Bisqo

Privacy policy

Last updated: 14 November 2026

Bisqo is a digital stamp card for small shops. Shop owners use the Bisqo app; their customers add a stamp card to Apple Wallet or Google Wallet from a web page, without installing anything. This policy explains, in plain language, what data is involved, why, and what your choices are.

Who we are

Bisqo (“we”, “us”) provides the Bisqo app and the pages at bisqo.store. For questions about privacy, write to gokhan.erdal.91@gmail.com.

Our role

  • Shop owners: for your account data, Bisqo is the controller.
  • Customers: each shop runs its own loyalty program. For customers’ stamp card data, the shop is the controller, and Bisqo processes that data on the shop’s behalf, only to run the program. You can contact the shop or us; we’ll help either way.

Data about shop owners

  • Your email address and password. Passwords are handled by Firebase Authentication; we never see them in plain text.
  • Your shop: shop name, join link, card design (color, stamp icon, stamps for a reward, reward text) and the logo image you upload.
  • Your shop’s time zone and language.
  • Whether you have Bisqo Pro. Purchases are processed by Apple (App Store) or Google (Google Play); we don’t receive your payment card details.

Data about shop customers

  • The first name you type on the join page. It is shown on your card and to the shop.
  • Your stamp card: the number of stamps and the history of stamps and rewards (date and time, and which shop).
  • Your wallet (Apple or Google) and your language, so the card works and shows in your language.
  • Your birthday (day and month only, no year), if you choose to enter it on the join page of a shop that offers a birthday reward. It is used only to add your birthday stamps, and you can ask for it to be deleted at any time.
  • Apple Wallet only: when you add the card, your iPhone sends us a device library identifier and a push token. We use them only to update your card (for example, after a new stamp). When you remove the card, your iPhone tells us and we delete that registration.
  • Your IP address: used briefly to protect the join page from abuse (rate limiting), and recorded in standard server logs, which are kept for a limited period.

We don’t ask customers for an email address, phone number or password. The join page uses no cookies; it remembers the name you typed and a reference to your card in your browser’s local storage, on your own device, so you don’t have to type it again.

Why we use data

  • To provide the service: run stamp cards, keep wallet passes up to date, and show shop owners their dashboard and customers. Legal basis: for shop owners, our contract with you (GDPR Art. 6(1)(b)); for customers, providing the card you asked for and the shop’s legitimate interest in running its loyalty program (Art. 6(1)(b) and (f)).
  • Security and abuse prevention, such as rate limiting and server logs. Legal basis: legitimate interest (Art. 6(1)(f)).
  • Support: answering your messages. Legal basis: contract or legitimate interest.

What we don’t do

  • No ads.
  • No tracking across apps or websites.
  • No selling or sharing of personal data for advertising.
  • No third-party analytics or advertising SDKs.

Service providers

A few providers process data for us:

  • Google Cloud / Firebase: hosting, database, authentication, file storage and server functions. Data is stored in the EU (region europe-west1, Belgium).
  • Apple: Apple Wallet passes, the push notifications that update them, and App Store purchases.
  • Google: Google Wallet passes and Google Play purchases.

Our web pages load fonts from Google Fonts, so your browser connects to Google’s servers. Some of these providers may process data outside the EU; where they do, they rely on legal safeguards such as the EU Standard Contractual Clauses.

How long we keep data

  • Shop owner data: until you delete your account. You can do this in the app under Settings › Delete account. This deletes your shop, its cards and its statistics.
  • Customer card data: until the shop deletes it or the shop’s account is deleted. Card data is needed to keep the pass in your wallet up to date.
  • Customers can remove the card from their wallet at any time, and can ask for their card data to be deleted by emailing us or asking the shop.
  • Server logs: kept for a limited period, then deleted automatically.

Your rights

Depending on where you live (for example under the GDPR or Turkey’s KVKK), you can ask to access, correct or delete your data, object to or restrict its use, and receive it in a portable format. Email us at gokhan.erdal.91@gmail.com; for customer data, we work with the shop to answer you. We may need to confirm that the request comes from you.

You can also complain to a data protection authority: in the EU, the authority in your country; in Turkey, the Personal Data Protection Authority (KVKK Kurulu).

Children

Bisqo is not directed at children under 16, and we don’t knowingly collect their data. If you think a child has given us data, contact us and we’ll delete it.

Security

All connections are encrypted (HTTPS). Shop owners can only see their own shop’s data, and changes to stamp cards go through our servers.

Changes to this policy

We may update this policy as Bisqo changes. We’ll update the date at the top, and if the changes are significant, we’ll let shop owners know in the app or by email.

Contact

Questions or requests: gokhan.erdal.91@gmail.com