Privacy Policy

Ambr Systems Ltd, trading as Ambr ("Ambr", "we", "us", "our"), operates the Ambr mobile application and website at ambr.so (collectively, the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under the UK GDPR and the Data Protection Act 2018. If you are in the EU, the EU GDPR gives you equivalent rights and we honour them in the same way.

If you have any questions, contact us at support@ambr.so.

1. Who we are

Ambr is a digital loyalty card platform that allows businesses ("Merchants") to create stamp-based loyalty cards and customers ("Customers") to collect stamps and earn rewards. We act as the data controller for personal data processed through the Service.

The data controller is Ambr Systems Ltd, a company registered in England and Wales with company number 17544849, whose registered office is at The Hubb Business Centre, 335-351 Rainham Road South, Dagenham, RM10 8QR, United Kingdom. We are registered with the Information Commissioner's Office under registration number ZC289782.

2. Data we collect

We collect only the data necessary to provide the Service:

Account data

• Email address or mobile phone number (you choose one to save your card; we verify it with a one-time code or confirmation)
• Display name (optional, set by you)
• Password (email accounts only; stored as a secure one-way hash — we never see it in plain text)

Anonymous use

• You can collect stamps without creating an account. We create an anonymous account linked to your browser or device to hold your card. It does not include your name, email or phone number. Shops whose card you hold can still send messages to that card. If you later save your card or sign in, your stamps move to your account.

Loyalty activity data

• Stamp records: which loyalty cards you hold, how many stamps you have, and when, where (which branch) and how each stamp was added
• Rewards and offers you have earned, claimed or redeemed
• Your marketing preferences for each shop

Location check

• Some shops ask us to confirm you are at the shop when you stamp using their QR code. If so, we ask for your device's location once, check that you are within about 200 metres of the shop, and then discard it. We do not store your location or track it at any other time.

Online orders

• If you order from a shop online through Ambr: your name, an optional email address for your receipt, what you ordered, any note you add for the kitchen, and the order's payment reference. Card details go directly to our payment processor, Stripe; we never see or store them.
• Please don't put health information in an order note unless the shop needs it, for example a serious allergy. If you do, it is shared only with that shop so it can prepare your order.

Merchant and staff data

• Business details and loyalty card setup: the business name, address and branches, card design, stamp goal and rewards
• The owner's name, email address and mobile number, and the details of any managers and staff the owner invites (name, email or phone number, role and branches)
• A delivery name, phone number and address for the stamper and stand kit we post out
• Subscription and billing records. Payment card details are held by Stripe, not by us.
• Anything you tell us when you leave, such as the reason you closed your shop

Enquiries, waitlists and feedback

• If you ask about Ambr for your business or join a waitlist: your name, your shop's name, and your phone number or email address
• Feedback and support messages you send us, together with your role, device type and app version

Device data

• Your push notification token, if you allow notifications. We use it to send you stamp, reward and order updates, and offers from shops whose card you hold (see section 3).
• Your device type and app version
• IP addresses, which our hosting and sign-in providers log for security and to stop abuse

Usage data

• We keep a small set of first-party product metrics on our own infrastructure, for example which screens and prompts are shown or tapped. They are linked to your account or anonymous identifier and help us understand and improve the Service. We do not use third-party analytics or advertising tools, and we do not track you on other websites.

3. Legal basis for processing (UK GDPR Article 6)

• Contract performance (Art. 6(1)(b)): We process your account data, loyalty activity and orders because we need them to provide the Service you use, including the one-time codes we send by SMS or email when you save your card or sign in. The same applies to a Merchant's account, subscription and kit delivery.
• Legitimate interests (Art. 6(1)(f)): We rely on this for:
  • notifications about your stamps, rewards and orders
  • messages and push notifications with offers from shops whose loyalty card you hold
  • the location check and other steps that stop stamps being faked
  • product metrics, security logs and keeping the Service running
  • following up with businesses that ask about Ambr
  You can turn off a shop's offer notifications in the app at any time, or turn off notifications completely in your device settings.
• Consent (Art. 6(1)(a)): A shop sends you offers by text message only if you ticked the opt-in for that shop. You can withdraw it for each shop in the app, or by replying STOP to any of those texts.
• Legal obligation (Art. 6(1)(c)): We keep invoices and payment records because UK tax law requires it.

You can object to marketing at any time, and when you do, we stop.

4. How we use your data

• To authenticate you and maintain your account (including one-time sign-in and verification codes by SMS or email)
• To record and display your loyalty stamps and rewards
• To send you push notifications about your stamps, rewards and orders (if you have allowed notifications)
• To allow Merchants to verify stamp requests from Customers, and to prevent stamp fraud
• To deliver messages from shops whose card you hold: to your card's inbox, by push notification, and by text message only where you opted in to that shop
• To process online orders and send order receipts and updates
• To run Merchant accounts: subscriptions, billing, kit delivery, and service and account emails
• To respond to your support or feedback submissions and to enquiries from businesses

We do not sell or rent your personal data, and we do not share it with third parties for their own marketing.

A shop where you hold a card can see your name, your phone number or email address, and your activity with that shop, so its team can recognise you and serve you. The shop's owner can download that shop's customer list. Once downloaded, the shop is responsible for how it uses the list under data protection law. Shops never receive your password, and they only receive your activity with their own shop, never with other businesses.

