Privacy Policy
Last updated: October 19, 2026
This Privacy Policy explains how Kartisiya collects, uses, stores, and protects information when you use our websites, mobile applications, and related services.
Stamp cards in Apple Wallet and Google Wallet
This part is about the stamp card you add to your Wallet at a business, with no app and no sign-up. The card is the business's, and so is its data: the business is responsible for it (in the law's words, the controller). Kartisiya is the service that runs the card for the business and keeps the data on its behalf (the holder), only to run the card and with the security the law requires. The business gives the stamps and the rewards, and decides what its messages say.
What we keep: a card number, the address your Wallet uses to receive updates, the kind of phone and browser, every stamp and tap and when it happened, which card and design you looked at and chose on the card page, the language, and your yes or no to the business's messages, with the exact words you saw. We do not ask for your name, phone number or email, and we do not record your location.
Two small cookies on our site remember which card is yours, so a tap or a second scan finds it. They last up to two years and hold no personal details.
Why: to run your card for the business (stamps, rewards, card updates), to send the business's messages only if you said yes, and to stop misuse. To improve the service we may use combined statistics that identify no one. Your data is never sold.
Messages: the business's news and offers reach you only if you said yes. Every such message says how to stop. You can turn off updates at any time in the Wallet app on your phone, or remove the card there (step by step on our Support page).
Who else handles it: Apple and Google (they deliver the card to your Wallet), and the services our system runs on (Convex for the database, Vercel for the website). Each only as needed to run the card.
How long: while the card is in use at the business, or until the business asks us to delete it. When a business stops using Kartisiya, the details that identify a card are deleted within 30 days.
Your rights: you can ask to see the data about your card, correct it, or delete it. Ask the business, or write to us at kartisiya.support@gmail.com and we'll take care of it with the business.
1. Information we collect
We may collect account information such as your name, email address, authentication identifiers, and settings.
We collect product information you or your provider enter into Kartisiya, including card names, package details, balances, expiration dates, customer records, provider workspace information, and activity history.
We may collect device, usage, log, diagnostic, and support information, such as app version, approximate region, pages or screens viewed, error reports, and communications you send to us.
2. Local guest data
If you use the mobile app without signing in, guest cards are stored locally on your device. They are not synced to an account and are not automatically migrated when you sign in.
Deleting the app or device data may delete local guest cards.
3. How we use information
We use information to operate wallets and workspaces, sync account-backed cards, enforce permissions, maintain card history, provide support, prevent misuse, and improve the product.
We use account and subscription information to manage access to free and paid features.
We use diagnostic, usage, and support information to maintain security, fix issues, understand product performance, and communicate with you.
4. Provider-controlled records
If a service provider creates a customer record or issues a card to you, that provider controls the accuracy and use of the information it enters for its business relationship with you.
If you have questions about a provider-created record, balance, punch, reversal, expiration, or correction, you should contact the provider that created the record.
5. Payment and subscription information
Purchases and subscriptions may be processed by app stores or payment processors. We receive information needed to confirm access status, manage access, provide support, and comply with legal or operational requirements.
We do not store full payment card numbers.
6. Third-party service providers
We use trusted third-party service providers to operate Kartisiya, including services for authentication, hosting, database storage, analytics, diagnostics, payments, subscriptions, app distribution, and customer support.
These providers may process information only as needed to provide services to us and are subject to their own privacy and security obligations.
7. Retention and deletion
We retain information for as long as needed to provide Kartisiya, comply with legal obligations, resolve disputes, maintain security, and preserve audit history for balance-changing activity.
You may request deletion of your account or personal information through the support channels made available in the product. Some provider-issued card history may need to remain with the provider workspace for audit, dispute, or legal reasons.
8. Your choices
You may update certain account information in the product, manage app-store subscriptions through your app-store account, and delete local guest data by removing the app or its local data from your device.
If you believe provider-created information about you is inaccurate, contact the provider that controls that record.
9. Security
We use administrative, technical, and organizational safeguards designed to protect information. No online service can be guaranteed to be completely secure.
10. Changes to this policy
We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new effective date.