Privacy

Privacy notice

Last updated: 5 November 2026

Staamp keeps digital loyalty cards for small businesses. To do that we hold some personal data, about the businesses that use Staamp and about their customers. This notice explains what we hold, why we hold it, who else sees it, how long we keep it and what you can ask us to do. We do not sell personal data, we do not show adverts and we do not use analytics or tracking.

Who we are

Staamp is run by Alvento Ltd, a company registered in England and Wales (company number 16394298). That covers staamp.co.uk and the loyalty card and staff pages that each business has on its own web address. For anything about privacy, email [email protected].

Who is responsible for your data depends on who you are:

  • If you enquire about Staamp or run a business that uses it, Alvento Ltd is the controller of your data.
  • If you are a customer collecting stamps, the business you collect them with is the controller. Alvento Ltd processes your card data on its behalf, following its instructions. You can ask the business or us about it, and we will help either way.

If you enquire or your business uses Staamp

  • Enquiry form: your business name, your email address and the plan you asked about. We use these to reply and to set up a demo. When you send the form, we email ourselves your business name, email and the plan you asked about, so we can reply quickly.
  • Business account: your business name, address, phone number, opening hours, logo, colours and web address, and the staff password, which we store only in a scrambled form we cannot read.
  • Messages from Staamp: when we send a message to your dashboard, we record when your business read it.

Our lawful basis is taking steps at your request before a contract (for enquiries) and the contract itself (for accounts). We contact you only about your enquiry or your account.

If you are a customer collecting stamps

  • Your name, which is how the business finds your card.
  • Your email address, only if you choose to give it, and whether you agreed to hear from the business by email.
  • That you agreed to your visits being recorded, the words you agreed to and when.
  • Your stamps, check-in requests and rewards, and when each happened.

This is used only to run the business's loyalty card. The lawful basis is your consent, which the card asks for when you join and records again with each check-in. If you gave your email and agreed to hear from the business, the business can download it to contact you. Staamp does not email you itself.

So that it does not ask every visit, your card remembers on your phone that you agreed. That is stored only in your phone's browser, and you can switch it off from the card with "Stop remembering my consent".

If you tick "Remember me on this phone", your card also remembers your name on your phone, so it opens straight on your card next time. That is stored only in your phone's browser, it is off unless you tick it, and you can switch it off by unticking it or by tapping "Not you?" on the card.

You can ask staff to delete your card at any time; they can do it from their dashboard. You can also ask us.

If you add your card to Apple Wallet

You can add your card to Apple Wallet on an iPhone. That is your choice: a card is in your Wallet only if you add it, and you can remove it at any time. The lawful basis is your consent, which you give by adding the card.

  • What is on the card: the business's name, logo and colours, your name, your stamp count, your card number and whether a reward is ready. The card is stored on your phone. Apple's privacy policy covers how Wallet handles it on your device and in iCloud.
  • A private key: your card contains a private key that identifies your card to Staamp. The "Open your card" link on the back of the card uses it to open your card without you typing your name. Your phone sends the key to us over a secure connection only to find your card, and we do not write it to our logs. Anyone who can open your Wallet can use the card, so do not share it.
  • Keeping it up to date: when you add the card, your phone registers with Staamp. We store a device identifier and a push token that Apple gives your phone, together with your card. When your stamps change we send Apple a message addressed to that token, and Apple wakes your phone so the card can ask us for the new version. That message contains no personal data: no name and no stamp count. When a reward is earned your phone may show an alert, which your phone builds itself from the updated card.
  • Adding the card: the link that adds your card to Wallet works once and expires after five minutes.
  • Removing it: when you remove the card from Wallet, your phone tells us, we stop updating it and we delete the registration. If staff delete your card, the copy in your Wallet is marked as no longer active the next time your phone checks.

Who else handles data

  • Cloudflare carries all traffic to Staamp pages, so it sees your IP address and the pages you request.
  • Apple (only if you add your card to Apple Wallet) stores the card in Wallet on your phone and delivers the update message through the Apple Push Notification service. Apple handles that under its own privacy policy and may handle data outside the UK.
  • Oracle Cloud Infrastructure Email Delivery (London region) sends that enquiry email, and Google Workspace holds it in our Alvento mailbox.

Staamp itself runs on servers operated by Alvento Ltd in the United Kingdom. Cloudflare and Google may handle data outside the UK; where they do, they rely on the safeguards UK law requires for international transfers.

Logs and backups

Our servers keep logs of the pages requested, which can include the name typed to open a card. These logs are kept for 14 days. The application also logs check-ins and rewards, including the customer's name, to help us fix problems; these logs are kept for 30 days. Copies of the Staamp database are backed up every night and kept for 30 days.

How long we keep data

  • Enquiries: 12 months after you send the form, unless you become a customer or ask us to delete them sooner.
  • Business accounts: while the account is open, then deleted within 30 days of it closing.
  • Customer cards: until the customer or the business deletes them. When a business stops using Staamp, we delete its customers' data within 30 days.
  • Apple Wallet registrations: until you remove the card from Wallet or the business stops using Staamp, whichever is first. When a card is deleted we keep a small record of it (its number and its private key) so the copy on a phone can show that it is no longer active, and we delete that record within 30 days of the business stopping.

Deleted data can stay in backups for up to 30 days before those backups expire.

Cookies and browser storage

When staff sign in, we set one cookie to keep them signed in. Staamp also stores a few settings in your browser: that a customer agreed to visit tracking and, only if they tick "Remember me on this phone", the customer's name (both on the card), the business web address used to sign in (on staamp.co.uk), and display preferences on the staff dashboard. None of these track you, and we use no advertising or analytics cookies, so there is no cookie banner.

Your rights

You can ask to see the data we hold about you, to correct it, to delete it, to restrict or object to how it is used, or to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Email [email protected] and we will reply within one month. If you are a customer of a business, you can also ask the business directly.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Changes

If we change how we handle personal data, we will update this page and the date at the top.