Template. Replace the bracketed details and have a solicitor review before launch.

Privacy notice

Last updated [date]

Who we are

Tap Loyalty is run by [Company legal name], company number [number], registered at [registered address] ("we"). Contact: privacy@taployalty.co.

When you collect stamps at a café, the café is responsible for your details (the "controller") and we look after them on its behalf (the "processor"). For café owners' own accounts, we are the controller.

What we collect from customers

• Your first name, and your email if you choose to give it.
• Your stamp card: card number, stamps, rewards, and when you collected or used them.
• Whether you agreed to receive offers from the café, and when.
• A cookie on your phone that remembers your card for that café. It is needed for the service to work, not for advertising.
• A small counter in your browser's local storage that remembers your choice about the Add to Wallet button, so we don't keep asking. It is strictly functional and isn't used for tracking.
• If you add the card to Apple Wallet or Google Wallet: a device identifier and push token so your card can update. We don't receive your Apple or Google account details.

Why we use it

• To run your stamp card for the café (performance of a contract).
• To email you a link to your card, if you gave an email (performance of a contract).
• To send offers from the café, only if you ticked the box (consent). You can turn offers off at any time with the "Stop offers" link on your card page, or ask the café, which can record that you opted out.
• To prevent fraud, such as stamps without a purchase (legitimate interests).

We don't sell your details or use them for advertising.

Who we share it with

• The café you joined. Each café sees only its own customers.
• Service providers who help us run Tap Loyalty: Microsoft Azure (hosting), [email provider] (emails), Apple and Google (Wallet passes), Stripe (café billing only).

This website (taployalty.co) and the venue admin panel use Google Fonts, so Google receives your IP address when a page loads. The customer card page does not. The website sets no cookies and has no analytics or tracking.

International transfers

Your details are stored in [region, e.g. the EU or Australia]. Our team may access them from Pakistan to provide support. Where details leave the UK, EEA or Australia, we use safeguards such as the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

How long we keep it

While your card is in use. Cards with no activity for 24 months are deleted. When a café cancels, its customers' details are deleted 30 days after cancellation, or 90 days after its free trial ends if it never chose a plan.

Your rights

You can access, correct or delete your details, object to their use, or withdraw consent. The quickest way to delete your card is the "Delete my card" link under your stamps. Otherwise write to privacy@taployalty.co or ask the café.

You can complain to your data protection authority: the ICO in the UK, the OAIC in Australia, or the authority in your EU country.

Children

Tap Loyalty isn't meant for children under 13 (under 16 in some EU countries).