Privacy Policy
Last updated 15 September 2026
- Seller
- Stemply, sole trader
- Country
- Ukraine
- Service
- https://stemply.online
- Contact
- contact@stemply.online
1. Two different roles
This matters, so it comes first. For the account of the business owner we are the controller. For the data a business enters about its own customers we are the processor — the business decides what is collected and why, and we act on its instructions.
2. What we collect
From the business: name, email address, business name and address, language and settings, sign-in records, and payment status received from Creem.
Entered by the business about its customers: a name if given, the card code, the stamp or point balance, and the history of visits. We ask for no more than that — no surname, address or date of birth is required to run a loyalty card.
Technical: server logs with IP address and request time, kept for security and troubleshooting.
3. Why
To provide the service you signed up for, to take payment, to keep the service secure, and to meet legal obligations such as accounting. We do not sell data and we do not use your customers' data for our own purposes.
4. Who else processes it
- Hosting provider — the servers the application and database run on.
- Creem — payments and invoicing, as merchant of record.
- Apple and Google — delivery of wallet cards and push updates to phones.
- Cloudflare — DNS and protection of traffic to the site.
5. Where it is stored
Data is stored on servers in the European Union. Each business's data is isolated at database level, so one business cannot read another's.
6. How long
Business account data is kept while the account is open and for up to 12 months after closure, then deleted. Customer records are deleted when the business deletes them or when its account is deleted. Accounting records are kept for as long as the law requires.
7. Your rights
You may request access to your data, correction, deletion, or a copy in a portable format. Write to us and we will respond within 30 days. If your customer contacts us directly about their data, we will refer them to the business that holds it, which is the correct route.
8. Security
Traffic is encrypted in transit. Passwords are stored hashed, never in readable form. Access to production data is limited to the person named above.