StampEzee Privacy Policy

This Privacy Policy explains how Elyon Techno Labs Inc., operating the StampEzee platform, collects, uses, discloses, retains, transfers, and protects personal information. It applies to our websites, mobile applications, retailer dashboards, administrative tools, loyalty programs, Wallet passes, integrations, communications, and related services collectively called the “Services.”

It applies to retailers and their personnel, customers who use the StampEzee app, and customers who participate without downloading the app, including through a phone number, email address, QR code, web link, point-of-sale interaction, or Apple Wallet or Google Wallet pass. Additional notices may be presented when a particular feature or law requires more specific information.

1. Who We Are

Elyon Techno Labs Inc. is the operator of StampEzee and is accountable for personal information under its control.

Legal entity: Elyon Techno Labs Inc.

Service address: Tiffany Court, Mississauga, Ontario, Canada

Privacy and general contact: hello@stampezee.com

Website: https://www.stampezee.com

The person responsible for privacy compliance may be contacted at the email address above. We may ask for information needed to verify an identity or locate the relevant account before responding to a privacy request.

2. Scope and Our Roles

2.1 When StampEzee decides how information is used

We act as the organization responsible for deciding how personal information is used for our own account administration, authentication, security, fraud prevention, product operation, billing, service analytics, support, legal compliance, platform communications, and business management.

2.2 When a retailer runs a loyalty program

Each retailer determines the rules of its loyalty program, the customers it enrols, the rewards it offers, and the retailer communications it sends. For loyalty data processed solely to operate that retailer’s program, StampEzee generally acts as a service provider or processor on the retailer’s instructions, while the retailer remains responsible for its own notices, lawful basis, consent, marketing choices, program rules, staff access, and responses to customer requests relating to its program.

Retailers may independently collect or use information through their stores, websites, point-of-sale systems, ecommerce platforms, mailing lists, or other services. Those independent practices are governed by the retailer’s privacy notice, not this Policy. Where StampEzee and a retailer each determine distinct purposes, each is independently responsible for its own processing.

2.3 Retailer personnel

Retailer owners, administrators, Loyalty Executives, and other authorized personnel may access customer loyalty information according to permissions configured by the retailer. Retailers are responsible for granting appropriate access, training personnel, removing access promptly, and ensuring that accounts are not shared.

3. Personal Information We Collect

3.1 Retailer and business account information

• Name, business name, business email address, telephone number, username, login credentials, and multi-factor authentication information.
• Store, branch, website, ecommerce, service-area, and business contact information.
• Retailer verification, onboarding, subscription, plan, invoice, tax, and billing-status information. Payment card details are generally handled by the payment processor and are not stored by StampEzee in full.
• Loyalty-program configuration, including stamp cards, points rules, completion paths, bonus or time-limited offers, exclusive rewards, scratch-card or randomized reward settings, reward descriptions, validity rules, campaign content, and brand assets.
• Integration settings, identifiers, permissions, and events from point-of-sale, ecommerce, messaging, Wallet, and other connected services.
• Support requests, feedback, meeting notes, communications, and records of actions taken through retailer and super-administrator tools.

3.2 Retailer staff and Loyalty Executive information

• Name, email address, telephone number or username, role, branch assignment, permissions, login and authentication information.
• Operational records such as QR scans, stamps or points issued, redemptions, reversals, returns, corrections, offline actions, and administrative changes.
• Security and audit information, including login times, failed attempts, IP address, device details, and actions associated with the staff account.

3.3 Customer and EzeeUser information

• Name, telephone number, email address, profile image if offered and supplied, date of birth, birthday, member anniversary, wedding anniversary, preferred language, and other optional profile details.
• Account and verification information, including one-time-password requests, verification status, authentication events, and linked app or no-app account identifiers. We do not store the content of an OTP longer than operationally required.
• Loyalty activity, including retailers joined, stores or branches visited, stamps and points earned, card stages, extra-stamp carryover, rewards unlocked or redeemed, redemption links, bonus and promotional participation, scratch-card outcomes, referrals or shares, badges, levels, streaks, leaderboards, and related timestamps.
• Purchase-related loyalty events received from a retailer, staff member, point-of-sale system, ecommerce platform, or integration, including transaction or order reference, date, store, eligible value or item information, returns, cancellations, reversals, and reward eligibility. StampEzee is not intended to receive complete payment-card data.
• Customer QR or member-code identifiers, Apple Wallet or Google Wallet pass identifiers and update status, and records of scans or validations.
• Notification preferences, consent records, unsubscribe or opt-out status, delivery and failure status for push, WhatsApp, SMS, email, and other supported channels.
• Support requests, complaints, reward disputes, feedback, survey responses, and communications with StampEzee.

