1. Introduction

NOMI Stamps ("we", "us", "our") operates a digital loyalty platform that connects customers with shops. This Privacy Policy sets out in full how we collect, use, store, share, and protect your personal information when you use the NOMI Stamps app, shop owner portal, or website (collectively, "the Platform").

We are committed to handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using the Platform you consent to the practices described in this policy.

This policy applies to all users of NOMI Stamps: customers who collect loyalty stamps, and shop owners who manage loyalty programmes. Where practices differ between these groups, we say so clearly.

2. Definitions

In this policy:

• "Customer" means a person who uses NOMI Stamps to collect stamps and redeem rewards at participating shops.
• "Shop owner" or "operator" means a business that uses NOMI Stamps to run a loyalty programme for its customers.
• "Personal information" has the meaning given in the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable.
• "Sensitive information" includes health information and other categories afforded higher protection under the APPs. NOMI Stamps does not knowingly collect sensitive information.
• "Third-party provider" means a company we engage to provide services that support the Platform (e.g. Supabase, Stripe, Mapbox).

3. Information we collect

3.1 Information you provide: customers

• Email address: required to create and operate your account.
• Display name: the name shown on your profile. Can be your real name or a nickname.
• Password: stored securely as a hashed value via Supabase Auth. We never see or store your plain-text password.

We do not collect a profile suburb for customers. Instead, if you grant location permission, we collect your GPS location to personalise nearby shop and deal recommendations. See Section 3.4 and Section 5.

3.2 Information you provide: shop owners

• Email address and password: required to create and operate your account.
• Business name, address, suburb, and phone number: displayed on your shop listing.
• Shop description: up to 25 words displayed on your public listing.
• Social media handles: Instagram, TikTok and Facebook handles and your website address, if you choose to add them.
• Loyalty programme settings: stamp goal, reward description, card design choices.
• Promo content: titles, descriptions, dates, and images for deals you publish.

3.3 Loyalty and transaction data

When stamps are issued or rewards are redeemed through NOMI Stamps, we record:

• Stamp quantity and timestamp
• Which shop issued the stamps
• QR token nonce (a one-time value used to prevent duplicate stamp credits: stored only to validate uniqueness, not linked to personal identity beyond the card)
• Reward redemptions and deal redemptions
• Total stamp history per card

This data is the core of the loyalty service and cannot be disabled while you use NOMI Stamps.

3.4 Location data

See Section 5 for a full explanation of how we handle location. In summary: if you grant location permission, your GPS coordinates are recorded each time you open the app, and are retained for up to 12 hours. This data is used to show nearby deals, centre the map, determine Geo-Push notification eligibility, and show how far away a shop is.

3.5 Device and technical data

We automatically collect limited technical information to keep the Platform running reliably:

• Device type and model, operating system and version
• App version
• Server error logs and API error traces (collected via Supabase and Vercel infrastructure)
• IP address (logged temporarily by Vercel infrastructure for security and rate-limiting purposes)
• Browser type and version (web users)

This data is used only for debugging, security monitoring, and improving reliability. It is not linked to your identity in any personally identifiable way.

3.6 Push notification tokens

If you grant permission for push notifications, we store a device token issued by Apple's Push Notification Service (via Expo). This token is used only to deliver notifications from shops you follow. You can revoke this at any time in your device settings, which will prevent new tokens being stored.

3.7 Local storage and session data

We use your device's local storage (not cookies) to remember preferences such as dark mode, your active session token, and navigation state. This data stays on your device and is not transmitted to our servers except where required to authenticate your session.

3.8 Payment information: shop owners

Subscription billing is handled entirely by Stripe. NOMI Stamps never receives, processes, or stores your credit card or payment card details. We store only your Stripe customer ID and subscription status (active, trialing, cancelled) to manage access to plan features. By subscribing, you also agree to Stripe's terms and privacy policy at stripe.com.

