Privacy

A business signs up to Kumiro and decides what to collect from its own customers. For that information -- who holds a loyalty card, their stamps, messages sent through their website -- the business decides, and Kumiro only stores and shows it on their behalf.

For the business's own account, Kumiro decides: the email it was created with, the website content, and the settings behind it.

It matters because it tells you who to ask. A customer wanting their card changed or removed asks the business. A business owner wanting their account removed asks us.

A card holds as little as the business needs to run it: your stamps or points, the rewards you have earned and claimed, and when each of those happened. A first name and a phone number are optional, and exist so staff can find your card again if you lose your phone.

Your card itself is a link. Anyone holding the link can see the card, exactly like the paper card it replaces, and it can do nothing but display -- it cannot spend, and it is not an account.

If you add the card to Apple Wallet or Google Wallet, the pass carries the business's name, the card's name, your balance and your first name if you gave one. Apple and Google keep what they need to deliver it to your phone.

To change or remove what a card holds, ask the business. They can correct a balance or remove you; we cannot decide that for them.

Joining from a printed code creates a card with no phone number and no name unless you type one. Your browser keeps a small marker so that scanning the same code again opens the card you already made rather than a second one.

A one-way hash of your network address is kept with the join, only so that one connection cannot create hundreds of cards. The address itself is never stored.

An account holds the email address it was created with, and a password we never see: sign-in is handled by our database provider and stored as a hash.

Your website content, images and loyalty settings are stored so they can be published and edited. If you use the drafting help to write copy, what you type is sent to the model provider that wrote it, and their handling applies to that text.

If Kumiro set up your business for you, Kumiro stays on as a collaborator, listed on your Staff screen, until you remove it.

A message from a contact form holds what the sender typed, and a one-way hash of their address so the same sender cannot send hundreds. It is stored for the business and emailed to them.

There are no advertising or analytics cookies, and no tracking across other sites.

What is set: a sign-in session for the dashboard and the counter, a note of which language you chose, and, if you joined a card by scanning, a marker for that card so the same phone is recognised.

The database and file storage are Supabase. Hosting is Vercel. Email is sent through Resend. Wallet passes involve Apple or Google, for the customers who add one. Notifications to a business's own phone go through Expo, and Apple or Google. Drafting sends text to the model provider configured for this installation.

Nothing is sold, and nothing is shared for advertising.

A loyalty history is a ledger: stamps and rewards are added rather than edited, so a correction appears beside the mistake. That history stays while the card does.

A business can remove a customer, delete messages, unpublish a website or ask us to close the account. Removing a business's account removes the cards and messages it held.

Each business's data is separated in the database itself, so one business cannot read another's even if the application asked. Card links and wallet passes are signed. Network addresses are hashed rather than kept. The keys that sign passes are held on the server and never reach a browser.

If what is collected changes, this page changes with it, and the date at the top moves.