Privacy Policy

Last updated: September 2026

1. Who We Are

Eazistamp is operated by Keigan Baldwin, an individual based in Barcelona, Spain ("Eazistamp", "we", "us"). We operate the Eazistamp loyalty stamp card platform, available at eazistamp.com, through the customer card web app, and through the Eazistamp staff app for iOS, Android and web.

For data protection purposes, we act as:

• Data Controller for data relating to our direct customers (business owners and staff who use Eazistamp)
• Data Processor on behalf of our business customers, for data relating to their end customers (loyalty card holders)

Contact for data protection matters: privacy@eazistamp.com

2. What Data We Collect and Why

For business owners and staff (our direct customers):

• Name and email address — to create and manage your account and sign you in
• Sign-in provider details — if you choose Sign in with Google or Sign in with Apple, see section 3
• Business name, address, logo and branding — to configure your loyalty program and wallet passes
• Payment information — processed by Stripe; we never see or store your card details
• Technical logs — error reports and service logs, to keep the platform secure and working
• Email address and business name (waitlist) — to notify you when Eazistamp launches; deleted on request

For loyalty card holders (end customers of businesses using Eazistamp):

• Name and, optionally, email address — to identify you and link your stamp card
• Stamp and reward history — to operate the loyalty program on behalf of the business
• Apple Wallet / Google Wallet pass identifiers — only if you add your card to a wallet, so the pass stays up to date
• Push notification tokens and language preference — only if you opt in

We do not sell personal data, and we do not use it for advertising.

3. Sign in with Google and Sign in with Apple

The Eazistamp staff app lets business owners and staff sign in with their Google or Apple account instead of a password.

What Google user data we access. When you sign in with Google we request only the basic email and profile scopes. Google shares your name, email address, profile picture and a Google account identifier with us. We do not request access to Gmail, Google Drive, Contacts, Calendar or any other Google service.

How we use it. We use this data only to authenticate you, to match your sign-in to your existing Eazistamp staff or owner account, and to show your name and picture inside the app. We do not use it for advertising, profiling, or any purpose unrelated to providing the Eazistamp service.

How we store and protect it.The data is stored in Google Firebase Authentication and Cloud Firestore, encrypted in transit (TLS) and at rest, and is accessible only to Eazistamp's own systems and to you.

Sharing. We do not sell or transfer Google user data to third parties, except the infrastructure providers listed in section 5 that host the service for us, or where required by law.

Retention and deletion. We keep this data while your account exists. You can delete your account from the app (Account → Delete account) or by emailingprivacy@eazistamp.com; the data is then deleted within 30 days. You can also revoke Eazistamp's access at any time from yourGoogle Account permissions page.

Eazistamp's use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements.

Sign in with Apple works the same way: we receive your name and email address (or an Apple private relay address if you choose to hide your email) and use them only to sign you in.

4. Legal Basis for Processing (GDPR)

• Performance of contract — processing necessary to provide the Eazistamp service to you
• Legitimate interests — analytics and platform improvement, fraud prevention
• Legitimate interests (soft opt-in) — occasional offers from a business whose loyalty card you hold, about its own products. You can refuse when you join, turn offers off at any time in your profile, or use the “Manage or stop offers” link on your wallet pass
• Legal obligation — tax records, compliance with applicable law
• Consent — push notifications and optional sign-in with Google or Apple (you can withdraw at any time)

5. Third-Party Services and International Transfers

We use the following third-party services which may process your data:

• Google Firebase / Firestore — database, authentication (including Sign in with Google), hosting (USA; EU data centre: europe-west1) — Standard Contractual Clauses
• Stripe — payment processing (USA/EU) — Standard Contractual Clauses
• Resend / Nodemailer — transactional email (USA) — Standard Contractual Clauses
• Vercel — website hosting (USA) — Standard Contractual Clauses
• Apple — Wallet pass delivery (USA) — Standard Contractual Clauses
• Google — Wallet pass delivery (USA) — Standard Contractual Clauses

All international transfers rely on Standard Contractual Clauses approved by the European Commission.

6. How Long We Keep Your Data

• Account data: for the duration of your account, plus 30 days after a deletion request
• Loyalty card data: for the duration of the business's subscription, plus 30 days
• Payment records: 7 years (Spanish tax law requirement)
• Backup exports: 30 days

7. Your Rights

Under GDPR and Spanish law (LOPDGDD), you have the right to:

• Access your personal data
• Rectification of inaccurate data
• Erasure ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Object to processing based on legitimate interests
• Restrict processing in certain circumstances
• Withdraw consent at any time where processing is based on consent

To exercise any right, email privacy@eazistamp.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Spanish data protection authority: Agencia Española de Protección de Datos (AEPD) at aepd.es.

8. Cookies and Tracking

Our marketing website uses strictly necessary cookies to keep you signed in and remember consent preferences. We do not use advertising or tracking cookies. See our cookie banner for details. The Eazistamp apps do not use advertising identifiers or third-party analytics SDKs.

9. Changes to This Policy

We will notify you of material changes by email or in-app notification at least 14 days before they take effect.

10. Contact

Questions about this policy or your data: privacy@eazistamp.com.