This Privacy Policy explains how Passumo ("Passumo", "we", "us") collects, uses, and protects personal data when you use our website and our digital loyalty-card service (the "Service"). We are committed to handling personal data in line with the EU General Data Protection Regulation (GDPR) and applicable data-protection law.
1. Who we are
Passumo provides digital loyalty cards that businesses ("Merchants") offer to their customers ("End Customers") through Apple Wallet and Google Wallet.
- For personal data about Merchants, website visitors, and Merchant account holders, Passumo is the data controller.
- For End Customer personal data collected through a Merchant's loyalty program, the Merchant is the controller and Passumo acts as a data processor on the Merchant's behalf, under the Merchant's instructions.
Passumo is a trading name of Michael Yao, a sole trader established in the United Kingdom, who is the controller for the personal data described above. You can reach us at hey@passumo.com.
2. Data we collect
From Merchants
- Account and contact details (name, email address, mobile number).
- Business details used to build your loyalty card. During onboarding we may retrieve information about your business from public sources (for example, your public business listing and your website), such as business name, address, category, logo, and brand colours.
- Content you create in the Service, such as card designs and campaigns.
From End Customers who join a loyalty program
- Contact details you provide on a join page, such as name and email address or phone number, depending on how the Merchant configures the program.
- Loyalty activity, such as visits, stamps, points, and rewards redeemed.
- Wallet pass identifiers needed to issue and update your pass.
Automatically
- Basic technical data required to operate the Service securely (for example, IP address and device/browser information contained in server logs).
3. How we use personal data
- To provide, operate, and secure the Service.
- To issue loyalty passes to Apple Wallet and Google Wallet and keep them up to date as customers earn stamps or rewards.
- To send service and loyalty communications (such as pass updates and, where enabled, push notifications) on the Merchant's behalf.
- To provide support and respond to enquiries.
- To help Merchants finish setting up and get their first customers, including setup tips by email and text while they set up. Every tip has a link to turn them off, texts can be stopped by replying STOP, and both can be turned off in Settings.
- To comply with legal obligations.
4. Legal bases (GDPR)
Where we act as a controller, we rely on:
- Performance of a contract: to provide the Service to Merchants who sign up.
- Legitimate interests: to secure, maintain, and improve the Service, where not overridden by your rights.
- Consent: where required, for example for optional communications; you may withdraw consent at any time.
- Legal obligation: where we must process data to comply with the law.
When we process End Customer data on a Merchant's behalf, the Merchant is responsible for establishing the lawful basis for that processing.
5. Sub-processors and service providers
We use a limited set of trusted providers to run the Service. They process personal data only as needed to provide their service to us:
- Supabase: application database, authentication, and file storage.
- Railway: hosting for our website, merchant dashboard, and API.
- Apple: Apple Wallet pass issuance and updates.
- Google: Google Wallet pass issuance and updates, and business lookup during onboarding (Google Places and Maps).
- Amazon Web Services: sending the email and SMS messages a Merchant sends to their own customers.
- Postmark: sign-in codes, invitations, and other account email, and telling us whether account email other than sign-in codes was delivered and opened (see section 9).
- Stripe and Autumn: subscription billing and payment processing. Card details go to Stripe directly and are never held by us.
- PostHog (EU hosting): analytics for this website and the merchant dashboard, in the cookieless configuration described in section 9.
- Vercel AI Gateway: AI-assisted card and content generation.
- Unsplash: stock imagery used in card designs.
We do not sell personal data. A current sub-processor list is available on request at hey@passumo.com.
6. International transfers
Some providers may process data outside the European Economic Area. Where that happens, we rely on an appropriate transfer mechanism (such as the European Commission's Standard Contractual Clauses) to protect your data.
7. Retention
We keep personal data only as long as it is needed for the purposes above:
- Merchant account data: for as long as the account is open. If you ask us to close your account, we delete or anonymise the data as part of that request; this is handled by our team on request rather than on a fixed automatic schedule.
- End Customer data: retained on the Merchant's instructions for as long as their loyalty program runs. If a Merchant asks us to close their account, we delete End Customer data as part of that same request.
- Message records (that a message was sent, to which membership, and whether it was delivered): 24 months, so a Merchant can account for what was sent on their behalf.
- Account email records (which account emails we sent a Merchant, and whether each was delivered and opened): 24 months.
- Opt-out records: kept indefinitely. If you unsubscribe or reply STOP, we have to remember that in order to keep honouring it.
- Billing and tax records: 6 years, as UK tax law requires.
- Server logs: up to 90 days, for security and troubleshooting.
8. Your rights
Subject to applicable law, you may have the right to access, correct, delete, or receive a copy of your personal data (portability), to restrict or object to certain processing, and to withdraw consent. To exercise these rights, contact us at hey@passumo.com. If Passumo processes your data on behalf of a Merchant, we will forward your request to that Merchant or ask them to instruct us. You also have the right to lodge a complaint with your local data-protection authority.
9. Cookies and similar technologies
This website sets no advertising or tracking cookies. Specifically:
- Website analytics: we use PostHog, hosted in the EU, in a cookieless configuration. It records which pages were viewed and which buttons and form steps were used, so we can see where people get stuck. It stores nothing on your device (no cookie, no local storage), which means we cannot recognise you when you return, and we do not try to. Session recording is switched off. We rely on our legitimate interest in understanding how the site is used; you can object at any time using the contact details above, and a browser "do not track" or ad-blocking setting will stop it outright.
- Referral codes: if you arrive on a link from a business that referred you, we store that business's referral code in your browser's local storage for up to 90 days, so the business is credited and any discount applies when you sign up. The code identifies the referring business, not you, and you can remove it at any time by clearing your site data. If you go on to sign up, the code travels with you to the sign-up page and is kept there until your account records it. The business that referred you sees your business's name and whether it is on a trial or paying, and nothing else.
- Merchant dashboard analytics: when a Merchant is signed in to the dashboard, we use the same cookieless PostHog setup to see which screens they reach and where they get stuck, and we record those sessions to see how the dashboard is used. Anything typed into a form field is masked and never recorded. This covers Merchants using the dashboard only: End Customers on a join page are never recorded, and neither is the staff scanner. We rely on our legitimate interest in improving the Service; you can object at any time using the contact details above, and a browser "do not track" setting stops it.
- Account email opens: the emails we send Merchant account holders about their account, such as setup tips, the Monday summary, and shipping notices, carry a tiny image that tells us when an email was opened, so we know which owners we have reached. Sign-in codes never carry it, and neither does anything a Merchant sends their own customers. Some mail apps load images on their own, so an email can show as opened when it was not. We rely on our legitimate interest in helping Merchants set up and use the Service; you can object at any time using the contact details above, and turning off remote images in your mail app stops it.
- Signed-in sessions: the merchant dashboard stores your session token in your browser. This is strictly necessary to keep you signed in.
If we ever add advertising or cross-site tracking, we will ask for your consent first and update this policy before doing so.
10. Children
The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from children.
11. Changes to this policy
We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you.
12. Contact
Questions about this policy or your personal data? Email us at hey@passumo.com.