Terms of Service

Last updated: 1 June 2026

1. Introduction

These Terms of Service ("Terms") govern your use of the TapStamp mobile application ("App") and the TapStamp business dashboard ("Dashboard"), collectively referred to as the "Service".

By using TapStamp, you agree to these Terms. If you do not agree, please do not use the Service.

2. Definitions

  • "Customer" means an individual who uses the TapStamp App to collect stamps and redeem rewards.
  • "Business" means a company or sole trader that uses the TapStamp Dashboard to manage a loyalty programme.
  • "NFC Pod" means the physical NFC chip device provided to Businesses for contactless stamp collection.

3. Customer terms

3.1 Account registration

You may create an account using your Apple ID, Google account, or phone number. You are responsible for maintaining the security of your account credentials.

3.2 Collecting stamps

Stamps are collected by tapping your device on a Business's NFC Pod or scanning their QR code. Each tap or scan counts as one stamp. Stamps cannot be transferred between accounts or businesses.

3.3 Rewards

Rewards are set by individual Businesses. TapStamp does not guarantee any specific reward value or availability. Rewards may have expiry dates set by the Business. Expired rewards cannot be redeemed.

3.4 Offers and vouchers

Businesses may send you offers and vouchers through the App. These are subject to the terms set by each Business, including expiry dates and usage limits. TapStamp is not responsible for the fulfilment of offers by Businesses.

3.5 Acceptable use

You must not:

  • Attempt to collect stamps fraudulently (e.g. by manipulating NFC data)
  • Create multiple accounts to abuse reward programmes
  • Reverse-engineer, decompile, or tamper with the App
  • Use the App for any unlawful purpose

4. Business terms

4.1 Account and subscription

Businesses register an account and receive a 30-day free trial with access to Growth tier features. No payment details are required during the trial. After the trial, Businesses must select a subscription plan to continue using the Service. Subscriptions are billed monthly via Stripe. All prices are in GBP and exclude VAT unless stated otherwise.

4.2 Plans and pricing

  • Starter: £20/month
  • Growth: £35/month
  • Scale: £50/month

The NFC pod is a separate one-time purchase of £10, which includes the pod, A6 acrylic stand, and A6 info card. It is not included in the subscription fee. All new accounts include a 30-day free trial with Growth access.

4.3 Free trial

Your 30-day free trial begins when you register your account. No payment details are required. You will not be charged during the trial period. When the trial ends, access to the Dashboard will be restricted until you select a plan and set up billing. There is no automatic charge.

4.4 Cancellation and refunds

You may cancel your subscription at any time from the Dashboard. Cancellation takes effect at the end of your current billing period. We do not offer refunds for partial billing periods. The NFC pod purchase is non-refundable.

4.5 NFC Pods

All NFC Pods supplied by TapStamp remain TapStamp's property. The £10 fee in clause 4.2 is a non-refundable activation and provisioning fee, not a sale of the hardware. You are granted a non-exclusive licence to use the Pod solely with the TapStamp service for the duration of your subscription (or trial, if you do not subscribe).

You must not tamper with, dismantle, reverse-engineer, clone, re-encode, or use any Pod with any service other than TapStamp.

Upon termination of your subscription, expiry of your trial without subscription, suspension or termination of your account, or written request from TapStamp, you must return all Pods in your possession to TapStamp within 14 days at your own cost, in reasonable condition (accepting fair wear and tear). TapStamp may charge a replacement fee of £20 per Pod not returned within that period.

4.6 Business responsibilities

As a Business, you are responsible for:

  • Setting fair and accurate rewards for your loyalty programme
  • Honouring rewards and offers presented by Customers
  • Complying with all applicable laws, including consumer protection regulations
  • Ensuring your use of push notifications complies with marketing regulations

5. Intellectual property

The TapStamp name, logo, App, Dashboard, and all related materials are owned by TapStamp. You may not use our trademarks or branding without written permission. Businesses retain ownership of their own logos and branding uploaded to the Service.

6. Data and privacy

Your use of the Service is also governed by our Privacy Policy. By using TapStamp, you acknowledge that you have read and understood our Privacy Policy.

7. Service availability

We aim to keep TapStamp available at all times but do not guarantee uninterrupted access. The App is designed to work offline for stamp collection, with data syncing when connectivity is restored. We may perform maintenance or updates that temporarily affect availability.

