Privacy policy

Who we are

Club OTD is a loyalty stamp card app. It is operated by DML Studio LLC. This policy explains what data we use when you use the app or this site.

Data we collect

From customers: name, email, and your stamp activity (cards, stamps and redemptions). From businesses: business name, category, country, state, city and, if provided, phone, address and the shop's spot on the map (only if the business taps "Use my location"). We never ask for or store a customer's location. From your device: an identifier to send you notifications, the platform and the app version. For security we log the IP address on stamp requests and in the audit log. If you buy from a business that connected its sales system to Club OTD (for example Kharyo), that system sends us your phone number so we can keep your stamps. We don't store the number: we store an encrypted fingerprint (hash) and the last 4 digits. If the system sends your name, we use it on your card; if it sends your email, we don't store it. If you add your card to Apple Wallet, we store the identifier Apple gives your device for that pass and its notification token, encrypted. We only use them to update the pass when you get a stamp or the card changes.

What we use it for

To create your account, show your cards, send stamp requests and notifications, review businesses, charge subscriptions and prevent fraud. We do not sell your data.

Who we share it with

When you ask for a stamp, the business team sees your name and your progress on their card, never your email. We also use providers that process data on our behalf: Firebase (Google) for notifications, Apple and Google for sign-in, the app stores and RevenueCat for subscriptions, and local payment processors. If the business connected its sales system, that system sees your progress on that business's card. If you added your card to Apple Wallet, we send Apple an empty notice so your Wallet updates the pass. That notice carries none of your data. If you add your card to Google Wallet, Google receives your name, your stamps and your card's QR code to show it on your phone.

We process the logo a business uploads with OpenAI to generate its card design. In-app purchases are handled by Apple, Google and RevenueCat, and we never see your payment card details. If something fails on our servers, we may log the error in Sentry, without personal data.

How long we keep it

We keep your data while your account is active. When you delete it, we end your sessions, remove your devices and Apple or Google sign-in links, and anonymize your account: your name and email are erased. Stamps and redemptions remain without personal data for the business statistics. We keep the audit log (with IP) and payment records for as long as the law requires. If a connected business gave you stamps and you don't claim your card with the link you received, after 12 months without new stamps at that business we delete your phone number and your name. If you claim it, the phone number is linked to your account for that business only and is deleted with it. If you buy from another connected business, you get another link and claim it once there too. The device identifier and the pass token are deleted when you remove the pass from your Wallet, one week after you delete your account (during that week the pass shows as no longer valid in your Wallet), or after a year in which neither your card changes nor your device checks in.

Your rights and account deletion

You can ask for access, correction or deletion of your data. You can delete your account from the app, under Profile, or request it at clubotd.com/en/delete-account.

Children

Club OTD is not aimed at children under 13 and we do not knowingly collect their data.

Changes to this policy

If we change this policy we will publish the new version here with its date. If the change is significant, we will let you know in the app.

Contact

If you have questions about your data or want to exercise your rights, email us at [email protected].