VoucherPage · TIDYROX S.R.L.

Privacy

TIDYROX S.R.L. is the controller for VoucherPage account data. The contact is office@tidyrox.com. We do not ask for a phone number.

If you create a page, we store your email, a PBKDF2 hash of your password, the business name, logo URL, colour, currency, voucher amounts, terms, a hash of the staff PIN, and the Stripe restricted key encrypted with AES-GCM. We store voucher codes, amounts, remaining balances, whether a voucher was complimentary, the Stripe checkout session id, and redemption amounts.

We use that data to run the page: sign you in, show the vouchers, confirm a payment with Stripe, and let staff redeem. The session cookie is an httpOnly cookie. A second cookie is set after a correct staff PIN. We do not sell personal data.

The card payment is processed by Stripe on the business's own Stripe account. We send the checkout session id to Stripe with the business's restricted key, and we read back whether it was paid, the amount, the currency, and which Payment Link it belongs to. Stripe's own privacy notice covers the card data.

The public demo asks for a card number only to check that it is Stripe's test card 4242. The number is not stored and no payment is made.

Voucher codes are unguessable. The public check page shows the business name, the original amount, and the remaining balance for that code.

You can ask for a copy of your account data, or for it to be deleted, by writing to office@tidyrox.com. Deleting the account removes the page. Voucher records already issued may be kept if a customer still needs to redeem them, unless you ask us to remove those too.

We keep the account for as long as the page exists. Server logs may keep a request path for a short time. They are not used for advertising.