Privacy Policy

Who we are

IziStamp is a trading name of Flowstox LTD, registered in England and Wales. Our registered office is 46 Nova Road, Croydon, CR0 2TL, United Kingdom. We are the data controller for personal information collected through the IziStamp website, merchant accounts, and mobile app. Where a merchant uses IziStamp to send marketing messages to the customers who added that merchant’s loyalty pass to Apple Wallet or Google Wallet, the merchant is the data controller for that marketing and IziStamp acts as a data processor on the merchant’s instructions.

What data we collect

We collect data from both our website visitors and users of the IziStamp mobile app. The categories below cover all sources.

Website visitors

• Contact details — name, email address, phone number, and business name when you fill in a form, book a demo, or sign up.
• Account & service data — merchant profile information, stamp activity, and reward configurations you create in IziStamp.
• Technical data — IP address, browser type, device identifiers, pages visited, and referring URL collected automatically when you browse our site.
• Communications — any messages or feedback you send us by email or through our forms.

Mobile app users

• Email address — used for account creation, verification, and recovery via one-time passcodes (Supabase Auth).
• User ID — a unique identifier linked to your loyalty cards, game history, and collectibles.
• Stamp & loyalty activity — merchants joined, stamps collected, rewards claimed, and timestamps.
• Game results — scores, wins, losses, and move timestamps used for game validation and leaderboard rankings.
• Collectible cards — tier, star rating, and timestamps of collectible cards earned.
• Device push token — used to send push notifications for new stamps, prizes, and reminders.
• Crash & performance data — anonymised crash logs and app interaction data to improve stability and features.

Wallet pass customers

If you add a merchant’s loyalty card to Apple Wallet or Google Wallet without installing the app, we process a limited set of data to run your loyalty pass — you stay anonymous to the merchant and to us unless you later install the app and verify your email.

• Wallet pass identifier & loyalty activity — the pass and its stamp/reward progress for the merchant whose card you added.
• Device push token— provided by Apple or Google, used to update your pass (stamp and reward changes) and, where the lawful basis applies, to deliver a merchant’s marketing messages.
• Marketing state— whether you have become eligible for a merchant’s marketing messages and whether you have opted out.

How we use your data

We process your personal data for the following purposes:

• To provide, maintain, and improve the IziStamp service.
• To respond to enquiries, support requests, and demo bookings.
• To send you service-related communications (e.g. account confirmations, usage updates).
• To comply with legal obligations and protect against fraud.
• To analyse usage patterns so we can improve the user experience.
• To deliver a merchant’s marketing messages to its wallet-pass customers where the lawful basis for doing so is met, and to honour opt-outs (see Marketing & wallet passes below).

Legal basis for processing

Under UK GDPR we rely on the following lawful bases:

• Contract — processing necessary to deliver the IziStamp service you signed up for.
• Legitimate interests — improving our products, preventing fraud, and ensuring security.
• Consent — where you opt in to marketing communications; you can withdraw consent at any time.
• Soft opt-in (PECR) — for marketing a merchant sends to the customers of its own loyalty programme who added its wallet pass, where permitted by the Privacy and Electronic Communications Regulations. The merchant is the controller for this marketing; IziStamp acts as its processor.

Marketing & wallet passes

When you add a merchant’s loyalty card to your wallet, the merchant may send you occasional marketing messages — such as offers — through the pass. This is separate from the functional updates your pass always receives.

How consent works

We show you a clear notice naming the merchant at the moment you add the pass, with a one-tap option to decline. Adding the pass does not, by itself, start marketing: you only become eligible to receive a merchant’s marketing messages after you first use the loyalty card with that merchant (your first stamp). Until then, and if you decline, no marketing is sent.

Service messages always continue

Functional updates to your pass — such as a stamp being added or a reward becoming ready — are not marketing. They are not affected by your marketing choices and continue even if you opt out.

Opting out

You can stop a merchant’s marketing at any time: decline at the point of collection, or use the unsubscribe link carried in the pass and in every marketing message. Opting out applies across both your Apple and Google passes for that merchant and takes effect immediately. Your pass keeps working as normal.

For this wallet marketing the merchant is the data controller and IziStamp acts as the processor delivering the messages on the merchant’s behalf.

Cookies & analytics

We use essential cookies to keep the site functioning and a small number of analytics tools to understand how visitors and users move through our website and portals so we can improve them.

• Google Analytics 4 — on our marketing website only, to measure page views and traffic sources. It runs only after you accept analytics cookies in our consent banner; it is disabled by default (Google Consent Mode).
• PostHog — on our merchant portal and wallet join pages, to measure which features are used. We run it in a privacy-protective configuration: session recording is disabled, automatic capture is off, and we collect only a defined set of product events. PostHog sets a first-party cookie to recognise a returning browser. Data is processed in the EU.

We do not record your screen or capture what you type. Analytics event properties are filtered to strip fields such as your name, email, and password before anything is sent, and we do not use third-party advertising trackers. You can change or withdraw your cookie choices at any time through our consent banner or your browser settings.

Third-party sharing

We do not sell your personal data. We may share data with trusted service providers who process it on our behalf:

• Supabase — database, authentication, and edge function hosting (user accounts, loyalty data, game records).
• Expo — push notification delivery and over-the-air app updates (device push token, OS version).
• Apple & Google Wallet — pass hosting and the delivery of pass updates and notifications to your device (wallet pass data and push token).
• Vercel — website hosting.
• PostHog— product analytics for our merchant portal and wallet join pages (feature-usage events; no session recording). Data is processed on PostHog’s EU infrastructure.
• Google Analytics — website traffic measurement, loaded only with your consent.
• Sentry — crash and error diagnostics for the mobile app. Error reports may include a masked screenshot of the moment a crash occurred, with all text and images obscured, and exclude personal identifiers by default.
• Email delivery — service-related communications (account verification, updates).

All processors are contractually bound to handle your data securely and only as instructed by us. Where data is transferred outside the UK, we ensure appropriate safeguards (such as Standard Contractual Clauses) are in place.

Data retention

We retain your personal data only for as long as necessary to fulfil the purposes described above, or as required by law. When data is no longer needed, it is securely deleted or anonymised.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify any inaccurate or incomplete data.
• Request erasure of your data.
• Restrict or object to certain processing.
• Request data portability (receive your data in a structured, machine-readable format).
• Withdraw consent at any time where consent is the basis.

To exercise any of these rights, email us at hello@izistamp.com. We will respond within 30 days.

Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via our website or by email. We encourage you to review this page periodically.

Contact us

If you have questions or concerns about this policy or how we handle your data, please contact us: