Privacy policy
This policy explains what information PunchCardQR collects from business owners and their customers, how it's used, and the choices available. PunchCardQR is a loyalty-card platform used by a business ("Owner") to run a digital punch card for their own customers ("Members").
Information we collect
From Owners: your email address (used for passwordless sign-in), business name and details you add (website, phone, Instagram, timezone), and billing information, which is processed directly by Stripe — we never store your card number.
From Members: a customer only provides information they choose to share. Joining a loyalty card requires no personal details by default. If a Member opts in to marketing or requests card recovery, we store the email address they provide for that purpose only. An Owner may optionally record a Member's name, phone or birthday for card-management purposes.
Automatically: basic technical data such as IP address and browser type, used only for security, rate-limiting and diagnosing issues — not for advertising or tracking across other websites.
How we use information
- To operate the loyalty card platform: creating accounts, recording punches, issuing rewards, and generating the dashboard an Owner sees.
- To send transactional email: sign-in codes, card recovery links, and receipts, all directly tied to an action you or a Member took.
- To send marketing email to Members only when an Owner has enabled a campaign (such as a birthday reward) and the Member has explicitly opted in at signup.
- To process payments for paid plans, handled by Stripe under its own privacy policy.
What we don't do
- We don't sell personal data to third parties.
- We don't share one business's customer list with another business.
- We don't require a Member to create a password or account to use a loyalty card.
Data storage and security
Data is stored with Supabase (Postgres) and protected by row-level security policies that scope every business's data to that business alone. Passwordless sign-in codes and card-recovery links expire automatically and can only be used once.
Cookies and local storage
We use browser local storage to keep an Owner signed in and to remember device-level preferences, such as which location a Scan-mode device is operating from. We don't use third-party advertising cookies.
Your choices
- Members can decline marketing emails at signup, or ask the business they joined to remove their contact information at any time.
- Owners can export or delete their business data by contacting us.
- Anyone can request a copy of the personal data we hold about them.
Changes to this policy
If this policy changes materially, we'll update the date above and, where required, notify Owners by email.
Contact
Questions about this policy or your data can be sent to support@punchcardqr.com.