Privacy policy

• Bentorno is a digital stamp card. Businesses use it to give their customers stamps and rewards, and customers collect them in the Bentorno app.
• We collect only what the service needs: for customers, your email, your name and, if you give it, your birthday; for businesses, the account and business details you enter.
• Each business decides about its own cards: the stamps, visits and rewards you collect there. We handle that data for the business.
• We don't sell your data, show ads, use tracking cookies or analytics tools, or train AI on your data.
• You can see, correct, export and delete your data, and object to how we use it. Write to [email protected].

This policy explains how Bentorno handles personal data on its website (bentorno.com), in the dashboard for businesses and their teams, and in the Bentorno app for customers.

Bentorno is run by the provider named in our Impressum, who is responsible for your data as described below (the "controller"). You can reach us at [email protected] for anything about your data. We have not appointed a data protection officer.

Two parties handle data in Bentorno, each for its own part:

• Bentorno decides about the accounts: a customer's account (email, name, birthday, Bentorno code, sign-in) and a business's account (the owner's account, the business and its venues). For these, we are the controller and this policy applies in full.
• Each business decides about its own cards and its team: the cards it issued, the visits, stamps and rewards on them, which of its updates you opened, and its team members' accounts, the venues they work at and who gave which stamp. For these, the business is the controller, and we handle the data on its behalf under our data processing agreement. Questions about a business's card or its rewards are best sent to that business; we forward requests about its data to it.

If you collect stamps (customers)

• Your email address, to sign you in with a one-time code and to send you the codes.
• Your name and surname, so the businesses whose cards you hold know whose card they scan.
• Your birthday's day and month, if you give it (never the year), for birthday rewards.
• Your Bentorno code, which staff scan or type to find your card.
• Your cards: which businesses' cards you joined and when, your visits, the stamps you earned and redeemed, your rewards, and the amount of a receipt when staff enter one.
• Which business updates you opened, and when you first did.
• Sign-in records: the one-time codes we sent (stored only in scrambled, hashed form), your signed-in devices' sessions, and the times of sign-in attempts, kept with a hashed form of your email to limit repeated tries.

If you run a business (owners)

• Your name, email address and password (stored only as a secure hash).
• The business's details: its name, legal name, invoicing address, phone and tax ID, its logo and social media links.
• Each venue's name, type, address, time zone, description, contact email and phone, its join code, and the text and logo on its counter sign.
• Your stamp cards' rules and rewards, and the updates you write, with their images and author.
• Your subscription and its payments, as Polar reports them: the plan, its status and price, how many venues it covers, when the paid period starts and ends, whether a cancellation is scheduled, when it started and ended, and each payment's amount, tax, date and refund status.
• These can identify you as a person if your business carries your name, as a sole trader's often does.

If you work for a business (staff)

• Your name and email address, from your invite, and your password (stored only as a secure hash).
• The venues you work at, when you were last active, and the stamps you gave or undid.
• Your business manages this data: ask it first about your account, and we forward requests to it.

Everyone who uses the website, the dashboard or the app

• Technical request data in logs, ours and our hosting provider's: your IP address (our own logs keep an IPv4 address in full and shorten an IPv6 address to its network), the time, the page or function requested, the result, your browser's type in our hosting provider's logs and, if you are signed in, your account's ID. These logs never record one-time codes, passwords, Bentorno codes or searches, and we don't use your IP address to find out where you are.
• Security records at Cloudflare, which protects our sites: for a request one of its security rules acted on (for example one it stopped), the address requested, which can include a Bentorno code or a search, with your IP address and browser's type.
• Your language choice, and whether you last picked our website's page for businesses or the one for customers, in cookies (see our cookie policy).
• The emails you send us.

Where it comes from. Most of this comes from you. Visits, stamps and receipt amounts are entered by a business's staff when they scan your code. A team member's name and email come from the owner's invite. Subscription and payment details come from Polar.

What you must give. To create an account, a customer needs an email address, a name and a surname; a business owner needs their name, email address and a password, the business's name and, before the business goes live, its legal name and invoicing details. Without them we can't provide the service. Your birthday, venue contact details and social media links are optional.

What we don't collect. We don't collect payment card details, your location, your contacts or special categories of data such as health data, and we ask you not to put such information in any text you write in Bentorno. Photos you upload are stored as you upload them, and can carry hidden details such as where they were taken, so check them before you upload.

• To provide Bentorno: to create and run your account, sign you in, keep your cards and stamps correct, give birthday and welcome rewards, show businesses their customers and visits, and send the emails the service needs (sign-in codes, address confirmation, password resets, team invites, and the code to confirm deleting an account).
• To run a business's subscription: to open Polar's payment window and card form in the dashboard, and keep the plan and its payments in step with Polar.
• To remember your language, so each page opens in the language you chose, and the side of our website you picked (businesses or customers), so the website opens on it.
• To keep it safe and working: to limit repeated sign-in attempts, find and fix errors, prevent misuse, and improve the service from anonymous statistics.
• To show businesses how their customers come back: for each business, the dashboard sorts the business's customers into groups from their visits there: new (joined in the last 30 days), regular (4 or more visits in 30 days), slipping away (3 or more visits but none in the last 21 days) and reward ready. This is a simple form of profiling, done for the business. It only changes what the business sees, never what you get, and no decision with legal or similarly significant effects is made about you automatically.
• To meet legal duties: such as keeping business records, and answering authorities when the law requires it.
• To protect our rights: in a dispute or a legal claim.

We don't send marketing emails. We don't sell your data, use it for advertising, or train AI models on it. Anonymous statistics can no longer identify anyone, and we never try to identify people in them. If we ever want to use your data for a new purpose, we will do so only if it fits the purpose we collected it for, or with your consent.

The GDPR requires a legal basis for each use of personal data. For what we decide, ours are:

What a business decides. For its cards, its visits, stamps and rewards, its customer groups and its team, the business decides why the data is used and on which legal basis, usually its contract with you or its legitimate interest in running its loyalty programme and seeing how its customers come back. We use that data only on the business's instructions (Art. 28 GDPR). An objection to it, such as to the customer groups, goes to the business, and we forward it if you send it to us.

Where we rely on a legitimate interest, you have the right to object (see Your rights). Nothing in Bentorno relies on your consent today; if anything ever does, you can withdraw it at any time.

• The businesses whose cards you join see your name, a shortened form of your email (such as ay•••@example.com), your Bentorno code, when you joined, your visits, stamps and rewards at that business, the group you are in, and an activity log of your card naming the team member behind each change. A birthday reward shows them the day, never the year. They never see your full email, your other businesses' cards or which updates you opened (only how many people did). Nothing is public.
• A business's team sees all of the business's customers and its activity log, including who gave which stamp, and the owner sees the team's names, emails and last activity.
• Our service providers, who handle data only on our instructions under contracts that protect it: Railway (hosting, database and file storage), Resend (sending our emails) and Cloudflare (protecting our sites from attacks and abuse: every request to them, with your IP address, passes through its network).
• Polar (Polar Software, Inc.), which sells Bentorno's subscriptions as the merchant of record and handles payment, tax and invoices as the seller, under its own privacy policy. When an owner opens the payment window, we send Polar the owner's email and name and the business's legal name, invoicing address, tax ID and its ID with us, for the invoice and to link the payment to the business. The owner types the card and the billing details into Polar's payment window, and a new card into Polar's card form, where Stripe processes the card for Polar; we never see it. As the seller, Polar sends the owner the emails about the subscription and the receipt of each payment, and makes each payment's invoice, which the owner downloads on the dashboard's billing page.
• Professional advisers such as lawyers and accountants, under confidentiality.
• Authorities, only when the law requires it or to protect our rights.
• A buyer or successor, if the business is sold or merged, under this policy.
• Anyone else, only if you ask us to.

