Privacy Policy
Effective date: June 16, 2026
Last updated: October 21, 2026
This Privacy Policy explains how Comprafy SAS ("Comprafy") collects, uses, shares and protects personal information in connection with Stallmark.
Stallmark is the new name of Card Club. Only the name changed: the company, the Service and the way we handle your information are the same.
1. Our Role
For Merchant account data, Comprafy acts as the data controller. For Customer data in a store loyalty program, the Store/Merchant is generally the controller and Comprafy acts as a processor/service provider.
2. Information We Collect
- Merchant email, display name, profile details, account status and role.
- Store information such as name, logo, colors, address, website and settings.
- Customer email (only when the store requires one), marketing consent, customer number, balance and membership status.
- Loyalty activity such as stamps or points earned, removed, redeemed or expired.
- Wallet pass data such as pass identifiers, platform and device push tokens.
- Subscription status, plan, store capacity and billing-period identifiers.
- Limited technical logs, timestamps and security/audit events.
We do not collect government IDs, payment-card numbers, precise location or contacts. Customers are never asked for a phone number. Payments are processed by app-store payment providers such as Apple or Google.
3. How We Use Information
We use information to provide and secure the Service, authenticate users, issue and update loyalty cards, record stamp and point transactions, enable permitted merchant communications, manage subscriptions, prevent abuse and comply with legal obligations.
4. How We Share Information
We share information only as needed to run the Service: with the enrolled store, supported mobile wallet providers, app-store payment providers, infrastructure/auth/email/analytics service providers, legal authorities when required and successors in a business transfer. We do not sell personal data or share it for third-party advertising.
5. Cookies and Analytics
Public web pages use essential technologies needed for the pages to work. We do not use advertising cookies, and we do not track you across other websites.
We measure how the website is used with our own first-party analytics, not a third-party analytics service. When you open a page or use a feature, your browser sends our servers a short record: what happened (for example, a page view or a button press), the page address without its query string, the referring page stripped to its address and campaign tags, and the time. It sets no cookies, stores nothing on your device and contains no name, email, invitation code or card link. We do not use it to build a profile of you or to follow you to other sites. Because nothing is stored on your device and no individual is identified, this needs no consent banner, and we rely on our legitimate interest in understanding which pages are useful in order to improve them.
Our servers also keep standard access logs, which include IP addresses, for security, troubleshooting and traffic analysis. These are deleted automatically after 180 days.
If we ever add analytics that require consent, we will ask for it before using them.
6. Retention and Deletion
We retain personal information while needed to provide the Service and for legitimate business or legal purposes. If you delete your data or account, active-system data is permanently deleted except where retention is required or permitted by law, and residual backup copies may persist for a limited period before being overwritten.
7. Your Rights
Depending on where you live, you may have rights to access, correct, delete, export, restrict, object to or withdraw consent for certain processing. Customers may also need to contact the relevant Store because the Store controls its loyalty-program data.
8. Security and Transfers
Communications use HTTPS/TLS, data is stored on secured infrastructure, access is role-based, sensitive tokens are hashed where appropriate and secrets are kept in protected key-management systems. The Service may use infrastructure in countries other than where you live, with appropriate safeguards where required.
9. Children
Stallmark is a business tool intended for adults and is not directed to children. Merchants are responsible for the lawfulness of any participation by minors in their loyalty programs.
10. Contact
Comprafy SAS
Website: https://comprafyapp.com
Stallmark: https://getstallmark.com
Email: contact@comprafy.app