Privacy

Who's responsible

Each business that uses Smudge decides how its stamp card works and is responsible for its customers' information. Smudge handles that information for the business, only to run its stamp card: we're its service provider.

For business owners, managers and staff, and for demo requests, Smudge is responsible for the information.

What we collect

From stamp card customers: your first name; your email and birthday month, only if you give them; whether you agreed to offers, with when you agreed, the version of the wording you saw, and a scrambled code made from your internet address (not the address itself); your stamps, rewards and visit times; the sale amount, if the business records it; which wallet you use; and, for Apple Wallet, the codes Apple gives us to update your card.

From businesses: the owner's and managers' emails, the business's details, staff names and when they sign in (PINs are stored scrambled and can't be read), and billing details. Card payments are handled by Stripe, our payment provider: we never see full card numbers.

From demo requests: your name, business, phone or email, and your message.

When anyone uses Smudge: your internet address and device details, for a short time, to keep the service secure (for example, to slow down repeated attempts), and error reports when something breaks.

Why we use it

To give you your card and keep it up to date. To send your card link if you change phones (only if you gave your email). To give your birthday reward (only if you gave your birthday month). To send offers, only if you agreed. To show the business its numbers and monthly report. To run billing. To keep Smudge secure and fix problems.

We don't sell personal information, and we don't use it for advertising.

Offers and your consent

You only get offers if you ticked the box yourself when you joined. We record when you agreed and the wording you saw, so the business can show your consent. You can stop offers at any time with one tap on your card, and it takes effect straight away.

Who we share it with

Only with the service providers that help us run Smudge, and only what each one needs: Supabase (our database), Vercel (hosting), Apple and Google (to put cards in their wallets and keep them up to date), Resend (emails), Stripe (business billing), Upstash (security limits, with scrambled internet addresses) and Sentry (error reports). They may only use it to provide their service to us.

We may also share information when the law requires it.

Where it's kept

Our database is in Canada. Some of our service providers process information in other countries, such as the United States, where it can be accessed by authorities under those countries' laws.

How long we keep it

Customers' information is kept while the business uses Smudge. If you delete your card, your name, email and birthday month are deleted straight away. When a business stops using Smudge, its customers' personal information is deleted 90 days later, or straight away if the business deletes its account. Anonymous numbers, such as visit counts, are kept.

Billing records are kept as long as tax law requires.

Your choices and rights

Stamp card customers can stop offers or delete their card from the card itself. You can also ask the business, or us, to see, correct or delete your information. Businesses can export or delete their data from their dashboard.

If you're not happy with how we've handled your information, tell us. You can also complain to the Office of the Privacy Commissioner of Canada or the Information and Privacy Commissioner for British Columbia.

Cookies

We only use cookies that Smudge needs to work: to keep you signed in, to remember your card on this phone, and to remember a few settings. We don't use advertising or tracking cookies.

Keeping it safe

Information is encrypted on its way to and from Smudge. Each business can only see its own customers. PINs and internet addresses are stored scrambled, and access to our systems is limited and logged.

Children

Smudge stamp cards aren't meant for children under 13.

Changes to this policy

If we change this policy, we'll update the date below. We'll tell businesses by email before an important change.

Contact

Questions or requests about privacy? Email hello@smudgecards.com.