What we collect

We only collect information that helps us run the service. The categories are:

Merchant account data

• Business name, address, VAT number, and billing details
• Owner and staff names, email addresses, and phone numbers
• Login credentials (passwords are hashed using Argon2, never stored in plain text)

Customer loyalty data

• First and last name, email address, and mobile phone number, where provided
• Notes added by authorised merchant staff to help manage the loyalty account
• A unique wallet pass identifier, issued by Apple Wallet or Google Wallet
• Stamp history, reward redemptions, and visit timestamps

Technical data

• Browser type, device type, operating system, and IP address
• Pages visited on our website and how long you spent on each
• Error reports, to help us fix bugs

How we use it

We use personal data to run the service, keep it safe, and improve it. Concretely, that means:

• Issuing and updating wallet passes, and delivering push notifications
• Processing payments and sending invoices
• Answering support requests and sharing product updates
• Detecting fraud, abuse, and suspicious stamping patterns
• Measuring which features are useful, so we can build the right things next

Fraud prevention

We use Google reCAPTCHA on selected website forms to distinguish genuine users from automated submissions and protect Stempy against spam, fraud, and abuse. reCAPTCHA may process technical information such as your IP address, browser and device information, and how you interact with the page. This security processing is carried out under our legitimate interests in protecting our website and services. Google processes this information in accordance with its applicable privacy terms.

Lawful basis for processing

Under UK GDPR and the EU GDPR, we rely on one of the following lawful bases for each purpose:

• Contract: processing we need to do to deliver the service you signed up for
• Legitimate interest: running the service safely, preventing fraud, and improving the product
• Consent: marketing emails, analytics cookies, and anything optional. You can withdraw consent at any time
• Legal obligation: accounting records, tax filings, and responses to lawful requests

Sharing and processors

We share personal data only with the vendors we need to run Stempy. Each is under a written data processing agreement and each is vetted for security. The core list is:

• Amazon Web Services (Ireland): infrastructure hosting
• Stripe (UK): payments and billing
• Resend (USA): transactional email, under Standard Contractual Clauses
• Google reCAPTCHA (USA): bot, spam, fraud, and abuse prevention, with international transfers protected by Standard Contractual Clauses where required
• Apple and Google: wallet pass delivery and push notifications
• Plausible (EU): privacy friendly website analytics, no cookies

We will share data with the police, regulators, or courts when we are legally required to. We publish the number of requests we receive each year in our transparency report.

How long we keep it

We hold on to data only as long as we need to. The default retention periods are:

• Active merchant accounts: while the account is open, plus six years for tax records
• Closed merchant accounts: deleted within 90 days, except billing records
• Customer loyalty data: deleted within 30 days of a merchant closing their account, or sooner on request
• Website analytics: aggregated and anonymised after 14 months
• Support conversations: two years, then deleted

Your rights

You have the right to access, correct, export, or delete the personal data we hold about you. You can also object to processing, ask us to restrict it, or withdraw consent. To exercise any of these rights, email privacy@stempy.co.uk and we will respond within 30 days.

If you are unhappy with how we handled your request, you can complain to the UK Information Commissioner's Office at ico.org.uk.

Security

We take security seriously. We run Stempy on encrypted infrastructure, enforce multi factor authentication for all staff, log every access to production, and audit our code through third party security reviews twice a year. Passwords are hashed using Argon2. Payment card data never touches our servers; Stripe handles it end to end.

If we ever experience a personal data breach that is likely to affect your rights, we will notify you and the ICO within 72 hours, as the law requires.

Cookies

The Stempy website uses a small number of cookies. Essential cookies keep you signed in and remember your theme preference. We also use Plausible Analytics, which does not set any cookies or collect personal data. Google reCAPTCHA may use cookies and similar technologies, and process device and interaction information, when protecting selected forms against bots, spam, fraud, and abuse. We do not use advertising or cross-site marketing trackers.

You can clear cookies at any time using your browser settings.

Children

Stempy is built for businesses and their customers. It is not directed at children under 16. We do not knowingly collect personal data from children. If you are a parent and believe your child has given us data, email us and we will delete it.

Changes to this policy

When we make meaningful changes to this policy, we will email every merchant at least 30 days before the change takes effect. Minor clarifications are published here with an updated version number.

Contact

Questions, requests, or complaints? Get in touch:

• Email privacy@stempy.co.uk
• Call 07447 476948 Monday to Friday, 9am to 6pm GMT
• Or use the contact form