8. Limitation of liability

To the maximum extent permitted by law:

  • TapStamp is provided "as is" without warranties of any kind, express or implied.
  • We are not liable for any indirect, incidental, or consequential damages arising from your use of the Service.
  • Our total liability for any claim shall not exceed the amount you have paid us in the 12 months preceding the claim.
  • We are not liable for the actions, products, or services of any Business participating in TapStamp.

9. Account termination

We may suspend or terminate your account if you breach these Terms, engage in fraudulent activity, or use the Service in a way that harms other users or our reputation. We will provide reasonable notice where possible.

10. Changes to these Terms

We may update these Terms from time to time. We will notify you of material changes via the App or email. Continued use of the Service after changes constitutes acceptance of the updated Terms.

11. Governing law

These Terms are governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the courts of England and Wales.

12. Contact

For questions about these Terms, contact us at [email protected].

13. Data Processing Agreement

This section forms an Article 28 UK GDPR data processing agreement between you (the "Controller" — the business operating a TapStamp account) and TapStamp / Golden Oak SEO Ltd ("TapStamp" — the "Processor") regarding the personal data of your end-customers that TapStamp processes on your behalf.

13.1 Subject matter and duration

TapStamp processes end-customer personal data on your behalf to provide the loyalty card service, for as long as you maintain an active TapStamp account, and for the retention periods set out in our Privacy Policy after termination.

13.2 Nature and purpose

Processing consists of: collection, storage, indexing, retrieval, transmission (push notifications, vouchers), aggregation (segmentation analytics), and deletion. Purpose: operating your loyalty programme.

13.3 Types of personal data

End-customer name, email, phone number, birthday, sign-in method, FCM device tokens, stamp history, redemption history, and notification preferences.

13.4 Categories of data subjects

Your end-customers who hold loyalty cards with you.

13.5 Controller and Processor obligations

You (Controller) are responsible for the lawful basis for processing each customer's data, for capturing valid PECR-compliant marketing consent (the TapStamp app handles this on your behalf at the moment a customer adds your card), and for responding to data subject rights requests directed at you. TapStamp (Processor) processes end-customer data only on your documented instructions, including any transfer to a third country, except where required by law.

13.6 Confidentiality

TapStamp ensures personnel authorised to process the data are bound by confidentiality obligations.

13.7 Security

TapStamp implements appropriate technical and organisational measures including: encryption in transit (TLS) and at rest, role-based access control via Firebase Authentication and Firestore security rules, Firebase App Check on all callable functions, audit logging, and regular dependency security review.

13.8 Sub-processors

TapStamp engages the following sub-processors and accepts responsibility for their compliance: Google LLC (Firebase, Firestore, Cloud Functions, Cloud Storage, FCM), Stripe Payments UK Ltd (subscription billing — does not process end-customer data), Resend Inc (transactional email to businesses — does not process end-customer data), Vercel Inc (dashboard hosting), and Cloudflare Ltd (DNS, WAF, captcha). We will notify you of changes to this list via the Dashboard and you may object within 30 days.

13.9 Assistance with data subject rights

TapStamp will provide reasonable assistance to enable you to respond to access, rectification, erasure, restriction, portability, and objection requests, including via the in-app account-deletion mechanism available to end-customers.

13.10 Personal data breach

TapStamp will notify you without undue delay (and in any event within 72 hours of becoming aware) of any personal data breach affecting your customers' data, with information sufficient for you to meet your own breach-notification obligations to the Information Commissioner's Office.

13.11 Audits and inspections

TapStamp will, on reasonable notice and no more than once per year, make available all information necessary to demonstrate compliance with this section and contribute to audits conducted by you or an auditor mandated by you.

13.12 Return or deletion on termination

On termination of your account, TapStamp will, at your choice, delete or return all end-customer personal data unless retention is required by law. Standard retention is 30 days post-cancellation as set out in our Privacy Policy.

13.13 International transfers

TapStamp uses Google Cloud / Firebase, which may process data outside the UK. Transfers are protected by Google's UK Addendum to the EU Standard Contractual Clauses, an approved safeguard under UK GDPR Article 46.

13.14 Governing law

This DPA is governed by English law, consistent with section 11 of these Terms.