3.4 Device, usage, and security information

• IP address, approximate location derived from IP, device and browser type, operating system, app version, language, time zone, device or advertising identifier where lawfully enabled, and network information.
• Pages and screens viewed, navigation, taps, feature use, session timing, referral source, app-install and update information, and performance events.
• Crash reports, diagnostics, error logs, delivery logs, API and integration events, suspicious-activity indicators, and security or fraud-prevention records.
• Authentication, access, administrative, scanning, redemption, campaign, and audit logs needed to protect accounts and reconcile loyalty activity.

3.5 Location and device permissions

If you enable location access, we may collect your device’s precise or approximate location to show nearby participating retailers, provide directions or location-relevant features, and help prevent misuse. Location access is optional and can be changed in device settings. We do not intend to continuously track precise location in the background. If a future feature requires background location, we will provide a separate notice and request the permission required by the operating system and applicable law.

Camera access is used when you choose to scan a QR code or use another camera-dependent feature. Photo or file access is used only when you choose to upload a logo, image, document, or other file. Push notifications are used only when enabled. The operating system may provide controls independent of StampEzee.

3.6 Information from third parties and integrations

• Retailers, their authorized staff, and other customers who submit or verify a loyalty transaction.
• Point-of-sale and ecommerce platforms, including order, customer, refund, return, and loyalty-trigger information authorized by the retailer.
• Payment processors, which provide subscription status, payment confirmation, disputes, refunds, and limited billing metadata.
• Twilio, WhatsApp, email providers, push-notification services, and telecommunications providers, which provide routing, delivery, failure, consent, and engagement events.
• Apple, Google, app stores, Wallet platforms, mapping services, analytics, crash-reporting, security, and fraud-prevention providers.
• Identity, account, or integration providers selected by a retailer or user.

4. How We Use Personal Information

• Provide, personalize, maintain, and support the Services and create, link, verify, and administer app and no-app accounts.
• Operate loyalty programs, issue and reconcile stamps or points, calculate card progress, carry valid overflow, unlock and validate rewards, process redemptions, apply returns or reversals, and prevent duplicate or unauthorized awards.
• Provide retailer dashboards, staff access, customer QR codes, web-based reward links, Apple Wallet and Google Wallet passes, badges, levels, streaks, leaderboards, and other features requested by the user or retailer.
• Authenticate registration, login, account recovery, and administrative access using WhatsApp, SMS, email, or other approved channels, and manage channel fallback and delivery status.
• Send transactional, security, loyalty, reward, service, and, where permitted, marketing communications and respect preferences and opt-outs.
• Process subscriptions, invoices, receipts, plan limits, trials, add-ons, refunds, and retailer billing administration.
• Provide customer support, investigate reward or account disputes, correct records, and communicate about incidents or service changes.
• Protect users, retailers, and StampEzee; detect fraud, abuse, account sharing, unauthorized scanning, reward manipulation, SMS pumping, security threats, and violations of our terms.
• Monitor, test, troubleshoot, analyze, and improve reliability, accessibility, usability, features, and business operations, using aggregated or de-identified information where reasonably possible.
• Comply with legal, regulatory, tax, accounting, reporting, sanctions, and law-enforcement obligations, establish or defend legal claims, and enforce agreements.
• Complete a merger, financing, reorganization, acquisition, or sale, subject to appropriate confidentiality and lawful processing requirements.

We will not use personal information for a new purpose that is materially incompatible with the purpose for which it was collected unless permitted by law or after providing notice and obtaining any required consent.

5. Consent and Other Legal Grounds

In Canada, we rely on meaningful consent where required and may collect, use, or disclose information without consent only where permitted by law. Consent may be express or implied depending on the sensitivity of the information and reasonable expectations. We limit collection, use, disclosure, and retention to purposes a reasonable person would consider appropriate in the circumstances.

Where the GDPR, UK GDPR, or similar laws apply, our legal grounds may include performance of a contract, compliance with legal obligations, consent, and legitimate interests such as service security, fraud prevention, support, and improvement. Where we rely on legitimate interests, we consider the impact on individuals and do not use that basis where their rights override our interests.

