Privacy Policy

This policy explains what PunchPass (“PunchPass,” “we,” “us”) collects, why, and what choices you have. It covers two kinds of people: businesses that sign up to run a loyalty program on PunchPass, and the customers of those businesses who save a card. If anything here is unclear, email us at k127email@gmail.com.

Information we collect

From a business that signs up:

• Name, email address, and password (stored as a one-way hash, never in plain text)
• Business details: name, tagline, logo, brand colour, phone, website
• Location details: an address and coordinates for each location, used to power the lock-screen suggestion on a customer’s wallet pass

From a customer who saves a card:

• First name (optional)
• Email address and/or phone number, at least one is required so a card can be recovered if a phone is lost
• Stamp, redemption, and visit activity tied to that card

Automatically: standard web server logs, and cookies for signing in and remembering a language preference. See “Cookies” below.

Location and the lock screen

A business can set an address for each location. That address is embedded in the wallet pass itself, and it is Apple Wallet or Google Wallet, not PunchPass, that uses the phone’s own location awareness to decide when to surface a lock-screen suggestion. PunchPass does not track a customer’s live location on our servers.

How we use this information

• To create and update Apple and Google Wallet passes
• To record stamps, track rewards, and let a business look up and manage its own customers
• To operate the business dashboard and admin tools
• To send account-related messages (for example, a reply to a support request)
• To keep the service secure and working as intended

Who we share it with

• Apple and Google, because delivering a wallet pass requires sending pass data to their wallet services
• The business a customer joined can see that customer’s own name, contact info, and stamp history. A business cannot see another business’s customers
• Service providers that host our servers and database, bound to use data only to provide that hosting

We do not sell personal information, and we do not share it for third-party advertising.

Cookies

We use a small number of cookies: one to keep a business owner signed in, and one to remember a chosen language on the marketing site. We don’t use advertising or cross-site tracking cookies.

Payments

PunchPass does not currently process card payments through this site. Billing is arranged directly and manually while payment processing is being built out. This section will be updated once that changes.

Data retention and deletion

A business can cancel its subscription at any time; canceling stops billing but keeps its programs and customer history intact in case it comes back. A business can separately request that its account and data be permanently deleted, which removes it from our systems. A customer who wants their own information corrected or removed can ask the business they joined, or contact us directly.

Security

Passwords are hashed, not stored in plain text, and every request to our servers is made over an encrypted connection. No method of storage or transmission is perfectly secure, and we can’t guarantee absolute security.

Children’s privacy

PunchPass is not directed at children under 13, and we do not knowingly collect personal information from them.

Your choices

A customer can decline to give a name, and can choose email, phone, or both when joining a card. Declining to provide either means a card can’t be issued, since that’s how a lost card gets matched back to its owner.

International users

PunchPass is operated from the United States. If you are located elsewhere, you may have additional rights under local law (for example, GDPR in the EU/UK). Contact us and we will do our best to honour applicable requests.

Changes to this policy

If this policy changes in a meaningful way, we’ll update the date at the top of this page.

Contact

Questions or requests about your data: k127email@gmail.com.