Privacy
Draft. Review with counsel before launch. Last updated November 2026.
What we collect from customers
Your name, email, shipping address, phone number and the Google Business listing you connect your card to. Payments are processed by Stripe; we never see your full card number.
What we collect when someone taps a card
The time, which card, the device type and browser, whether it came from the chip or a QR code, and the approximate city derived from the IP address. That city is worked out on our own server against an offline database, so the IP address is never sent anywhere else, and the address itself is hashed and never stored in the clear. This is what lets the business that owns the card see how often it gets used. We do not track anyone after they leave for Google.
Retention
Individual tap events are kept for 13 months. Daily totals are kept indefinitely. Account data is kept while the account exists.
Third parties
Stripe for payments, Google Places for business lookup, and our email provider for order and account email. We do not sell personal data.
IP location data
City lookups use the DB-IP Lite database, made available by DB-IP under a Creative Commons Attribution licence.
Contact
privacy@gpromote.com