Personal data
Privacy policy
Last updated: 5 October 2026
This translation is provided for information. In case of discrepancy, the French version prevails. French version
Stamply gives shops a loyalty card in Apple Wallet and Google Wallet. This page explains what data we process, why, and what your rights are, in accordance with Moroccan law no. 09-08 on the protection of individuals with regard to the processing of personal data.
01Who is responsible
For merchant accounts (owners and their teams), Stamply is the data controller.
For a shop's customers (card holders), the shop is the data controller; Stamply acts as a processor and only processes this data on the shop's instructions, to make the card work.
Contact: info@karelotm.dev.
02Data we collect
Merchants: name, email address, password (stored hashed), shop name and visuals, log of actions taken in the dashboard.
Shop customers: first name, phone number, marketing consent, history of stamps, points and rewards. The phone number is encrypted (AES-256) and is never shown in full in lists.
We do not receive customers' location: nearby reminders are computed by the phone itself.
03Sign in with Google
If you choose “Continue with Google”, we only receive your name, email address and profile picture, in order to create and open your Stamply account.
This data is not sold, not shared with third parties and not used for advertising. Stamply's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
04Purposes
Providing the service: creating and updating cards, adding stamps, handing out rewards, the shop dashboard.
Sending notifications on the card (reward available, offers) only to customers who agreed, at most one campaign per card per day.
Security: preventing fraud and abuse (rate limits, Cloudflare Turnstile bot check, audit log).
05Hosting and processors
Application and files: Vercel (Paris region). Database: Neon (Frankfurt). Job queues and rate limits: Upstash (Frankfurt). Cards: Apple Wallet and Google Wallet. Bot protection: Cloudflare.
These providers process data only to deliver their service to Stamply.
06Retention
A customer's data is kept while their card is active, then anonymised after 24 months of inactivity. A merchant's data is kept for the duration of the subscription, then deleted on request.
07Your rights
You have the right to access, correct, object to and delete your data. Customers can delete their data directly from the “Your data” link on the back of their card, or by writing to the shop or to info@karelotm.dev.
You can also lodge a complaint with the CNDP (Morocco's national commission for the protection of personal data).