4. How we collect your information

We collect information:

• Directly from you: when you register an account, update your profile, generate a QR code, scan a QR code, publish a promo, or contact us.
• Automatically: device and technical data is collected automatically when you use the Platform.
• From third-party providers: Stripe sends us subscription status events via webhook; Supabase Auth manages session data.

We do not purchase personal information from data brokers or receive personal data from third parties for marketing purposes.

5. Location data: how it works

We treat location data with particular care. Here is a precise and complete account of how location works in NOMI Stamps:

5.1 When location is accessed

When you first install the NOMI Stamps app, you are asked once via your device's system permission dialog whether to allow location access. If you grant it, your GPS coordinates are read each time you open the app (to keep nearby deal and notification eligibility current, and to centre the map on your position). The app also registers a periodic background refresh task. Your device may wake the app approximately every 12 hours to silently update your location without any action from you. This background refresh is subject to your device's scheduling and battery optimisation; it is not guaranteed to run at exact intervals. We do not request "always on" background location access. Mapbox (our mapping provider) receives your coordinates while the Map tab is open to render the map; this is governed by their privacy policy at mapbox.com/legal/privacy.

5.2 Location data retention

Each location read results in a new GPS coordinate point being stored alongside a timestamp. We retain all points recorded within the past 12 hours; points older than 12 hours are automatically deleted after each new update. There is no long-term movement history: the maximum window of stored location data at any moment is 12 hours. Server logs (maintained by Vercel) may contain IP addresses that could approximate a general location; these are retained for a maximum of 30 days.

5.3 Geo-Push notifications

If a shop on NOMI Stamps publishes a deal with Geo-Push enabled, NOMI Stamps checks whether any of your GPS coordinates stored within the past 12 hours places you within 5km of that shop. If so, you may receive a push notification for that deal, provided you have also granted push notification permission. This check uses only your stored location points. You can opt out of push notifications at any time in your device settings.

5.4 Distance in deal notifications and shop details

When a shop sends you a deal notification and your location was recorded within the past 30 minutes, the notification may say how far you are from that shop (for example, "400m away"). If your most recent location is older than 30 minutes, no distance is shown. The distance is calculated on our servers from your stored location points and the shop's address; your location is never shared with the shop. When you open a shop's details in the app, the distance is calculated on your device from your current position.

5.5 Revoking location access

You can revoke location permission at any time in your device settings (iOS: Settings → Privacy & Security → Location Services → NOMI Stamps; Android: Settings → Apps → NOMI Stamps → Permissions → Location). If you revoke permission: the Map tab will display a "location disabled" banner and your location will no longer be updated; the "Deals near you" section will be hidden from the Deals tab; background location refresh will stop. All other features (loyalty cards, stamps, promos) continue to work normally without location access.

6. How we use your information

6.1 Providing the service

• Creating and authenticating your account
• Operating your loyalty cards: recording stamps, tracking progress, enabling reward redemptions
• Displaying your history of stamps and rewards
• Enabling shop owners to generate and validate QR codes
• Showing nearby shops and deals on the Map tab
• Delivering push notifications from shops you follow (customers) or to your card-holding customers (shop owners)
• Processing subscription payments (shop owners)
• Sending transactional emails: password resets, account confirmations

6.2 Personalisation

• Matching Geo-Push deals to customers within 5km of a shop (using stored GPS location, if permission granted)
• Showing how far away a shop is in a deal notification (only from a location recorded in the past 30 minutes) and in a shop's details
• Showing your loyalty rank and achievement progress based on total stamps earned
• Surfacing promos from shops where you hold a loyalty card

6.3 Analytics and improvement

• Generating anonymised, aggregated statistics (e.g. stamps issued per suburb, daily stamp volumes)
• Monitoring Platform performance and identifying bugs
• Understanding how features are used to guide product development

We do not use individual behavioural data to build advertising profiles. All analytics that inform product decisions are aggregated and cannot identify you.

