TrueStamp Privacy Policy

1. Introduction & Scope

TrueStamp is a dual-sided platform. Local businesses ("Business Owners") use TrueStamp to run digital loyalty stamp card programs and collect AI-assisted customer reviews. End customers of those businesses ("Customers") use TrueStamp — typically by scanning a QR code at checkout — to earn stamps, track and redeem rewards, and submit reviews of their visit.

This Policy explains what personal data TrueStamp collects, why we collect it, the legal bases we rely on, how long we keep it, and the rights available to Customers, Business Owners, and their team members ("Users," collectively with Customers and Business Owners).

Dual-role disclosure. TrueStamp does not sit in a single, uniform relationship to all the personal data that flows through the platform:

• For account, authentication, billing, security logging, product analytics, and marketing data, TrueStamp is the data controller — we decide why and how this data is processed.
• For customer loyalty data (stamps, reviews, redemptions) collected through a Business Owner's workspace, the Business Owner is the data controller and TrueStamp acts as a data processor, processing that data only on the Business Owner's instructions and pursuant to a data processing agreement between TrueStamp and the Business Owner.

This distinction recurs throughout this Policy and determines, among other things, who a Customer should contact first to exercise certain rights over loyalty data (see Section 13).

2. Data Controller Identity

The controller responsible for the processing described in this Policy (except where Section 1 identifies a Business Owner as controller) is:

Mohd Aquib Khan and Umar Raza Ansari, doing business as TrueStamp
Privacy inquiries: truestamp.privacy@gmail.com

EU representative. TrueStamp does not currently engage in large-scale processing of EU/EEA residents that would require the appointment of an EU representative under GDPR Article 27. EU-based users may direct all privacy inquiries to the primary privacy contact email listed above.

3. Categories of Personal Data Collected

3.1 Customers

Note on date of birth. TrueStamp previously supported collection of a full date of birth. This field has been deprecated and is no longer collected. TrueStamp now collects only birthMonth and birthDay, used exclusively to trigger birthday-related promotional benefits.

3.2 Business Owners

4. Sources of Data

We collect personal data from the following sources:

• Directly from the Customer — at sign-up, when scanning a QR code, and when editing or submitting a review.
• Directly from the Business Owner — at workspace creation, during billing setup, and when configuring loyalty program rules.
• From the Business Owner, acting as controller — loyalty program data that a Business Owner's staff enters into the workspace on a Customer's behalf (e.g., a cashier recording a redemption).
• From Google OAuth — limited to the openid, email, and profile scopes when a User signs in with Google.
• From QR scan events — the decoded string produced when a Customer's device scans a TrueStamp QR code. No image or camera frame is captured as part of this process (see Section 8).

5. Purposes & Legal Basis (GDPR Article 6)

Where processing relies on legitimate interest, TrueStamp has considered that interest against the impact on individuals' rights and has concluded the processing is proportionate. Users may object to legitimate-interest processing as described in Section 13.

6. AI-Assisted Review Drafting Disclosure

TrueStamp offers AI-assisted review drafting from verified customer visits. The mechanism works as follows:

1. A Customer must have a valid, verified stamp or visit record before any AI drafting can occur. TrueStamp does not generate speculative or unprompted draft content — generation is gated on a real visit record.
2. An AI draft is generated (via Groq, operating in zero-data-retention mode — see Section 11).
3. The Customer is required to review and may edit the draft before it goes anywhere further.
4. The Customer must affirmatively submit the review. Nothing is auto-posted on the Customer's behalf.

Explicit disclosures:

• No auto-posting. A draft is never published without the Customer's own edit-and-submit action.
• No sentiment gating. Draft generation is not conditioned on whether feedback appears positive or negative — negative-feedback drafts are generated on the same basis as positive ones.
• No speculative generation. The system will not produce a draft in the absence of a valid, verified visit record tied to the Customer.

Transparency to end users. Consistent with the transparency expectations reflected in Article 50 of the EU AI Act, the TrueStamp interface labels AI-assisted content so Customers know, before they edit or submit, that a draft was machine-generated.

Audit trail. Every draft interaction is logged in ReviewAiDraftLog, an immutable record maintained consistent with FTC 16 C.F.R. Part 465, capturing: sourceVisitId, modelVersion, promptVersion, aiDraftText, humanEditedText, submittedText, submittingUserId, and associated timestamps. This log is retained even after a Customer deletes their account (see Sections 12–13).

7. Children's Data & Age Verification

TrueStamp is intended for use by individuals 13 years of age or older. At sign-up, Customers pass through a neutral age gate — the interface does not indicate why a given input was rejected, which helps discourage attempts to work around the gate. Sign-ups indicating an age under 13 are blocked at this stage.

TrueStamp does not collect a full date of birth. It collects only birthMonth and birthDay, used solely to trigger birthday-related promotional benefits described in Section 3.1.

TrueStamp maintains a written data retention and deletion policy consistent with the amended COPPA Rule's written-policy requirement, and does not knowingly collect personal data from children under 13. A parent or guardian who believes a child under 13 has provided personal data to TrueStamp may contact us at truestamp.privacy@gmail.com to request deletion.

