Privacy policy

Stampil is run from Israel, at stampil.co.il. For any privacy question, write to us at the address at the bottom of this page.

When a business opens an account or adds a staff member, we store:

• The business's name, and the owner's phone number and email address.
• A password, in hashed form only. We cannot read it.
• The logo and colour the business chose, and its loyalty program settings.
• The name and phone number of each staff member the business added, and a hashed password.
• The plan the business is on (Free, Pro or Business) and when it started.

A business owner can sign in with a Google account. When they do, we receive the email address, the name and an identifier of the account from Google. We use them only to recognise you and sign you in to your business account.

We never receive your Google password, we do not access your contacts, mail or files, and we do not pass this information to anyone.

A customer who joins a business's card gives a name and a phone number. On the business's behalf we store:

• Name and phone number.
• The state of the card: stamps, points, tier and rewards owed.
• Visit history: when a stamp, a purchase or a redeemed reward was recorded, and by which staff member. On a points program the purchase amount is stored too.
• Messages the business sent to its cardholders.

This information belongs to the business the customer joined. The business decides what is done with it, and Stampil stores and processes it for that business. A customer never opens an account or chooses a password: the personal link to the card is the key, so it should not be shared.

Someone who leaves their details in the form on this site gives a name, a business name, a phone number and, if they wish, an email address and a message. We use them to get back to that person and for nothing else.

We use only the cookies the service needs to work: to keep you signed in, to remember the language you chose, and to complete a sign-in from an emailed link. There are no advertising cookies and no marketing trackers on this site.

To protect the service we see the IP address of whoever calls it, and use it to limit repeated sign-in attempts. Forms and sign-in run a Cloudflare Turnstile check that confirms a person, not software, is submitting. Server errors are logged so that we can fix them.

• To run the service: cards, stamps, rewards and messages.
• To sign you in and keep your account safe.
• To send emails the service needs, such as confirming an address or resetting a password.
• To get back to people who contacted us.

We do not sell information, and we do not use it for advertising.

The service runs on providers that hold information for us, only in order to provide their service to us:

• Supabase — the database, logo files and email sign-in. In Frankfurt, Germany.
• Render — the server. In Frankfurt, Germany.
• Vercel — hosting for this site.
• Cloudflare — the site's domain and the person check on forms.
• Resend — delivery of the service's emails.
• Google — signing in with Google, if you chose it.

Some of these providers also operate outside Israel and outside Europe. Beyond that, we hand over information only where the law requires us to.

Information about a business is kept while its account is active. Information about a customer is kept while their card exists with the business. When we are asked to delete, we delete within a reasonable time, except for what the law requires us to keep.

Under Israel's Protection of Privacy Law, anyone may see the information held about them, ask for it to be corrected and ask for it to be deleted.

A business owner can write to us directly. A business's customer can ask the business they joined, or ask us, and we will pass the request to the business and help carry it out.

All traffic to the site is encrypted, passwords are stored hashed, and access to a business's information is limited to that business and the staff it added. No system is completely safe; if we learn of an incident that affected your information, we will tell you.

If we change this policy we will update this page and the date at its top. We will email business owners about a material change.