Privacy Policy
Tampkit runs tap-to-stamp loyalty cards for local businesses like cafés. This policy explains what personal information we collect, how and why we collect it, who we share it with, where it's kept, and the choices you have. It covers three groups of people: customers who collect stamps on a card, the business owners and staff who use the Tampkit staff app, and visitors to our website.
We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). You can contact us about privacy at any time at customer@tampkit.app.
- We collect only what the loyalty card and the staff app need to work.
- We never sell your information, use it for advertising, or track you across other apps and websites.
- Customers can delete their card and sign-in at any time with Delete my data.
- Messages from a business only reach you if you add the card to Apple Wallet or turn notifications on, and you can switch them off at any time.
- Our providers (like Google, Cloudflare, Apple and Stripe) may store information outside Australia, mainly in the United States.
1. Who we are
“Tampkit”, “we”, “us” and “our” mean Tampkit, based in Sydney, New South Wales. You can reach us at customer@tampkit.app.
When you collect stamps at a business, Tampkit runs the card on that business’s behalf. The business decides what its card offers, and it can see its own customers’ cards. It can’t see cards you hold with any other business.
2. What we collect from customers
| When you sign in | If you sign in with Google: your email address and Google account ID. As part of standard Google sign-in, Google also shares your Google name and profile photo, which are stored with your sign-in record. We use the first name you give us on your card instead. We never get your Google password, contacts, emails or files. If you sign in with your email and a password, we get your email address, and your password is handled by Firebase Authentication. We never see it. |
|---|---|
| What you tell us | Your first name and your age. |
| What your card records | Which business (and which of its stores) your card is for, each stamp and the date and time you got it, the rewards and coupons you earn or use, and when you last opened your card. |
| When you tap the stamp | A one-time code from the stamp, used once to add your stamp and then thrown away. |
| Apple Wallet | If you add your card to Apple Wallet: a card number, your iPhone’s Wallet device ID and push token, so your card can update by itself. Your first name and stamps are shown on the card in your Wallet. |
| Notifications | If you turn on notifications in your browser: the notification address your browser gives us, so the business can send you messages. We also note your last visit, so you aren’t sent a “we miss you” message straight after coming in. |
| Technical information | When you open your card, your IP address and browser type are processed by Google Firebase and Cloudflare to sign you in, load the page and protect it from attacks. They keep these in security logs for a short time. |
| On your phone | Your browser keeps a copy of your card and a few settings (like sound on or off) so the page loads fast. You can clear this in your browser settings. |
We don’t collect your precise location, contacts, photos, payment details or what you buy.
3. What we collect from businesses and their staff
| Your account | Your name and email address, and your sign-in through Google, Microsoft or email and password (again, we never see your password). |
|---|---|
| Your team | The email addresses of the people you add to your team, and whether each one is an owner or staff. |
| Your business details | Your business name, address, phone, opening hours, logo, photos, menu, links (like Instagram or Google reviews) and the card design and offers you set up. Most of this is shown to your customers on their card. |
| Billing | The billing owner’s email, your business name, how many stores you pay for, your plan status, and your invoices and payment history. Card payments are handled by Stripe. We never see or store your full card number. |
| Pilot program feedback | While Tampkit is in its pilot program, we may ask for your feedback, or sit with you while you use the staff app. If you agree, we keep notes of what you tell us and where you got stuck. We only use them to improve Tampkit. |
| Messages with us | Anything you send us by email, phone or in person, so we can help you. |
4. Visitors to our website
When you visit tampkit.app, Cloudflare processes your IP address and browser type to deliver the page and protect it from attacks. We don’t use advertising or tracking cookies, and we don’t use analytics or advertising tools that follow you across other apps or websites.
5. How we collect it
We collect information directly from you when you sign up, use your card or the staff app, or contact us. We also get some from Google, Microsoft or Apple when you sign in or add your card to Wallet, from the stamp when you tap it, and from Stripe when a business pays. When a business adds you to its team, we get your email address from that business.
6. Why we collect it
For customers, we use your information to:
- sign you in, keep your stamps and rewards, and show your card on any phone you sign in on
- keep your Apple Wallet card up to date
- stop the same tap being counted twice and prevent misuse of the stamps
- show the business’s offers and treats, including ones only for people 18 and over
- let the business greet you by name, send you the messages it has set up, and see how its loyalty program is going.
For businesses and staff, we use your information to:
- run your account and staff app, and let your team sign in
- show your business details and offers on your customers’ cards
- bill you and send receipts, renewal reminders and other account emails
- help you when you contact us, and tell you about fixes and new features
- learn from pilot program feedback what to fix and build next.
