Privacy Policy

This policy explains how Form44 (“we,” “us”) handles personal information. Form44 is operated as a sole-trader business based in Victoria, Australia. This policy covers three groups of people:

• Merchants — the business owners and staff who hold a Form44 account;
• Members — a Merchant's own customers, who add a loyalty card to Apple Wallet or Google Wallet at a Merchant's /join link and never create a separate Form44 account; and
• Waitlist subscribers — people who leave an email address ahead of launch in a city we haven't opened in yet.

We handle Australian Privacy Principles obligations under the Privacy Act 1988 (Cth) as they apply to a business of our size and activities.

1. Information we collect

From Merchants

• Account details: name, email address, and password (stored hashed by our authentication provider, never in plain text);
• Business details: business name, type, logo, brand colours, and, if you use the location picker, the address you enter;
• Billing details: Stripe customer and subscription identifiers, plan tier, and payment status — Stripe holds your card details directly, we never see or store them;
• Staff details: names and a hashed PIN for anyone you grant stamper access to;
• Support correspondence you send us.

From Members (collected through your Merchant's enrollment page)

• Name, and email address where the Merchant's enrollment flow collects one;
• A wallet pass serial number and, depending on platform, an Apple device push token or Google Wallet object identifier — used only to deliver pass updates and push notifications;
• Loyalty activity: stamp counts, visit timestamps, tier, and reward redemptions recorded by the Merchant's staff.

We don't collect a Member's precise real-time location. Where a Merchant configures a location-based notification, the geofence coordinates are set on the pass and evaluated by Apple's or Google's wallet software on the Member's own device.

From waitlist subscribers

• Email address, and which part of the site the signup came from.

Collected automatically

• Standard server logs (IP address, browser/device type, timestamps) kept for security, fraud prevention, and diagnosing faults;
• Authentication cookies set by our login system so you can stay signed in — see Section 6.

2. How we use it

• To provide the service: running the loyalty program, recording stamps and rewards, generating and updating wallet passes, and sending the push notifications a Merchant sends to their own Members;
• To bill Merchant subscriptions via Stripe and manage plan limits;
• To operate Merchant-facing analytics (visit counts, member growth, and similar aggregate figures shown on a Merchant's own dashboard);
• To prevent fraud and abuse (for example, rate-limiting stamper access);
• To respond to support requests and send service-related emails (verification, billing, account notices);
• To meet legal obligations.

We don't sell personal information, and we don't use Member or Merchant data for third-party advertising.

3. Our role for Member data

For a Member's information, the Merchant who runs that loyalty program is the one who decides what's collected and why — Form44 acts as their service provider, processing that data to operate the program on their instructions. If you're a Member and want to access, correct, or delete your information, the fastest path is to contact the business whose loyalty card you hold; we'll also action a direct request from you where we're able to verify it, and will refer you to the relevant Merchant where they hold the primary relationship.

4. Who we share information with

We use a small number of service providers (“sub-processors”) to run Form44, each of which only receives what it needs to perform its function:

• Stripe — payment processing and subscription billing;
• Supabase — database hosting, authentication, and file storage;
• Vercel — application hosting;
• Resend — transactional email delivery (verification, billing, and notice emails);
• Apple Inc. — Apple Wallet pass generation and push updates via Apple Push Notification service, for Members on iPhone;
• Google LLC — Google Wallet API for Members on Android, and the Maps Platform for the Merchant address/location picker.

We may also disclose information where required by law, to enforce our Terms, or in connection with a merger, acquisition, or sale of assets (with notice to affected account holders where practical).

5. International data transfers

Some of the providers above process or store data on servers located outside Australia. Where this happens, we rely on the provider's own security and contractual commitments, and take reasonable steps consistent with Australian Privacy Principle 8 before information is disclosed overseas.

6. Cookies

We use strictly necessary cookies set by our authentication provider to keep Merchant dashboard sessions signed in. We don't currently use advertising or third-party analytics cookies. If that changes, we'll update this section and, where required, ask for consent.

7. Retention

We keep Merchant account data for as long as the account is active and for a reasonable period afterwards to meet accounting, tax, and legal obligations. We keep Member data for as long as the Merchant's program and that Member's pass remain active; if a Merchant deletes their account, associated Member data is deleted or de-identified within a reasonable period. Waitlist emails are kept until launch outreach is complete or you unsubscribe, whichever is sooner.

8. Security

We use industry-standard measures to protect information, including encryption in transit, hashed passwords and staff PINs, and database-level access controls that keep each Merchant's data isolated from every other Merchant's. No system is perfectly secure, and we can't guarantee absolute security.

9. Your rights

You can ask us to access, correct, or delete personal information we hold about you, or ask how we've handled it, by emailing hello@form44.app. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. If you're outside Australia

Form44 is operated from Victoria, Australia, and our services are currently directed at Australian businesses. If you use Form44 from another country, your information is transferred to and processed in Australia and by the providers listed in Section 4, under this policy. Where the law of your country (for example, the EU/UK GDPR or a US state privacy law) gives you additional rights over your personal information — such as access, correction, deletion, portability, or objection to processing — we'll honour those rights on a verified request to the contact address below, and you retain any right to complain to your local data protection authority.

11. Children

Form44 is a business tool and is not directed at children. We don't knowingly collect personal information from anyone under 16 beyond what a Merchant's own loyalty card enrollment might incidentally include (such as a first name), and we'll delete such information on request.

12. Changes to this policy

We'll update the effective date above when this policy changes and, for material changes, take reasonable steps to notify Merchant account holders.

Contact

hello@form44.app — see also our Terms of Service.