Privacy policy
Version of 2026-09-27
This policy explains what data Estamp processes, why, and how to exercise your rights. The data controller is Antoine RICOURT, sole proprietor (micro-entreprise), SIREN 893 043 836, 18 rue de Boyer, 69160 Tassin-la-Demi-Lune, France. Contact: contact@estampapp.com.
What we collect
Account: email address, first and last name, sign-in method (Apple, Google or email), a generated public ID, language, preferences (anonymity, newsletter), and the date and version of the terms you accepted.
Use: your loyalty cards, your stamp requests, your approved visits and your rewards.
Merchants: the shop's name, category and photo, the card and rewards configured, the subscription status and the billing events sent by the App Store or Google Play. We never receive your bank details: payment is handled entirely by Apple or Google.
Device: your phone's notification identifier if you allowed notifications and, when the app crashes, a technical report (device model, version, error trace) without your name or email.
No advertising, no advertising trackers, no selling of data.
What a merchant sees
A merchant only sees the customers who joined their card, and for each one: the six-character public ID, or the first name and last initial if you chose to be seen. They see your requests, visits and rewards at their shop, never at another one. They never have access to your full name or email.
Why, and on what basis
Providing the service (account, cards, stamps, subscription): performance of the contract. Notifications and newsletter: your consent, which you can withdraw at any time in your phone settings or your profile. Security, preventing stamp fraud and crash reports: our legitimate interest in a reliable service. Keeping billing events: our legal and accounting obligations.
How long
Your data is kept for as long as your account exists. Deleting the account, from your profile or by writing to contact@estampapp.com, erases it from our database immediately; technical backups are overwritten within 30 days. Billing events, which hold neither a name nor bank data, are kept for 10 years. Crash reports are deleted after 90 days.
Who processes data for us
Supabase (database hosting and authentication, servers in the European Union), Expo (sending notifications), RevenueCat (subscription tracking), Sentry (crash reports), Apple and Google (sign-in, notifications and payments, as controllers of their own processing). Some of these providers are based in the United States; transfers rely on the Data Privacy Framework or on the European Commission's standard contractual clauses.
Your rights
You can access, correct or erase your data, get a copy of it, object to some processing or ask for it to be restricted by writing to contact@estampapp.com. We answer within one month. You can also lodge a complaint with the CNIL (www.cnil.fr), the French data protection authority.
Changes
After a significant change to this policy, the app tells you and asks you to accept it again.