You may withdraw consent for future processing where consent is the legal basis, subject to legal or contractual restrictions and reasonable notice. Withdrawal may prevent us from providing a feature that depends on the information. It will not affect processing already lawfully completed.

6. Loyalty Programs and Retailer Responsibilities

When you join or participate in a retailer’s program, relevant profile, transaction, loyalty, reward, and communication information is made available to that retailer and its authorized personnel. A retailer may use that information to administer its program, resolve disputes, communicate with members, and understand program performance, subject to law and its own privacy notice.

Retailers must collect only information needed for lawful loyalty purposes, provide required notices, obtain and document required consents, honour customer choices, restrict staff access, configure campaigns lawfully, and respond to rights requests. Retailers must not upload sensitive or unlawful data, use StampEzee to send messages without proper authority, or combine StampEzee data with other data in a way that violates law or customer expectations.

A customer may participate in multiple retailer programs under one StampEzee identity. One retailer does not receive the customer’s activity with another retailer unless the customer directs it, the programs are clearly affiliated, or disclosure is otherwise permitted by law.

7. Communications and Notification Choices

Service and transactional communications may include OTPs, security alerts, account notices, loyalty balance or stamp updates, reward-unlocked notices, redemption links, receipts, program changes, and support responses. These messages are necessary to provide a requested service or protect an account and may not include an unsubscribe option where law permits, although channel controls may be available.

We may attempt OTP delivery through WhatsApp first and use SMS as a fallback if delivery fails or the user requests SMS, depending on destination support and account configuration. For other notifications, an app user may receive push notifications; a no-app user may receive WhatsApp; and a user who supplied an email address may also receive email. Reward-unlocked notices may be sent through more than one applicable channel. Routing may change based on consent, availability, delivery status, cost, fraud controls, and local rules.

Marketing or promotional communications from a retailer require the consent or other lawful authority applicable to that retailer and channel. Consent to one retailer does not automatically authorize another retailer. Marketing messages will identify the sender and provide an effective unsubscribe or opt-out method where required. Opting out of marketing does not stop essential service messages. Message and data rates may apply.

WhatsApp, mobile carriers, email providers, Apple, Google, and push-notification providers process certain delivery information under their own terms and privacy practices. Delivery receipts do not prove that a user read a message.

8. How We Disclose Personal Information

8.1 Retailers and authorized personnel

We disclose customer information to the retailer whose program the customer joins or uses, and to the retailer’s authorized personnel, as described in this Policy and the retailer’s settings.

8.2 Service providers

We use service providers for cloud hosting, databases, content delivery, security, authentication, messaging, WhatsApp, SMS, email, push notifications, payments, analytics, crash reporting, support, mapping, Wallet passes, app distribution, document storage, and professional advice. They may process only the information reasonably required for their services, subject to contracts and safeguards appropriate to the relationship.

8.3 Connected platforms and retailer-selected integrations

When a retailer connects a point-of-sale, ecommerce, accounting, marketing, or other platform, information may flow between StampEzee and that platform according to the permissions granted. The retailer is responsible for selecting the integration and ensuring it has authority to transfer the data. Third-party platforms may independently process information under their own privacy notices.

8.4 Wallet and device platforms

If you add a pass to Apple Wallet or Google Wallet, the applicable platform receives information needed to create, store, display, and update the pass. The platform provider controls its own device and account processing. Removing a pass from a Wallet does not automatically delete the underlying StampEzee loyalty account or retailer records.

8.5 Legal, safety, and corporate events

We may disclose information where reasonably necessary to comply with law or legal process, respond to valid requests, investigate fraud or security incidents, protect rights or safety, enforce agreements, collect amounts owed, or establish or defend legal claims. Information may also be disclosed in connection with due diligence, financing, restructuring, merger, acquisition, or sale, subject to confidentiality and lawful-use restrictions.

9. Selling, Sharing, and Targeted Advertising

StampEzee does not sell personal information for money. We do not knowingly sell or share personal information of individuals under 16 for cross-context behavioural advertising. We do not currently use customer loyalty histories to provide third parties with targeted advertising across unrelated services.

Some privacy laws define “sale,” “sharing,” or “targeted advertising” broadly and may treat certain advertising cookies or partner disclosures as covered activity even when no money changes hands. If we introduce such processing, we will update our notice and provide any required opt-out mechanism, including recognition of legally required browser-based preference signals where applicable.

