Privacy Policy

1. Who we are

Stow Cards provides a wallet pass platform for merchants. This policy explains how we handle personal data when you use our website, the Pass Designer, the merchant console, and the in-store scanner app.

2. Data we collect

Merchant account data: name, email, business details, and billing information.
Customer enrollment data: the details your customers submit to join a program (for example name and email), processed on your behalf.
Pass and usage data: points, stamps, member codes, device registrations, and pass update events needed to deliver passes.
Technical data: basic logs and, if enabled, privacy-friendly analytics.

3. How we use data

We use data to operate the Service: to build and update passes, deliver them to Apple Wallet and Google Wallet, run the console and scanner, process payments, provide support, and keep the Service secure.

4. Controller and processor roles

For customer enrollment data, the merchant is the data controller and Stow Cards acts as a processor. For merchant account data, Stow Cards is the controller. Merchants are responsible for having a lawful basis to enroll their customers.

5. Security

Authentication is token-based, service-to-service calls are cryptographically signed, and each merchant’s data is tenant-scoped. Wallet signing credentials are kept strictly server-side and never exposed to a browser. Read more on our security page.

We share data with the wallet providers (Apple, Google) as needed to deliver passes, and with infrastructure and payment subprocessors that help run the Service. We do not sell personal data.

Our subprocessors today:

Amazon Web Services: hosting, storage, backups and email delivery, in its London region (United Kingdom).
Cloudflare: DNS for our domain, and forwarding email sent to our addresses.
Apple: delivering Apple Wallet passes and their update notifications.
Google: delivering Google Wallet passes and their updates.

7. Retention

We keep personal data for as long as needed to provide the Service and to meet legal obligations. Merchants can export or request deletion of their data; on account closure, data may be deleted after a reasonable grace period.

8. Your rights

Depending on your location, you may have rights to access, correct, delete, or port your data, or to object to certain processing. Customers should contact the merchant they enrolled with; merchants and others can contact us directly.

Merchants are the controllers of their members’ data and Stow Cards processes it for them, so a merchant handles each request from its members and we act on the merchant’s instructions.

9. International transfers

We host the Service and keep its backups in the United Kingdom, in Amazon Web Services’ London region. Some subprocessors in section 6 handle data outside the UK: Apple and Google receive the pass data their wallets need, and Cloudflare forwards email sent to our addresses. Where personal data leaves the UK, we rely on the UK’s adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified recipients, or on the International Data Transfer Addendum to the EU Standard Contractual Clauses.

10. Cookies and local storage

Draft for legal review. This section covers the Stow Cards website, stow.cards.

The website sets no cookies. It keeps two small items in your browser’s local storage. They stay on your device, are never sent to us, and are removed when you clear your browser’s data for the site:

Your cookie choice (stow.site.consent): your answer on analytics, the version of this section you answered, and when. We ask again after 6 months, or sooner if this section changes.
Your pass color (stow.site.passType): the pass type you pick on the homepage, so every page keeps its color. It is saved only when you pick one, and kept until you clear it.

Both are strictly necessary for something you asked for, so they are always on.

Analytics. The website runs no analytics today. If we add analytics, it will run only after you accept it, and we will name the provider and what it collects here first. If your browser sends a Global Privacy Control signal, we treat it as a refusal unless you choose otherwise.

Your choice. On your first visit, a banner at the bottom of the page asks about analytics, with Accept all and Reject all buttons of equal weight and a Manage option that lists each category. You can change or withdraw your choice at any time with Cookie settings in the site footer. If your browser blocks scripts or storage, the banner does not appear and nothing optional runs.

11. Contact

Privacy questions or requests? Email hello@stow.cards or see our contact page. See also our Terms of Service.