Our database, files and servers are in the EU. Railway, Resend and Cloudflare are US companies: Railway's operations and support are in the US, Resend stores the emails it sends (including sign-in codes) and its delivery logs in the US, and Cloudflare handles each request to our sites in its worldwide network and keeps its records in the US. These transfers rely on the EU-US Data Privacy Framework, under which all three are certified, and on the EU's standard contractual clauses in their data processing agreements, which also cover any other country without an EU adequacy decision where Cloudflare's network may handle a request. You can ask us for a copy of these safeguards at [email protected]. Polar, which sells our subscriptions, is a US company too and keeps its data mainly in the US, where what we send it at checkout goes; its own privacy policy explains how it protects data that leaves the EU.

When a period ends, we delete the data or make it anonymous. A deleted account is removed at once from our database; copies in backups are kept apart and deleted as the backups expire.

We protect your data with measures that fit the risk: encrypted connections, passwords stored only as secure hashes, one-time codes and session keys stored only in hashed form, limits on repeated attempts, sign-in cookies that scripts can't read, and logs that never record codes, passwords or searches. The full list is in our data processing agreement. No system is perfectly secure: use a strong password for the dashboard, keep your email account safe, since sign-in codes and links go there, and tell us at once if you think someone used your account.

You have the right to:

• access your data and get a copy of it;
• correct data that is wrong (customers can edit their name and birthday in the app);
• delete your data: customers can delete their account in the app, a business owner can delete all of the business's data in the dashboard's settings, team members ask their business, which manages their account, and you can always ask us at [email protected];
• restrict how we use your data;
• export your data: ask us and we send it to you in a common, machine-readable format, to keep or give to someone else;
• withdraw consent at any time, where we rely on it, without affecting what came before.

Your right to object. Where we use your data on the basis of a legitimate interest, you can object at any time, for reasons that arise from your situation. We then stop, unless we have compelling reasons that override your interests, or need the data for a legal claim.

Emails. We send only the emails the service needs. If we ever send news or offers, we will do so only as the law allows, with a link to stop them in every email.

To use any of these rights, write to [email protected] from the email address of your account, so we can confirm it's you. We answer within one month; for complex requests we may need up to two more months, and if so we tell you within the first month. If we can't do what you ask, we tell you why. For data a business controls, such as its cards, we pass your request on to it.

You can also complain to a data protection authority, in particular where you live, where you work, or where you think the problem happened.

Some privacy laws outside the EU give extra rights or ask for extra statements. If your local law gives you more rights than this policy describes, we honour them. Wherever you live:

• We don't sell your personal data or share it for targeted advertising, and we don't use it for profiling that has legal or similarly significant effects. There is nothing to opt out of, so there is nothing for a Global Privacy Control signal to switch off.
• We use your sign-in details only to provide and secure the service, collect no other sensitive data on purpose, and don't give personal data to others for their own marketing.
• We don't track you across other websites, so "Do Not Track" signals change nothing.
• You can ask what personal data we hold about you, where it came from, why we use it and who we share it with, and ask us to correct or delete it. Someone you authorise can ask for you, once we've confirmed your identity and their authority.
• If we turn down your request, you can ask us to look at it again by replying to our answer.
• We will never treat you worse for using your rights.

In the last 12 months, and today, we collected these kinds of personal data:

We sold or shared none of it for advertising.

Our pages link to other websites, such as the social media pages of businesses and of Bentorno, and the dashboard opens Polar's payment window and, to change the card, Polar's card form. We don't control them; their own privacy policies apply.

The Bentorno app and business owners' accounts are for people aged 18 or older; we don't knowingly collect data about younger customers. Each business decides who joins its team. If you think a customer under 18 has given us their data, tell us and we will delete it.

We update this policy when our service or the law changes. The date at the top shows the latest version. If a change matters for your account, we will tell you by email before it applies. You can ask us for earlier versions.

For anything about your data, write to [email protected]. Our full details are in our Impressum.