6.4 Security and fraud prevention

• Storing QR nonces to prevent stamp replay attacks
• Monitoring for unusual usage patterns (e.g. rapid repeated stamp attempts)
• Rate limiting API access to prevent abuse
• Verifying account identity to prevent impersonation
• Security notice emails: when your password, login email or a shop PIN changes, we email you the device type, approximate location (city level, derived from the IP address) and IP address of the request that made the change, so you can spot changes you did not make. These details are included in the email only and are not stored in our database.

6.5 Legal obligations

We may use or disclose your information to comply with a legal obligation, court order, or enforceable government request, or to protect the rights, property, or safety of NOMI Stamps, our users, or the public.

6.6 What we do not do

We do not sell your personal information to any third party. We do not share your data with advertisers. We do not use your data to serve you targeted advertising outside of the NOMI Stamps Platform. We do not use your data for any purpose not listed in this policy without your separate, explicit consent.

7. How we share your information

7.1 With shops

Shop owners can see aggregated analytics for their loyalty programme: total stamps issued, redemption counts, and promo performance.

If you hold a loyalty card with a shop, that shop can also export a record of customers who hold a card with them, which includes your name and email address. Shops may use this information for their own purposes, such as marketing or customer relationship management, separate from the NOMI Stamps Platform. We do not control how a shop uses this exported data once they receive it, and you should refer to that shop's own privacy practices for how they handle it.

You can opt out of being identified in a shop's export at any time via Profile → Account → Hide My Name & Email. If you opt out, your record appears in the shop's export as "Opted Out" instead of your name and email.

7.2 With service providers

We share the minimum necessary personal information with the following trusted third-party providers to operate the Platform:

• Supabase (supabase.com): database, authentication, and real-time services. Data stored in Australia and the European Union. Supabase processes data under its Data Processing Agreement in accordance with GDPR-equivalent standards.
• Mapbox (mapbox.com): map rendering. Your device location is transmitted to Mapbox only while the Map tab is open to render the map.
• Stripe (stripe.com): payment processing for shop subscriptions. We never receive your payment card details.
• Expo (expo.dev): push notification infrastructure. Your device push token is shared with Expo solely to deliver notifications you have opted into.
• Resend (resend.com): transactional email delivery (e.g. password resets). Your email address is shared with Resend only to deliver emails you have initiated.
• Vercel (vercel.com): Platform hosting and serverless functions. Vercel processes request data (including IP addresses) as part of serving the Platform.

All third-party providers are contractually required to use your data only for the purpose of providing their service to us and to maintain appropriate security standards.

7.3 Legal disclosures

We may disclose personal information if we believe in good faith that disclosure is necessary to: comply with applicable law or legal process; protect the rights, property, or safety of NOMI Stamps, our users, or others; prevent fraud or security threats; or respond to an enforceable government request. Where legally permitted, we will notify affected users before making such a disclosure.

7.4 Business transfers

If NOMI Stamps is involved in a merger, acquisition, asset sale, or restructuring, your personal information may be transferred as part of that transaction. We will notify you via the app or email before your information is transferred and becomes subject to a different privacy policy.

7.5 What we do not do

We do not sell, rent, or trade your personal information for payment. Other than the shop data export described in 7.1, we do not share your information with any third party for their own commercial purposes, and we do not share your information with social media platforms or advertising networks without your explicit consent.

8. Data storage and international transfers

NOMI Stamps is operated from Australia. Your data is primarily stored in Australia and the European Union via Supabase. Certain service providers (Vercel, Expo, Resend) operate globally and may process data in the United States or other jurisdictions.

When your personal information is transferred outside Australia, we take steps to ensure it is protected to a standard comparable to the APPs, including by using providers with data protection agreements that meet or exceed Australian standards.

By using NOMI Stamps, you consent to the transfer of your information as described in this section.

9. Data retention

We retain personal information only for as long as necessary for the purposes set out in this policy, or as required by law.