10. Cookies, SDKs, and Similar Technologies

Our websites, apps, and dashboards may use cookies, local storage, software development kits, pixels, and similar technologies for authentication, security, preferences, feature operation, analytics, diagnostics, performance, and, only where lawfully enabled, advertising or campaign measurement.

Essential technologies are required for requested functions and account security. Where required, non-essential technologies will be activated only after consent. Browser, device, and in-app controls may allow you to change choices, although blocking essential technologies may prevent some features from working. A separate Cookie Notice or consent interface may identify current technologies, providers, purposes, and durations.

11. International Processing and Transfers

StampEzee is based in Canada and may use retailers and service providers located in Canada, the United States, the United Arab Emirates, the European Economic Area, the United Kingdom, India, and other countries where StampEzee, its providers, or a participating retailer operates. Personal information may therefore be processed outside the country where it was collected and may be accessible to courts, law-enforcement agencies, or regulators under local law.

We remain accountable for personal information transferred to a provider for processing and use contractual, organizational, and technical measures appropriate to the information and destination. Where the GDPR, UK GDPR, or another transfer regime applies, we use an approved transfer mechanism where required, such as an adequacy decision or standard contractual clauses, together with supplementary measures where appropriate. Contact us for information about relevant safeguards.

12. Retention and Deletion

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain loyalty and redemption records, satisfy retailer instructions, protect accounts, resolve disputes, enforce agreements, and meet legal, tax, accounting, audit, and breach-record obligations. Actual periods depend on the data, sensitivity, relationship, legal requirements, and risk of harm.

Deletion may be delayed or limited where information is needed to complete a transaction, preserve another person’s rights, comply with law, maintain security or anti-fraud records, establish or defend claims, or remain in backups until the applicable backup cycle completes. When no longer required, information is deleted, anonymized, or securely destroyed.

13. Security and Privacy Incidents

We use administrative, technical, and physical safeguards appropriate to the sensitivity and volume of information, which may include access controls, least-privilege permissions, authentication, encryption in transit, encryption at rest where appropriate, logging, monitoring, backups, vulnerability management, staff confidentiality duties, vendor review, and incident-response procedures.

No service can guarantee absolute security. Users and retailers must protect their devices and credentials, use unique access accounts, keep contact information current, and notify us promptly of suspected unauthorized access. Retailers are responsible for the security of their own systems, networks, staff accounts, and connected integrations.

We investigate suspected breaches and maintain records as required. Where a breach creates a real risk of significant harm or another reporting threshold is met, we will notify affected individuals and regulators as required by applicable law. Notices may describe steps individuals can take to reduce risk.

14. Your Choices and Controls

• Account and profile: review or update available information through the app, web experience, retailer, or support channel.
• Location, camera, photos, and push notifications: change permissions in device settings. Disabling a permission may limit the related feature.
• Marketing: use the unsubscribe or opt-out mechanism in the message or contact the responsible retailer or StampEzee, as applicable.
• Retailer program: leave or ask to be removed from a specific retailer program, subject to records the retailer or StampEzee must retain.
• Wallet pass: remove the pass through Apple Wallet or Google Wallet. This does not by itself delete the loyalty profile.
• Account deletion: use an available in-app deletion control or contact hello@stampezee.com. Deletion is subject to the limits described in this Policy.
• Leaderboards and social features: use available visibility settings or contact us. If a retailer enables a public or group leaderboard, we aim to use limited display information such as a chosen name, initials, avatar, rank, badge, or score rather than unnecessary contact details.

15. Access, Correction, and Privacy Rights

Depending on where you live and subject to legal exceptions, you may have rights to request access to personal information; learn how it was collected, used, and disclosed; correct inaccurate information; withdraw consent; request deletion; object to or restrict processing; receive a portable copy; opt out of certain sale, sharing, profiling, or targeted advertising; and complain to a privacy regulator.

Submit a request to hello@stampezee.com and identify the telephone number or email address associated with the account, the retailer program if relevant, and the request. Do not send passwords or OTPs. We may verify identity and authority before responding. An authorized agent may be required to provide proof of authority. We will respond within the period required by applicable law and explain any lawful refusal or extension.

If a request concerns data controlled by a particular retailer, we may direct the request to that retailer or assist the retailer in responding. Contacting StampEzee does not prevent you from contacting the retailer directly. We will not discriminate against you for exercising a privacy right, although a requested deletion or restriction may make a loyalty feature unavailable.

