Privacy Policy

• Service owner: Miranda Network, S.L., Tax ID B-75866194, registered address at Carretera TF-643, 21, piso 01, puerta 1 B, 38600 Granadilla de Abona, Santa Cruz de Tenerife (España). Contact: support@mirandanetwork.es.
• Business data (account, billing, dashboard usage): Miranda Network, S.L. is the data controller.
• Data of each business's customers (their loyalty card): the controller is the business that issues the card. Miranda Network, S.L. acts as data processor, on behalf of the business and following its instructions (Art. 28 GDPR), under the data processing agreement.

Each business enters its legal details in Stampaz (name or company name, address and privacy contact email, and its data protection officer if it has one). The customer sees them in the basic information shown before signing up, with a link to the full information.

From businesses: name and email of the user, trade name, logo and card design, location addresses, the business's legal details, billing details, team members with access to the scanner, and the service usage log. Bank card details are processed directly by Stripe: Stampaz neither sees nor stores them.

From the businesses' customers: name; email, phone number and birthday only if the business asks for them; stamps or points, visits and redeemed rewards; whether they agreed to receive offers; the date, time and version of the text they accepted when signing up; and the technical identifiers Apple and Google use to update the card on the phone.

Location: Stampaz never receives or stores customers' location. The card includes the location's address, and it is the phone itself that decides to show the “you're nearby” alert.

We do not process special categories of data (health, beliefs, etc.), we do not make automated decisions with legal or similarly significant effects on anyone, and we do not create profiles.

• Providing the service to the business (account, dashboard, scanner, billing and support): performance of the contract (Art. 6(1)(b) GDPR).
• Complying with tax and accounting legal obligations: legal obligation (Art. 6(1)(c) GDPR).
• Security, fraud prevention and service notices to businesses: legitimate interest (Art. 6(1)(f) GDPR).
• Marketing communications from Stampaz to businesses: only if they accept them; they can unsubscribe at any time.
• Customers' loyalty card (stamps, rewards, card notifications): on behalf of the business, usually as performance of the program terms the customer accepts when signing up. The business's offers and marketing notifications: only with the customer's consent, which they can withdraw from their card at any time.

• A business's customers: for as long as they use the card. If a customer goes without visiting for the period chosen by the business (between 6 and 60 months; 24 by default), their data is deleted automatically.
• The customer can delete their card and all their data at any time from their web card.
• End of subscription: when a subscription ends, all data of the business and its customers is deleted automatically 30 days later. Before that, the business can download it.
• Account deletion: the business can delete its account from Settings at any time; deletion is immediate.
• Billing data: kept blocked for the periods required by law (for example, 6 years for commercial records and 4 years for tax purposes).
• Backups are overwritten periodically and are not used for anything else.

We do not sell data or share it for advertising purposes. It is only processed by the providers needed for the service to work:

• Supabase: database, authentication and storage, hosted in the European Union.
• Vercel: hosting and delivery of the website and dashboard, running in its Frankfurt region (European Union).
• Stripe: billing of businesses' subscriptions (business data only).
• Photon (Komoot, Germany): address search when a location is added. It only receives the text of the location's address; maps are served through our own servers, without your browser contacting third parties.
• Apple and Google: receive only the card content (customer name, stamps or points, card code, design and location details) to display it in Apple Wallet or Google Wallet and deliver its updates and notifications.

Some of these providers may process data outside the European Economic Area. In that case they do so with GDPR safeguards: an adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

We will only disclose data to authorities when required by law.

Notifications reach the card saved in the Wallet. The business can only send offers to those who accepted them, and within the limits of its plan. Any customer can stop receiving offers from their card, turn off notifications in the Wallet settings or remove the card from their phone.

You can access your data, rectify it, erase it, request its portability, object to or restrict its processing, and withdraw your consent at any time, without affecting prior processing.

• A business's customers: from your web card you can correct your data, download it (in JSON format), stop receiving offers or delete everything. You can also contact the business or us at support@mirandanetwork.es; if you write to us, we will forward the request to the business and help it respond.
• Businesses: from Settings you can export all your data (JSON) and delete your account. For anything else, write to us at support@mirandanetwork.es.

We will reply within one month. If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).

Stampaz is not aimed at minors. To sign up for a loyalty card you must be at least 14 years old (the age of consent in Spain, Art. 7 LOPDGDD). If we detect data of a minor under that age without the authorization of their parents or guardians, we will delete it.

We apply technical and organizational measures appropriate to the risk: encryption in transit, isolation of each business's data, access control, hashed passwords, backups and access restricted to staff who need it. If a security breach occurred, it would be notified as required by the GDPR.

We only use strictly necessary technical cookies. More details in the cookie policy.

If we make material changes to this policy, we will notify businesses by email and update the date above.