Privacy Policy

Who we are

Stampkaro is a digital loyalty card service for businesses in India, operated as a sole proprietorship registered under Udyam with its place of business in Pithoragarh, Uttarakhand. In this policy, we means Stampkaro, the business means a shop, café or other establishment using our service, and you means a person collecting stamps at one of those businesses.

You can reach us at business@stampkaro.in about anything in this policy, including a request to see or delete your data.

What we collect from customers

Your loyalty card holds:

• Your mobile number. This is your identity in Stampkaro. One number is one person across every business you are enrolled with, which is what lets your cards follow you rather than starting again at each shop.
• Your name — optional. Asked once, and reused on every card. You can leave it blank.
• Your visits and rewards at each business: when you visited, how many visits you have, what you have earned and what you have collected.
• A randomly generated card link, and whether you have asked us to stop messaging you.

We do not ask for your email address, date of birth, address, Aadhaar, PAN or any other government identifier, and we do not collect your location. We do not know what you bought — only that you visited.

What we collect from businesses

• Business name, WhatsApp number and, if provided, a Google review link
• Owner and staff email addresses and passwords. Passwords are stored only as a one-way hash and cannot be read by us or recovered by anyone.
• Subscription and payment status

We never see or store card, UPI or bank details. Payments are handled entirely by Razorpay; we receive only a subscription reference and whether it is paid.

How we use it

• To run the loyalty program: count visits, award rewards, show your card
• To send you WhatsApp messages about your own activity — a one-time code when you verify your number, and notifications about rewards you have earned
• To give the business you visit its own visit and reward figures
• To keep the service secure and to detect abuse

We do not sell your data, and we do not use it for advertising. A business can only ever see data about visits to that business — never your activity anywhere else, and never the fact that you hold other cards.

Where your data is stored

All data is stored in India, on Amazon Web Services in the Mumbai region (ap-south-1). It is not transferred outside India.

The one exception is WhatsApp: to send you a message we must pass your mobile number to Meta, which operates that service and is subject to its own privacy policy. Razorpay similarly processes payments for businesses. We use no other third-party processors — no analytics, no advertising networks, no tracking pixels.

How it is protected

Concretely, and only what is actually true today:

• Everything travels over HTTPS. Connections are encrypted in transit, with certificates renewed automatically.
• Passwords are hashed, never stored in a readable form.
• The database is not reachable from the internet — it accepts connections only from our own application.
• Administrative access is restricted to a single approved network address.
• Businesses are isolated from one another at the query level.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your data we will notify you and the relevant authority as required by law.

Your rights

Under India’s Digital Personal Data Protection Act, 2023, you can ask us to:

• Show you the data we hold about you
• Correct anything that is wrong
• Delete a card, or your account and every card on it
• Stop messaging you

You can remove any single card yourself from your wallet at any time. To delete everything, use the delete your data page. Every request is checked by a person and carried out within 2 to 4 business days. Email business@stampkaro.in if you would rather write.

Replying STOP to any WhatsApp message stops the notifications. We will still send a one-time code if you ask to sign in, because you asked for it.

How long we keep it

For as long as your card exists. Delete a card and its visit history goes with it. Delete your account and everything is removed, except records we are required to keep for tax or legal reasons — which do not include your visit history.

If a business stops using Stampkaro, the cards its customers hold with it are deleted.

Children

Stampkaro is not intended for anyone under 18. We do not knowingly hold data about children. Tell us if you believe we do and we will delete it.

Changes

If we change this policy we will update the date at the top, and tell businesses before anything material takes effect.