16. Additional Information for Canada

Under Canadian private-sector privacy law, StampEzee is accountable for personal information under its control, must identify appropriate purposes, obtain meaningful consent where required, limit collection and use, safeguard information, provide access, and maintain a process for challenging compliance. Personal information processed by providers outside Canada remains subject to our accountability, although it may also be subject to foreign law.

You may first raise a concern with our privacy contact at hello@stampezee.com. If the issue is not resolved, you may contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy authority. This Policy does not limit rights available under applicable law.

17. Additional Information for the EEA and United Kingdom

Where European or UK data-protection law applies, Elyon Techno Labs Inc. is a controller for the purposes described in Section 2.1 and may act as a processor for retailer-controlled loyalty data. Individuals may have rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and complaint to a supervisory authority.

We do not intend to make decisions based solely on automated processing that produce legal or similarly significant effects without the safeguards required by law. Fraud indicators, eligibility calculations, badge or leaderboard rankings, and loyalty-rule automation may affect access to a transaction or reward, but disputed outcomes can be reviewed by the responsible retailer or StampEzee. Where required, individuals may request human review.

If applicable law requires an EEA or UK representative or additional local contact information, we will provide it before offering the relevant regulated processing at scale.

18. Additional Information for United States Residents

Certain U.S. state laws may provide rights to know, access, correct, delete, or obtain a copy of personal information and to opt out of sale, sharing, targeted advertising, or qualifying profiling. These rights apply only when the relevant law covers StampEzee’s processing and are subject to statutory exceptions. We will honour legally required browser-based opt-out preference signals where applicable to the processing occurring through that browser.

The categories of personal information processed are described in Section 3; purposes in Section 4; recipients in Section 8; and retention criteria in Section 12. StampEzee does not use or disclose sensitive personal information for purposes that trigger a right to limit under California law unless we provide the required notice and control. Requests may be submitted under Section 15. Where applicable, an appeal of a denied request may be made by replying to our decision.

19. Children and Teenagers

StampEzee is not directed to children under 13, and we do not knowingly create accounts for or collect personal information directly from children under 13 without verifiable parental or guardian authorization where permitted and required. Users aged 13 to the age of legal majority may use StampEzee only with authorization from a parent or guardian where required by local law and subject to retailer rules.

Retailers must not knowingly enrol an underage person contrary to law or target age-restricted promotions to minors. If you believe a child provided personal information without appropriate authorization, contact hello@stampezee.com. We will investigate and delete or restrict the information where required.

20. Automated Features, Gamification, and Personalization

StampEzee may automatically calculate stamps, points, stages, reward eligibility, bonus windows, randomized scratch-card outcomes, badges, levels, streaks, leaderboard positions, and notification timing according to rules configured by StampEzee or a retailer. We may also use automated tools to identify suspected fraud, duplicate accounts, unusual scans, prohibited activity, or delivery abuse.

These tools use account, transaction, usage, device, and security information relevant to the rule. A retailer controls many loyalty and campaign rules and is responsible for their fairness and lawful use. A user may ask the retailer or StampEzee to review a disputed loyalty outcome. We do not represent that gamification rankings measure a person’s character, creditworthiness, employment suitability, or other unrelated trait.

21. Third-Party Services and Links

The Services may link to or interoperate with retailer websites, maps, payment services, social networks, ecommerce stores, app stores, Wallet platforms, and other third parties. Their own terms and privacy notices apply to their independent processing. StampEzee is not responsible for a third party’s independent privacy practices, although we remain responsible for providers processing information on our behalf as required by law.

22. Changes to This Policy

We may update this Policy to reflect changes in the Services, law, providers, or practices. We will post the revised Policy and change the “Last updated” date. If a change is material, we will provide additional notice through the Services or an appropriate communication channel and obtain consent where required. A change does not retroactively authorize materially different processing where the law requires new consent.

23. Contact and Complaints

Questions, requests, and complaints may be sent to:

Privacy Contact
Elyon Techno Labs Inc. operating as StampEzee
Tiffany Court, Mississauga, Ontario, Canada
Email: hello@stampezee.com

Please describe the concern and the account or retailer program involved. We will review the complaint, investigate as appropriate, and explain the outcome. You may also contact the privacy regulator in your jurisdiction. Nothing in this Policy limits any non-waivable right or remedy available under applicable law.