8. Camera & QR Scanning

TrueStamp's QR scanning feature performs client-side decoding only. When a Customer scans a code:

• The camera feed is processed locally on the Customer's device.
• No image or video frame is uploaded to or stored by TrueStamp at any point.
• Only the decoded text string — not any visual data — is transmitted to TrueStamp's backend.
• TrueStamp does not collect or process biometric data (e.g., facial geometry) through this feature.

9. Super Admin Support Access

TrueStamp support and administrative personnel may, for the stated purpose of support and troubleshooting, initiate a time-boxed impersonation session to view a workspace as a User would see it.

• Time-boxed: every impersonation session automatically expires after 30 minutes.
• Immutably logged: each session is recorded in ImpersonationLog, capturing adminUserId, targetUserId, targetTenantId, reason, startedAt, endedAt, and an actionsTaken record of what was done during the session.
• Survives deletion: ImpersonationLog entries are retained under a legitimate-interest / legal-obligation basis (supporting the security-of-processing obligations reflected in GDPR Article 32) even after the relevant account is deleted (see Sections 12–13).

10. International Data Transfers

TrueStamp's subprocessors are located in the countries listed in Section 11. Where personal data is transferred outside the EU/EEA (in particular, to subprocessors located in the United States), TrueStamp relies on Standard Contractual Clauses (SCCs) as the transfer mechanism.

We acknowledge that data transferred to, or processed by, US-based subprocessors may be subject to access requests under US law, including the US CLOUD Act. This is an accepted residual risk, mitigated through the contractual, technical, and organizational safeguards reflected in our subprocessor DPAs. SCCs are relied upon as our transfer mechanism independent of, and as a backup to, any subprocessor's Data Privacy Framework (DPF) certification status.

11. Subprocessors

TrueStamp will update this list, and this Policy, before adding or replacing a subprocessor in a way that materially changes how personal data is processed.

12. Data Retention Schedule

Audit-trail records (ReviewAiDraftLog, ImpersonationLog, and the Redemption ledger) are retained on the bases above even after the associated account has been deleted, as described in Section 13.

13. Your Rights (GDPR)

For loyalty data where a Business Owner is the controller (Section 1), we recommend contacting the Business Owner directly in the first instance; TrueStamp will support the Business Owner in fulfilling the request as their processor.

14. Your Rights (CCPA/CPRA & State Privacy Laws)

TrueStamp extends the following rights to all Users, regardless of whether CCPA/CPRA's applicability thresholds are met:

• Right to know what personal data we hold about you.
• Right to delete your personal data (subject to the audit-trail exceptions in Sections 12–13).
• Right to correct inaccurate personal data.
• Right to opt out of sale or sharing of personal data.

We do not sell or share personal information, as those terms are defined under CCPA/CPRA and comparable state privacy laws.

These rights can be exercised through the self-service tools described in Section 13, or by emailing truestamp.privacy@gmail.com. We will not discriminate against you for exercising any of these rights.

15. Cookies & Tracking Technologies

TrueStamp uses only strictly necessary authentication and session cookies required for the platform to function (e.g., keeping you signed in). We do not use marketing or advertising cookies, and we do not engage in cross-site tracking.

If we introduce analytics or marketing cookies in the future, we will update this Policy beforehand and, where required by law, implement an appropriate consent mechanism before doing so.

16. Security Measures

TrueStamp maintains industry-standard safeguards designed to protect personal data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption of data in transit and at rest.
• Row-level security (RLS) enforcing multi-tenant isolation: every query is scoped through the chain of authenticated user → workspace membership → workspace_id → resource ownership.
• Session management built on OAuth authentication with minimal, revocable scopes.
• Rate limiting to mitigate abuse and automated attacks.
• Time-boxed, immutably logged administrative access (see Section 9).

No system can guarantee absolute security, and TrueStamp continues to invest in the safeguards described above as the platform evolves.

17. Data Breach Notification

In the event of a personal data breach, TrueStamp will:

• Notify relevant supervisory authorities within 72 hours of becoming aware of the breach, where feasible, consistent with GDPR Article 33.
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, consistent with GDPR Article 34.
• Notify affected Business Owners without undue delay, so that they can meet their own notification obligations as controllers of loyalty data processed under Section 1.

18. Changes to This Policy

This Policy is versioned (see the version identifier at the top of this document, also recorded against each User's account as privacyPolicyVersion/privacyPolicyAcceptedAt). Where we make a material change, we will notify affected Users via an in-app banner upon your next login, as well as an email notification to the address associated with your account and, where required, seek renewed acceptance before the change takes effect. Prior versions of this Policy are available on request.

19. Contact Information

For privacy-related questions or to exercise any of the rights described in this Policy, contact:

Mohd Aquib Khan and Umar Raza Ansari, doing business as TrueStamp
truestamp.privacy@gmail.com

Data Protection Officer: TrueStamp's current processing scale does not require the mandatory appointment of a Data Protection Officer under GDPR Article 37. All privacy and data protection inquiries should be directed to the privacy contact email listed above.

Right to complain. If you are located in the EU/EEA and believe our processing of your personal data does not comply with applicable law, you have the right to lodge a complaint with your local data protection supervisory authority, consistent with GDPR Article 77 — including the authority for your habitual residence, place of work, or the place of the alleged infringement.

This Policy is designed to support compliance with applicable privacy requirements, including the GDPR, CCPA/CPRA and comparable US state privacy laws, COPPA, and the EU AI Act's transparency provisions for AI-assisted content.