← Back

Privacy Policy

Last updated: 16 September 2026

This Privacy Policy explains how PayStamp ("we", "us", "the Service"), operated by Antonis Christodoulou, Cyprus ("the Operator"), handles personal data when a lesson-based business (a "Business" — for example a swimming school, music school or sports club) uses PayStamp to manage student payment records.

PayStamp is a tool that Businesses use to track which of their students have paid for lessons. The Business that you are a customer of is the Data Controller of your personal data. PayStamp acts as a Data Processor, storing and processing that data on the Business's behalf and under its instructions.

If you are a parent or student and have questions about your data, the first point of contact is the Business you deal with directly (for example, your child's swimming school).

1. What data we process

Depending on what the Business enters, PayStamp may store:

  • Student name (and, where the Business records it, a parent or guardian name)
  • The lessons or programme the student is enrolled in
  • Enrolment start month and any paused months
  • Payment records (which months the Business owner has confirmed as paid, and the amount)
  • Where a Business publishes a link for paying it online, a note that a parent has said they paid — the amount, the date, and any reference they chose to give
  • A contact identifier for sending receipts (for example a phone number used for a WhatsApp or Viber message), where the Business chooses to use this feature
  • Language preference (English or Greek)

PayStamp does not process payment card data or bank details, and never holds or transfers money.

Payment reaches the Business directly — in cash, or through a payment page the Business itself publishes (for example Revolut, Viva, or its own bank). Where such a link is used, the parent leaves PayStamp entirely and the payment happens on that provider's page under that provider's terms. PayStamp records only that the Business has confirmed a payment was received.

2. Why we process it (legal basis)

The data is processed so that the Business can run its service — keeping track of enrolment and payments, and optionally sending payment receipts. The legal basis is the performance of the contract between the Business and its customers, and the legitimate interests of the Business in administering its lessons (Article 6(1)(b) and 6(1)(f) GDPR). The Operator processes this data only on the Business's instructions as a processor.

3. Where data is stored

Data is stored in a database hosted in the European Union (Frankfurt, Germany) by our infrastructure provider, Supabase. Data is transmitted over encrypted connections (HTTPS/TLS). Access to records is restricted so that each Business can only see its own students' data.

4. Who can see the data

  • The Business owner and any staff they authorise.
  • Where a parent portal is used, a parent can see the records relating to their own children.
  • The Operator, only where strictly necessary to maintain, support or secure the Service.
  • Our hosting sub-processor (Supabase), which stores the data on our behalf within the EU.

We do not sell personal data and we do not share it for advertising.

5. How long we keep it

Data is retained for as long as the Business keeps its account active and needs the records for administering its lessons. When a Business deletes a student record, or closes its account, the associated data is deleted within 30 days, including from any backup copies, unless we are required by law to keep it. A Business can request deletion of its data at any time.

6. Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability. Because the Business is the Data Controller, please direct these requests to the Business you deal with. If you contact the Operator directly, we will pass the request to the relevant Business and assist them in responding.

You also have the right to lodge a complaint with the Cyprus data protection authority, the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy).

7. Security

We apply appropriate technical and organisational measures to protect the data, including encrypted connections, access controls that isolate each Business's data, restricted administrative access to the underlying database, EU-based hosting, and regular review of our access rules and security configuration. No system connected to the internet can be guaranteed to be completely secure, but we work to keep the risk low and to respond promptly to any issue.

8. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top shows when it was last changed.

9. Contact

For questions about this policy or about how PayStamp handles data, contact: paystampapp@gmail.com

Privacy Policy · Terms of Service