Privacy notice

Last updated 11 November 2026

In short: we collect as little as we can: an email address to sign you in, your stamps, and only what you choose to add. Each shop sees only its own customers. We never sell your data, show adverts or use tracking cookies, and you can delete your cards or your whole account yourself at any time.

1. Who we are

StampOwl is provided by Danci Ltd, a company registered in England and Wales (company number 17228936), registered office Unit 8b Slutchers Ln, Bank Quay Trading Estate, Warrington, WA1 1PJ. We are registered with the Information Commissioner’s Office (ICO) under number ZC293551. For anything about your data, email privacy@stampowl.co.uk.

This notice covers everyone who uses StampOwl: customers who collect stamps, business owners, their staff, and visitors to our website.

2. Who is responsible for your data

Your StampOwl sign-in and My cards (your email address and the list of cards you hold): StampOwl is the controller.
Your card at a particular shop (your stamps, rewards and visits there, and your marketing choice for that shop): that shop is the controller and decides how it is used. StampOwl processes it on the shop’s behalf.
Business owners’ accounts: StampOwl is the controller.
Staff using the scanner: the business you work for is the controller, and StampOwl processes your details for it.

3. What we collect

If you collect stamps

Your email address, to sign you in with a one-time code. There is no password.
Your first name, only if you choose to give it.
Your birthday, only if a shop offers a birthday treat and you choose to give it.
Each card you join, with your stamps, rewards and visits, the date and time of each, and which member of staff gave them.
For each shop, whether you agreed to receive offers and reminders, and any reminder emails sent to you.

If you run a business

Your name and email address, and your Google profile name and picture if you sign in with Google.
Your business details: name, type, town, logo, card design, reward rules and settings.
Billing details: your subscription and payment status. Your card details are held by Stripe, not by us.
Messages you send us.

If you use the scanner as staff

Your name, as added by the business owner or typed when you sign in.
Your PIN, stored only in a scrambled (hashed) form that can’t be turned back into the PIN.
When you last signed in, a random identifier for the phone you use, and the stamps and rewards you gave.

Everyone

Basic technical information that any website receives, such as your IP address and browser type. Our hosting provider keeps this in short-lived logs to keep the service secure and working. We do not use analytics or advertising trackers.

4. How we use it and our legal basis

What we do	Legal basis
Sign you in, show your cards, let staff add stamps and give rewards, run the business dashboard and scanner	Contract: providing the service you asked for
Stop fake stamps and misuse: rotating card codes, limits between visits, PIN lockouts, records of who gave each stamp	Legitimate interests: keeping the scheme fair and secure for shops and customers
Send offers and reminder emails from a shop	Consent: only if you tick the box for that shop. You can withdraw it at any time
Birthday treats	Consent: only if you choose to give your birthday
Take payments and keep accounting records for businesses	Contract, and legal obligation (tax law)
Reply to questions and handle complaints or legal requests	Legitimate interests, and legal obligation where it applies

We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not build advertising profiles.

5. Offers and reminder emails

Joining a stamp card is not agreeing to marketing. A shop can only send you offers or reminders if you tick the separate, unticked box when you join. On some plans, StampOwl sends reminders in the shop’s name, for example when your reward is waiting, at most once a week. Every email has an unsubscribe link, and you can switch emails off for any shop from your card at any time.

The shops you join see your email address, your first name if given, your stamps, rewards and visits at their shop, and your marketing choice for them. Staff using the scanner see your first name or a partly hidden email. A shop never sees your cards at other shops.
Business owners see the names of their staff and the stamps each one gave.
Our service providers help us run StampOwl, under contracts that require them to protect your data and use it only for us:

Provider	What it does	Where
Vercel Inc.	Hosts the website and runs the app	Servers in London, UK. US company.
Neon Inc.	Database that stores accounts, cards, stamps and settings	Servers in London, UK. US company.
Clerk, Inc.	Business owner sign-in and accounts	United States
Resend	Sends emails: sign-in codes and reminder emails	Sent from Ireland, EU. US company.
Stripe Payments UK Ltd	Takes subscription payments from businesses	UK and EU, with some processing in the US

If a business owner chooses “Continue with Google”, Google shares their name, email address and profile picture with us under Google’s own privacy policy.
We may share data if the law requires it, or to protect the rights and safety of others.
If StampOwl is ever sold or transferred, your data would pass to the new owner, who must keep protecting it as this notice describes.

We never sell your data and never share it with advertisers.

7. International transfers

We keep our main database and website hosting in London. Some providers are based in, or may access data from, the United States. Those transfers are protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or by the UK International Data Transfer Agreement or Addendum.

8. How long we keep it

Your sign-in and cards: until you delete them. Deleting a card removes its stamps and history; deleting your account removes everything.
Sign-in codes: stored scrambled, they stop working after 10 minutes and are deleted within a day.
Wrong-PIN records (used to block guessing): deleted within a day.
A shop’s data: deleted within 30 days after the business closes its account. Your cards at other shops are not affected.
Staff details: until the business owner removes you, or the business closes its account.
Billing records: kept for six years, as tax law requires.
Server logs: kept for a short time by our hosting provider, typically a few days.

9. How we protect it

Everything is sent over encrypted connections (HTTPS). PINs and sign-in codes are only stored in scrambled form. Sign-in cookies are signed so they can’t be forged. Card codes change every 30 seconds so they can’t be copied. Each business can see only its own customers, and access to our systems is limited to the people who need it to run StampOwl.

10. Your rights

Under UK data protection law you have the right to:

get a copy of your data;
have inaccurate data corrected;
have your data deleted. You can do this yourself: open any card and choose to delete that card or your whole account;
restrict or object to how we use your data, including objecting to anything based on legitimate interests;
receive your data in a portable format;
withdraw consent at any time, for example by switching off emails from a shop.

Email privacy@stampowl.co.uk to use any of these rights. We will reply within one month. For data a shop controls, we will pass your request to that shop and help it respond. If you are unhappy with how your data is handled, please tell us first so we can put it right. You can also complain to the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

11. Children

StampOwl is not intended for children under 13, and children under 13 should not sign up. If you believe a child under 13 has given us their details, email privacy@stampowl.co.uk and we will delete them.

12. Cookies and similar technologies

We only use what is needed to run StampOwl. We use no advertising, analytics or tracking cookies, so we don’t ask you to accept any.

Name	What it is for	How long
customer	Keeps you signed in to My cards on this device	1 year, or until you sign out
staff	Keeps staff signed in to the scanner	30 days with a personal PIN; one shift (14 hours) with a shared shop PIN
__session, __client_uat and similar	Set by Clerk to keep business owners signed in, and to protect sign-in from attacks	Until you sign out, or as set by Clerk
Theme and scanner settings (stored in your browser)	Remember your chosen colour theme, and that the camera has been allowed for the scanner	Until you clear your browser data

13. Changes to this notice

We will update this notice if the way we handle data changes. The date at the top shows the latest version. If we make a significant change, we will tell you by email or on the site. Businesses can also read our terms for businesses, which include our data processing agreement.

14. Contact

Danci Ltd, Unit 8b Slutchers Ln, Bank Quay Trading Estate, Warrington, WA1 1PJ. Email: privacy@stampowl.co.uk. Company number 17228936. ICO registration number ZC293551.