Account and loyalty data: customers

Retained while your account is active. Deleted permanently within 30 days of account deletion, except where retention is required by law.

Account and loyalty data: shop owners (businesses)

When a shop owner cancels their subscription or deletes their account, all shop data (profile, loyalty programme, customer cards, settings, stamp history) is retained for 60 days. During this period the account is inactive but the data is preserved so the owner can return and resume without any loss. If the account is not reactivated within 60 days, all associated data is permanently deleted. Stripe billing records are retained separately in accordance with Australian tax law (see below).

This 60-day retention also applies when a shop owner on a multi-location plan removes an individual location. The location is deactivated immediately but all associated data (loyalty cards, stamp history, customer records) is held for 60 days and can be restored from Settings within that window. If not restored, the data is permanently deleted at the end of the 60-day period.

Visit history

Individual stamp, reward and deal redemption records (which shop, when, how many) are retained for 12 months, then automatically deleted. Your running stamp count and lifetime totals are kept on your loyalty card while your account is active. One exception: if a deal limits how many times each customer can claim it, your claims of that deal are kept for as long as the limit needs them (for a once-only deal, until the shop deletes the deal), so the limit can be enforced.

QR codes and nonces

Stamp and deal QR codes expire within minutes and are deleted about one day after they expire. The one-time value (nonce) from a scanned stamp QR code is stored with that stamp record to prevent replay attacks, and is deleted with it after 12 months. It is not used for any other purpose.

Location data (GPS coordinates)

Stored as a rolling 12-hour history: each app open appends a new point; points older than 12 hours are automatically deleted on the next update. Used for Geo-Push eligibility (5km window) during the 12-hour retention period, and for the distance shown in a deal notification when the latest point is under 30 minutes old. Deleted permanently when your account is deleted. Server access logs (containing IP addresses) retained for a maximum of 30 days.

Suburb preference

Retained as part of your profile until you update or delete it, or until your account is deleted.

Push notification tokens

Retained while your account is active or until you revoke notification permission. Deleted when your account is deleted.

Technical and error logs

Retained for a maximum of 30–90 days depending on the logging system. Not linked to identifiable user accounts.

Subscription and billing records (shop owners)

Stripe retains billing records in accordance with their policies and applicable financial record-keeping laws. We retain subscription status records for 7 years to comply with Australian tax law.

Anonymised aggregate data

Aggregated, non-identifiable statistics (e.g. total stamps issued in a suburb) may be retained indefinitely. This data cannot be used to identify you.

Backup data

Database backups are retained for up to 30 days before being automatically overwritten. Backups are encrypted and stored in the same regions as primary data.

10. Your rights

Under the Australian Privacy Act 1988 and the Australian Privacy Principles, you have the following rights regarding your personal information.

10.1 Right to access

You may request a copy of the personal information we hold about you. We will provide this within 30 days of a verified request. We may charge a reasonable fee to cover administrative costs in exceptional cases.

10.2 Right to correction

If you believe information we hold is inaccurate, out of date, incomplete, irrelevant, or misleading, you may request correction. You can update most profile information directly within the app. For other corrections, contact us.

10.3 Right to deletion

You may delete your account at any time via Settings → Delete account.

Customers: All personal information is permanently removed within 30 days of account deletion, except where retention is required by law (e.g. financial records).

Shop owners (businesses): On account deletion or subscription cancellation, your shop data is held for 60 days to allow for reactivation. If you do not reactivate within that period, all data is permanently deleted. The same 60-day retention applies when you remove an individual location on a multi-location plan: the location can be restored from Settings within that window. If you wish to be deleted immediately without the 60-day window, contact us at privacy@nomistamps.com.

10.4 Right to data portability

You may request a copy of your personal data in a portable, structured format (JSON or CSV). Contact us at privacy@nomistamps.com with your request. We will respond within 30 days.

10.5 Right to restrict processing

In certain circumstances you may request that we restrict how we process your data (for example, while a correction request is being assessed). Contact us to make such a request.