5. Data processors and third parties

We use the following sub-processors to operate the Service:

• Supabase, Inc. — database, authentication, and storage infrastructure. Data is stored on servers in Ireland, in the EEA (AWS eu-west-1). As a UK-based controller, our transfers to the EEA are covered by the UK's adequacy regulations, so no additional safeguards are required. Supabase processes data under a Data Processing Agreement.
• Netlify, Inc. — hosts the Ambr website and web app. Standard web request logs (IP address, browser type) may be kept briefly for security, under Netlify's own privacy policy.
• Stripe — takes payments: Merchant subscriptions and invoices, and card payments for online orders. Online-order payments go to the shop's own Stripe account. Stripe receives your payment details directly, and also uses them to prevent fraud.
• Twilio Inc. — sends text messages: one-time verification codes, and offers from shops you have opted in to. Only your phone number and the message are shared, at the moment of sending. Twilio processes data under its GDPR Data Processing Addendum.
• Resend — sends our emails: sign-in and verification emails, order receipts, and Merchant account and billing emails. Only your email address and the message are shared.
• Expo, Apple and Google — deliver push notifications to the Ambr app: through Expo's push service, then Apple Push Notification service on iPhone and Firebase Cloud Messaging on Android. Only your device's push token and the notification content are shared.
• Discord — internal notifications to the Ambr team: for example, when a business signs up, leaves, or sends us feedback. These alerts contain only the business's name, the event, and a link to our admin system. They never include anyone's email address, phone number, or the text of their feedback.
• postcodes.io — looks up the address for a postcode a business enters during setup. Only the postcode is sent.

Some of these providers are based in, or may access data from, the United States. Where data leaves the UK, we rely on the UK's adequacy regulations (including the UK-US data bridge where the provider is certified) or on the UK International Data Transfer Addendum to the EU standard contractual clauses.

6. Data retention

• Your account data and loyalty records are retained for as long as your account is active.
• If a Merchant pauses or closes their loyalty programme, your stamps and earned rewards are kept exactly as they are, so nothing is lost if they reopen. Any expiry date on a reward you have already earned is extended by the length of the pause, so a pause never costs you a reward.
• If you delete your account, your account details, stamps and rewards are permanently deleted, always within 30 days of your request. A Customer's account is deleted straight away. A Merchant who owns a business can delete straight away too, or — the default — close their shop at once (billing stops immediately) and have everything deleted 30 days later, keeping their account if they change their mind before then. We email to confirm the request and again when the deletion is complete.
• If a Merchant deletes their account, their loyalty card ends and the stamps and rewards Customers held at that business are deleted. Customers' own accounts, and their cards at other businesses, are not affected. A Customer who held that card sees a short note that the business has closed its card (the business name, the date and how many stamps they had), kept for 90 days or until they remove it.
• What we keep after a Merchant's account is deleted, and why: their invoices and payment records (held by our payment processor, Stripe) for 6 years from the end of the financial year they relate to, because UK tax law requires it; and a short record that the account was closed — the business name, the owner's contact details, the dates, how it was closed and any reason they gave us — for 6 years, so that we can deal with any dispute or legal claim about the account. We do not keep the personal data of the business's Customers.
• What we keep after a Customer deletes their account:
  • online orders you placed, with the name and receipt email on them. They are the shop's sales records and are kept until that shop's account is deleted.
  • feedback you sent us and product metrics, which are no longer linked to your account
• Business enquiries and waitlist sign-ups are kept until you ask us to remove them or we no longer need them to follow up.
• Security logs kept by our hosting and sign-in providers, including IP addresses, are kept only for a short period.
• If you have unsubscribed from our emails, we keep a record of that so that we never email you again.
• Anonymised aggregate statistics (e.g. total number of stamps issued by a Merchant) may be retained after deletion as they cannot be used to identify you.

7. Cookies and similar technologies

We don't use advertising or third-party analytics cookies. We use:

• Sign-in cookies, which keep you signed in. The Service can't work without them.
• Browser storage (local storage), which holds your anonymous card, remembers prompts you have dismissed, and keeps the anonymous identifier for our first-party product metrics. The identifier never leaves Ambr.
• Stripe's cookies, only on pages where you pay. Stripe uses them to process the payment securely and to prevent fraud.

Clearing your browser's site data removes all of these. You will need to sign in again, and an anonymous card you haven't saved to an account will be lost.

8. Your rights (UK GDPR)

Under the UK GDPR — and, if you are in the EU, the EU GDPR — you have the following rights:

• Right of access: Request a copy of all personal data we hold about you.
• Right to rectification: Correct inaccurate or incomplete data. You can update your display name and email directly in the app.
• Right to erasure ("right to be forgotten"): Delete your account and all associated data at any time via Settings → Leave Ambr (in the app or on the web), or by emailing us. Some records are kept where the law requires it — see section 6.
• Right to restriction: Ask us to restrict processing of your data while a complaint is being resolved.
• Right to data portability: Merchants can download everything we hold for their shop at any time from Settings → Your data, as a spreadsheet or as JSON. Customers can request a machine-readable copy by emailing us.
• Right to object: Object to processing based on legitimate interests. If you object to marketing, we always stop.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, email support@ambr.so. We will respond within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EU, with your national data protection authority.

9. Data security

All data is transmitted over HTTPS. Passwords are hashed using industry-standard algorithms and are never stored or transmitted in plain text. Access to production data is restricted to authorised personnel. We apply the principle of least privilege to all internal systems.

10. Children

The Service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last updated" date at the top of this page and, where required by law, by sending you a notification through the app or by email. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions or requests, contact us at: support@ambr.so

Or write to us at our registered office: