- § 1
Controller
Controller within the meaning of the GDPR: Printproof UG (haftungsbeschränkt) Beim Schlump 15 20144 Hamburg Germany
Data protection contact: support@treuly.de
This privacy policy covers the data we process as controller: website visits, contact inquiries, and the account, contract and billing data of business owners. The data of our customers’ end customers — in particular the details from the stamp card’s enrolment form (first and last name, optional date of birth, email address where applicable), pass identifiers, stamping and redemption timestamps and push recipient data — we process exclusively on documented instructions as a processor within the meaning of Art. 28 GDPR; the business issuing the stamp card is the controller in that respect. The basis is the data processing agreement, which we provide in text form on request to support@treuly.de.
- § 2
What data we collect
We only collect what Treuly needs to work: the shop owner’s email address (authentication), details about the shop and the stamp card (display and configuration), and stamp timestamps (reward logic).
Via the contact form on treuly.de we process your name, email address, subject, message text, selected language, and your consent to handle the inquiry. We use this data only to deliver your message to support@treuly.de, send you a confirmation email, and reply to your request. There is no marketing send and no profiling based on the contact form.
For your customers’ stamp cards we process the details from the card’s enrolment form: first and last name, optionally the date of birth and — where your business uses the NFC feature — the email address as an anchor for recovering the card. Added to this are the pseudonymous pass identifier, stamping and redemption timestamps and the technical wallet identifiers for pass updates. Your guests do not need a Treuly account. We process this data exclusively on your behalf (Art. 28 GDPR); your business is responsible for the loyalty program and for informing your guests.
We do not use your guests’ data to build advertising profiles of our own. Campaign and automation features address the pass holders of your business, are triggered by you and are not evaluated by us for our own purposes. No sale of data to third parties, no advertising trackers on treuly.de.
- § 3
Legal bases
Processing takes place on the basis of Art. 6 (1) (b) GDPR (performance of a contract) to provide the service, Art. 6 (1) (a) GDPR (consent) to handle contact inquiries submitted via the website form, Art. 6 (1) (c) GDPR (legal obligation) for retention requirements, and Art. 6 (1) (f) GDPR (legitimate interest) for operational security (e.g. log files and abuse protection on the contact form).
- § 4
Account area and statistics
In the logged-in account area on treuly.de we show you statistics about your business (e.g. stamps issued, active wallet passes, redemptions). These insights are derived from the operational data already processed to run the service and are provided in performance of the contract (Art. 6 (1) (b) GDPR). For these statistics we evaluate your end customers’ data in aggregate only; no additional personal data is collected for them.
Paid subscriptions are purchased on treuly.de. Payment is processed by Stripe Payments Europe, Ltd. (Ireland) together with Stripe, Inc. (USA). At checkout we pass Stripe your email address, your account identifier and the chosen plan. You enter the full payment details (e.g. your card number) directly with Stripe; they are processed exclusively by Stripe and are not stored by us. From Stripe we receive payment metadata (e.g. payment method, card brand and the last four digits), the payment and subscription status, the invoice data and your VAT identification number where you provide one. The legal basis is performance of the contract (Art. 6 (1) (b) GDPR). Stripe’s privacy terms apply in addition (https://stripe.com/privacy).
Subscriptions that were previously concluded as an in-app purchase in the Treuly iOS app continue to be billed via the Apple App Store. For those, payment is processed by Apple Distribution International Ltd.; we do not receive payment data from Apple — only the subscription status.
- § 5
Service providers (processors)
We use the following providers to operate Treuly:
• Website and API hosting: Render Services, Inc. (Frankfurt / EU region) • Database: Supabase, Inc. (EU region) • Authentication and account management: Clerk, Inc. (USA) • Transactional email (contact form): Resend, Inc. (USA) • Apple Wallet / push notifications: Apple Distribution International Ltd. (Ireland) • Google Wallet: Google Ireland Limited (Ireland)
Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (USA) process payment data as controllers in their own right; Stripe’s privacy policy applies in that respect (https://stripe.com/privacy).
Transfers to third countries (USA) take place on the basis of Standard Contractual Clauses under Art. 46 GDPR or, where certified, an adequacy decision (EU–US Data Privacy Framework).
- § 6
Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You may withdraw consent to processing contact inquiries at any time with effect for the future. Send requests informally to support@treuly.de.
Competent supervisory authority: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI), Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany, https://datenschutz-hamburg.de.
- § 7
Retention
We only retain personal data for as long as it is needed to provide the service or to meet statutory retention obligations (e.g. § 147 AO, § 257 HGB). Contact inquiries are kept in email correspondence only as long as needed to handle and document the request. After you delete your account we remove your content — including the end-customer data processed on your behalf — from the production systems within 30 days. Data held in backups is overwritten as part of the ordinary backup cycle. We retain invoice and accounting data for the duration of the statutory retention periods and otherwise block it from further processing.
- § 8
Cookies and access to end devices
On treuly.de we only use technically necessary cookies. When you sign in or register, our authentication provider Clerk, Inc. sets cookies for the .treuly.de domain so that the sign-in persists and abusive sign-in attempts can be detected. Under § 25 (2) no. 2 TDDDG this storage requires no consent, because it is strictly necessary for the service you asked for. We do not set analytics, tracking or advertising cookies.