Privacy policy

1. Controller

Alexander Siarsky
Maiengasse 55
4056 Basel, Switzerland
Email: info@stammkunde.ch
Phone: +41 77 999 58 11

If you have any questions about data protection, you can reach us at any time at the email address above.

2. Who is responsible for what

We are responsible ourselves for our website, the contact form and the businesses’ accounts.

The stamp cards are issued by the individual businesses (e.g. cafés, bakeries) to their customers. The respective business is responsible for the data on these cards. We process this data on its behalf and only according to its instructions (processing on behalf under Art. 9 FADP). The business only sees what is on the card (name or nickname, card number, stamps and visits) – there are no contact details. You can address requests about your card to the business or directly to us.

3. What data we process

Visiting the website

When you access the website, our hosting provider stores technically necessary information in server log files, e.g. IP address, date and time, page visited, browser and operating system. We need this data to run the website securely and reliably. We don’t analyse it. Our hosting provider Vercel automatically deletes these logs after 1 day. Customers only interact with our server, not directly with the database. When businesses log in, our database provider Supabase logs the IP address; these logs are deleted after 7 days at the latest. We don’t use any analytics or advertising trackers.

Contact form

If you send us a request or order via the form, we process your name, business, email address, chosen plan and billing period and, optionally, phone number and message. We use this information only to answer your request, create a sample card for you or process your order. To prevent abuse, we store a hash value of your IP address computed with a secret key when you submit the form; it is deleted after 12 hours at the latest.

Customers with a stamp card

• Name or nickname (optional and freely chosen, shown on the card)
• Card number and security key of the card
• Number of stamps, rewards redeemed and the date and time of each stamp and each redemption
• If the card is saved in Apple Wallet: a device identifier and a push token so the card updates automatically
• If the card is saved in Google Wallet: the information that the card is saved so it updates automatically. For this, the card content (name, stamps, card number, link to the card in the browser) and the business’s messages are transmitted to Google
• When a card is created: a hash value of the IP address computed with a secret key, to prevent abuse (mass creation of cards). The IP address itself is not stored; the hash value is deleted after 12 hours at the latest

We don’t collect customers’ email addresses, phone numbers, dates of birth or locations and don’t create profiles across several businesses. There is no account or password for customers.

What the business sees: when scanning your card, the name or nickname, the card number, the stamp count and the last visit. In the statistics it only sees aggregated figures (e.g. number of customers and visits, return rate, visit times by weekday and hour, number of customers who haven’t been in for a while) – no list of individual customers.

Businesses and their staff

For owners and staff we process email address, password (stored only in encrypted form), role in the business, the stamp card settings (e.g. name, logo, colours, reward) and a log of who gave or removed a stamp or redeemed a reward, and when.

4. Purpose of processing

• Operating the digital stamp card: issuing the card, recording stamps and rewards, updating the card
• Statistics for the business, e.g. number of visits and customers in a period
• Messages from the business to its customers via the wallet card (e.g. a reminder after a long time without a visit)
• Login and management of the businesses' accounts
• Answering requests
• Security, abuse prevention and troubleshooting

We don’t use the stamp card data for any other purpose – in particular not for our own marketing, advertising, profiles or analyses across several businesses. Messages via the card are only sent by the business where you got the card (see section 5).

5. Messages via Apple Wallet and Google Wallet

Businesses can send their customers short messages via the saved wallet card, which may appear as a notification on the device. Notifications can be switched off in Apple Wallet in the card's settings and in Google Wallet in the card's or the app's settings and in the device's notification settings. If the card is removed from Apple Wallet or Google Wallet, the device no longer receives messages.

6. Cookies and local storage

We only use technically necessary cookies so that businesses stay logged in after logging in and the chosen language is remembered. On customers' devices we only store the card number in the browser (local storage) so that a card already obtained can be found again. We do not use tracking or advertising cookies.

7. Disclosure to third parties and service providers

We don’t sell data and don’t pass on stamp card data to third parties. The only exception are the technical service providers without which the stamp card would not work. They process the data exclusively on our behalf and not for their own purposes:

• Vercel Inc. (hosting of the website and the application)
• Supabase Inc. (database and login), server location: Zurich, Switzerland
• Infomaniak Network SA (sending emails to businesses, e.g. invoices and support replies), Switzerland
• Apple Inc. (Apple Wallet and delivery of updates to iPhones)
• Google LLC (Google Wallet and delivery of updates to Android devices)

8. Disclosure abroad

The database with the stamp card and account data is located on servers in Zurich (Switzerland). However, some service providers are based in the USA or process data outside Switzerland, e.g. for hosting the website or delivering updates via Apple and Google. Data is only disclosed to countries with adequate data protection according to the Federal Council or – where this is not the case – on the basis of suitable safeguards, in particular the European Commission’s standard contractual clauses or a certification under the Swiss-U.S. Data Privacy Framework.

9. Retention

We keep personal data only as long as necessary for the respective purpose or required by law. Stamp card data remains stored as long as the business runs its stamp card programme with us; on request we delete or anonymise a card at any time. Cards that don’t receive a single stamp within 30 days of being created are deleted automatically. Demo cards (home page “Try the sample card”) are valid for 60 minutes and are deleted completely no later than 90 minutes after being created. If a business’s subscription ends, its data is kept for another 90 days for export and then deleted; we keep invoices in accordance with legal obligations. We delete requests submitted via the contact form 90 days after they have been dealt with. Support requests and email logs of a deleted business are deleted 30 days after its deletion; otherwise, the email log is deleted after 12 months. An automatic daily process applies these periods. We delete hash values of IP addresses after 12 hours at the latest. Vercel deletes server log files after 1 day; Supabase deletes login and database logs after 7 days at the latest.

10. Data security

We protect personal data with appropriate technical and organisational measures, including encrypted transmission (HTTPS), role-based access rights, passwords stored in encrypted form and strict separation of the data of individual businesses.

11. Your rights

Under the FADP you have in particular the right to:

• request information on whether and which personal data we process about you
• have incorrect data corrected
• request the deletion of your data or object to processing
• receive your data in a common electronic format (data portability)

Deleting your card: Every customer can delete their card completely. The easiest way is yourself on the card page: open the card in Apple Wallet or Google Wallet, choose “Card in browser” and at the very bottom “Delete card and data”. Or contact the business where you got the card and show the card or the card number; the business deletes it immediately with our tool. Afterwards the name, stamp count and wallet link are deleted on our side and the card no longer works. Visits then only count as an anonymous number in the business’s statistics. You can then remove the card from Apple Wallet or Google Wallet yourself. In Google Wallet it remains visible until then as “expired” (without name, stamps and card number), because Google does not allow us to delete it completely.

For all other matters, please contact the email address above. We may ask you to prove your identity – for a stamp card, for example, by showing the card. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) (www.edoeb.admin.ch).

12. Changes

We may amend this privacy policy at any time. The version published on this page applies.