Privacy policy
Last updated: 07.09.2026
This is a translation. The Polish version is the binding one, because stamplik operates in Poland and Polish law governs it.
1. Who the controller is
The controller is Radosław Kraj, trading as Radosław Kraj, ul. Pychowicka 3B/72, 30-364 Kraków, Poland, NIP 6762699438, REGON 542399330.
For anything to do with personal data, write to hi@stamplik.app.
We have not appointed a data protection officer. We are not required to, and the address above reaches the person who is actually responsible for this data.
2. What we collect
If you collect stamps (Customer):
- Your Account identifier, email address, name and profile picture. Google provides these when you sign in. You never set a password here and never fill in a form.
- Your Cards: stamp count, the history of Rewards you have claimed, and the dates of your first and most recent Stamp.
- A record of every Stamp Grant and every Redemption: which Card, which Venue, which Staff member, and when.
If you run a Business:
- Everything above, because your Account is one Account, plus
- your Business and Venue details, including the address, and a logo if you add one.
If you are a Business’s Staff:
- Your Account identifier, email address, name and profile picture, the same as a Customer.
- Your identifier is recorded on every Stamp Grant and Redemption you confirm, so it can be established who performed a given action. The basis is our and the Business’s legitimate interest (Article 6(1)(f) GDPR) in accountability for actions taken on its Customers’ Accounts.
We do not collect your phone number, date of birth, gender or location. We do not ask for anything that is not on this list.
3. Why, and on what legal basis
We process this data to make the service work: so your Card remembers how many Stamps you have, so a Business can confirm a Reward, and so you can sign in. The legal basis for these operations is Article 6(1)(b) GDPR, performance of a contract you are party to.
We also use the same data to compute a Business aggregate statistics about its own program: what share of its Customers come back a second time, what share have collected at least one Reward, how many collected a Stamp in the last 30 days, how many have been in at least twice but not in the last 30 days, how many are one or two Stamps away from a Reward, how many Stamps and how many new Customers arrive each week, how many Customers collected a Stamp in the last 30 days having also collected one before that, how many Rewards were redeemed in the last 30 days, how many days it typically takes a Customer to reach a first Reward, and which days of the week see the most Stamps. Some of these numbers are also shown against where they stood 30 days earlier. A Business sees only counts and percentages across all of its Customers together, and none of these statistics are attributed to you by name or single you out in any way. With very few Customers these numbers unavoidably cover only a handful of people, and we do not hide them from the Business in that case, because the Business granted every one of those Stamps itself. The legal basis is our and the Business’s legitimate interest (Article 6(1)(f) GDPR) in assessing whether its loyalty program works at all. You can object to this processing — see §7.
If we introduce features that need a different legal basis in future — in particular communications targeted individually at you based on your visit history — we will describe that basis separately here and, wherever the law requires it, ask for your consent beforehand.
Providing the data is voluntary, but the service cannot work without it. A Card with no Account has nobody to belong to.
4. Who we share it with
The Business where you collect Stamps. It sees your name and the state of your Card with them, plus the aggregate statistics about its program described in §3, which are not attributed to any individual Customer. It does not see your email address, or the Cards you hold at other Businesses. What a Business then does with that knowledge on its own account, such as offering you something at the counter, is its own affair and its own responsibility, as an independent controller.
Google Ireland Limited and Google Cloud EMEA Limited, as our processor, for hosting, the database and sign-in.
That is the entire list. We currently use no analytics, no advertising tools, no CRM and no mailing list. We do not sell data and never will.
5. Transfers outside the European Economic Area
Cards, Stamps, Redemptions, Business and Venue records and logos are stored in Warsaw, in the European Union. That data does not leave the EEA.
Sign-in is the exception. Firebase Authentication runs in the United States and offers no European region. It holds your Account identifier, email address, name, profile picture and sign-in timestamps. That transfer rests on Google’s certification under the EU-US Data Privacy Framework and on the standard contractual clauses in our data processing agreement with Google.
6. How long we keep it
For as long as you have an Account. Stamps do not expire, so a Card from two years ago is still your Card.
When you ask us to delete it, we delete everything: the Account, the Cards, the Stamp and Redemption history. We keep no just-in-case copy.
If a Business Owner asks for deletion, we also delete that Business along with its Programs, Venues and its Customers’ Cards. A loyalty card for a business that no longer exists has nothing left to remember.
We have not yet set a period after which an unused Card is deleted automatically. When we do, it will be described here.
7. Your rights
You have the right to:
- access your data and receive a copy of it,
- have inaccurate data corrected,
- have your data erased,
- restrict processing,
- data portability, meaning a copy in a machine-readable format,
- object to processing.
Write to hi@stamplik.app. We answer within one month. If a request turns out to be complex we may extend that by two months, but we will tell you within the first month if we do.
There is no “delete account” button. We do it by hand, after your email. At our scale that is more reliable than an automated process that might miss something.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.
8. What we store on your device
There is no cookie banner here, because there is nothing to ask consent for. We store exactly three things, all strictly necessary for the service you asked for:
| What | Where | Why |
|---|---|---|
| Sign-in session token | IndexedDB | To keep you signed in |
| Chosen language | localStorage | So the app remembers whether you prefer Polish or English |
| Application files | Cache Storage | So the app installed on your phone works |
There is no fourth item. There are no analytics, advertising or tracking cookies — we currently use no tools of that kind.
We also load nothing from anyone else’s servers. Fonts, icons and the rest of the page come from our own, so simply opening it sends your IP address to nobody.
9. What we do not do
We do not currently profile you individually. The aggregate statistics described in §3 are not the same thing — nobody sees information there attributed to you by name, only counts across all of a Business’s Customers together. We make no fully automated decisions about you that produce legal effects or similarly significantly affect you (Article 22 GDPR). The number of Stamps on a Card is a number of Stamps, not a rating or a score.
We do not track you outside stamplik. We do not know where you were before, or where you go next.
10. Changes
If we change this policy we will change the date at the top of the page. If a change is significant, we will say so in the app before it takes effect.
Last updated: 07.09.2026.