Privacy Policy
This policy explains how Stamps handles merchant accounts, customer loyalty data, and service telemetry.
Effective August 25, 2026 · Last updated August 25, 2026
1. Roles and scope
Stamps operates the platform and is the controller for merchant account, support, security, and website information. For member and loyalty data submitted by an organization, that organization is the controller and Stamps acts as its service provider or processor.
2. Information we process
We process account names, work emails, authentication records, organization details, API-key metadata, program settings, external member identifiers, optional member names and emails, loyalty balances, transaction metadata, request references, IP-derived security information, and operational logs.
3. Purposes
We use information to provide and secure the service; authenticate users; isolate organizations; process API instructions; maintain transaction records; communicate approvals and incidents; prevent abuse; troubleshoot reliability; comply with law; and improve product performance.
4. Legal bases
Depending on context, processing is necessary to perform a contract, meet legal obligations, protect legitimate security and service interests, or act on consent. Organizations are responsible for the legal basis covering the customer data they submit.
5. Service providers and transfers
We use infrastructure and authentication providers including Vercel, Neon, Google for root-administrator authentication, and transactional-email providers when configured. Data may be processed where these providers operate under contractual and technical safeguards. Core application and database workloads are configured in Singapore.
6. Retention
Account and organization records are retained while the service is active and for a reasonable period afterward for security, dispute, backup, and legal purposes. Loyalty transactions may be retained as an append-only audit record according to the organization’s instructions and applicable law. Operational logs and temporary backups use shorter, security-driven retention periods.
7. Security
Controls include tenant-scoped authorization, hashed API keys, key expiration and revocation, rate limits, encryption in transit, security headers, regional infrastructure, append-only transaction safeguards, and database-level tenant-integrity checks. No system can eliminate every risk.
8. Rights and organization requests
Individuals may request access, correction, deletion, restriction, objection, or portability where applicable. Customer-loyalty requests should normally be directed to the organization that collected the data. Organizations may contact us for assistance fulfilling a verified request.
9. Cookies
Stamps uses essential authentication and security cookies. Privacy-friendly performance or traffic measurement may be enabled without cross-site advertising profiles. If non-essential tracking is introduced, appropriate notice and consent controls will be added.
10. Contact
Privacy questions and verified requests may be sent to eddie@dxform.ph. We may request identity or authority verification before disclosing or deleting information.