10.6 Right to withdraw consent

Where we rely on your consent to process personal information (e.g. push notifications, location access), you may withdraw consent at any time without affecting the lawfulness of prior processing. To withdraw push notification consent, use your device settings. To withdraw location consent, use your browser or device location settings.

10.7 Shop owners: additional rights

• Right to access all stamp event and redemption records for your shop
• Right to correct your shop's business information at any time via Settings
• Right to export your shop's customer, stamp, redemption, and deal records at any time via Settings → Export Data
• Right to delete your shop's data by deleting your account

10.8 How to exercise your rights

Use the in-app account deletion feature in Settings, or email privacy@nomistamps.com. We will verify your identity before acting on requests. We will respond within 30 days.

11. Security

We take the security of your personal information seriously and implement the following measures:

• Transport Layer Security (TLS/HTTPS): all data transmitted between your device and our servers is encrypted in transit. We do not permit unencrypted HTTP connections.
• Row Level Security (RLS): Supabase RLS policies are applied to every database table, ensuring that users can only access their own data at the database level.
• Access controls: our service role keys, API secrets, and credentials are stored as environment variables and are never included in client-side code or version control.
• Rate limiting: all API endpoints are rate limited to protect against brute-force attacks and abuse.
• Input validation and sanitisation: all user-supplied input is validated and sanitised on the server side to prevent injection attacks.
• Encrypted backups: database backups are encrypted and stored in certified cloud infrastructure.

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at privacy@nomistamps.com.

Data breach notification

In the event of a data breach that is likely to result in serious harm to affected individuals, we will notify affected users and, where required, the Office of the Australian Information Commissioner (OAIC) as soon as practicable and in any case within 30 days of becoming aware of the breach, in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988.

12. Children's privacy

NOMI Stamps is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are under 13, please do not use NOMI Stamps or provide any information through the Platform.

If you are a parent or guardian and believe your child under 13 has created a NOMI Stamps account or provided personal information without your consent, contact us at privacy@nomistamps.com and we will promptly delete the account and associated data.

Users aged 13–17 should use NOMI Stamps with the knowledge and consent of a parent or guardian.

13. Third-party links and content

The Platform may contain links to third-party websites or services (for example, a shop's Instagram page). We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before providing personal information.

Shops listed on NOMI Stamps operate independently of NOMI Stamps. Any direct interactions you have with a shop outside of the NOMI Stamps Platform are not governed by this policy.

14. Cookies and local storage

NOMI Stamps does not use tracking cookies. We do not use advertising cookies or analytics cookies that report your behaviour to third parties.

We use browser local storage to store your session authentication token (necessary to keep you logged in), your dark mode preference, and certain UI state (such as your last active tab). This data remains on your device and is not shared with third parties.

Mapbox, which powers the Map tab, may set its own cookies or use local storage for map tile caching. This is subject to Mapbox's privacy policy.

No cross-app tracking: NOMI Stamps does not track you across other apps or websites for advertising purposes. We do not participate in any advertising network data sharing. No App Tracking Transparency (ATT) prompt is shown because no tracking of this kind occurs.

15. Complaints

If you believe we have handled your personal information in a way that does not comply with the Australian Privacy Act 1988, please contact us first so we can attempt to resolve the issue:

privacy@nomistamps.com

We will acknowledge your complaint within 5 business days and endeavour to resolve it within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices, technology, legal requirements, or for other reasons. When we make significant changes, we will notify you via the app or by email to the address on your account. The date at the top of this policy shows when it was last updated.

Your continued use of NOMI Stamps after any changes to this policy constitutes your acceptance of the updated policy. If you do not agree to the changes, please stop using NOMI Stamps and delete your account.

17. Contact us

For any privacy questions, requests, or concerns:

privacy@nomistamps.com

www.nomistamps.com

We aim to respond to all privacy enquiries within 5 business days.