We also use information to keep Tampkit secure and to meet our legal obligations. We only use it for these purposes. If we ever want to use it for something new, we’ll ask first, unless the law allows or requires it. We don’t use computer programs to make decisions that significantly affect you.
If you don’t give us the information a feature needs, that feature won’t work. For example, without signing in we can’t keep your stamps.
7. Messages and notifications
Customers: a business can send you short messages through Tampkit, such as “Thanks for coming in” or “1 stamp to go”. You’ll only get them if you add your card to Apple Wallet or turn on notifications. They’re held back overnight (9pm to 8am Sydney time), and you won’t get more than one automatic message a day. To stop them, turn off notifications for the card in Wallet or in your browser settings, or remove the card. We don’t send customers marketing emails.
Businesses: we send account emails you need, like your welcome, receipts, payment reminders and your weekly summary. We may also send news about Tampkit, such as new features. Every one of those has a way to unsubscribe, and you can always just reply and ask us to stop.
8. Who we share it with
- The business you joined and its staff can see your first name, stamps, rewards and visits, to run its loyalty program. Other businesses on Tampkit can’t see your card.
- Your team: owners and staff of the same business can see each other’s email addresses in the Team section.
- Our service providers, only to run Tampkit:
| Google Firebase | Sign-in and our database (your card, business accounts and settings) |
|---|---|
| Cloudflare | Hosting our pages and servers, stamp links and protection from attacks |
| Apple | Delivering Apple Wallet cards and their updates to iPhones |
| Stripe | Taking payments from businesses |
| Resend | Sending our emails |
| Google Maps Platform and Geoapify | The address search staff use to add their business address |
| Browser push services | Delivering notifications to customers who turned them on (run by the maker of your browser, such as Apple, Google or Mozilla) |
- If Tampkit is sold or merged, information may move to the new owner, who must keep protecting it under this policy.
- Anyone the law requires us to give it to.
Our providers can only use your information to provide their service to us. We don’t sell your information, use it for advertising, or give it to data brokers or to AI companies to train their models.
9. Information stored outside Australia
Our providers run servers around the world, so your information may be stored or processed outside Australia, mainly in the United States, and in other countries where Google, Cloudflare, Apple, Stripe and Resend operate. Before using a provider, we check that it protects personal information to a standard that meets Australian privacy law. Google processes Firebase data for us under its Firebase Data Processing and Security Terms, only to provide the service and not for its own advertising.
10. Google sign-in
We use Google sign-in only to confirm who you are and keep your account linked to you. We never sell your Google information or use it for advertising. Our use follows the Google API Services User Data Policy, including its Limited Use requirements. You can remove Tampkit’s access at any time at myaccount.google.com/connections.
11. How we keep it safe
- Information is sent over encrypted (HTTPS) connections and stored encrypted by our providers.
- Access is protected by sign-in. Customers see only their own cards, and each business sees only its own customers and team.
- Each stamp code works only once, so a copied link can’t be reused.
- Payment details stay with Stripe and never touch our servers.
No system is perfectly secure. If a data breach is likely to cause you serious harm, we’ll tell you and the Office of the Australian Information Commissioner (OAIC) as soon as we can, as the Notifiable Data Breaches scheme requires.
12. How long we keep it
- We keep a customer’s card while it’s being used. If a card isn’t opened for 2 years, we delete it.
- When you use Delete my data, your card and sign-in are removed from our live systems straight away. Google removes any backup copies within 180 days.
- If a business leaves Tampkit, we delete its customers’ cards and its business details within 30 days.
- We keep invoices and payment records for 5 years, because Australian tax law requires it.
- Security logs kept by our providers (like IP addresses) are deleted automatically after a short time.
13. Your choices and rights
- See or correct your information: email customer@tampkit.app. It’s free. We may need to check it’s you first, and we’ll reply within 30 days. If we can’t give you something, we’ll explain why.
- Delete: customers can use Delete my data at the bottom of their card. This also withdraws your agreement to this policy. Businesses can email us to close their account.
- Use a nickname: you don’t have to give your real first name. A nickname works fine. You do need to sign in, so we can keep your stamps safe.
- Turn off messages: see section 7.
- Don’t want to join? You don’t have to. Without a card we can’t keep your stamps or rewards, but you can still buy from the business as normal.
14. Age
You need to be 16 or older to make a card. We ask your age to check this and to only show 18+ offers to adults. If we learn that someone under 16 has made a card, we’ll delete it.
15. Questions and complaints
If you have a question or think we’ve mishandled your information, email customer@tampkit.app and tell us what happened. We’ll look into it and reply within 30 days. If you’re not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
16. Changes to this policy
If we change this policy, we’ll update the date at the top. If a change affects how we use your information in a significant way, we’ll show you the new policy in the app (and email businesses) and ask you to agree again before it applies to you.