CITYSTACK PRIVACY POLICY
Last updated: 09/10/26
1. Who we are
CityStack is operated by Citystack Ltd, a company registered in England and Wales. In this policy, “CityStack”, “we”, “us” and “our” mean Citystack Ltd. Our registered office is 124 City Road, London, England, EC1V 2NX. For privacy enquiries, contact support@citystack.co.
This policy applies to the following connected CityStack services: citystack.co, our public website; shop.citystack.co, our online shop; and app.citystack.co, our web app. It explains what information we use when you browse the public website, contact us, buy products through the online shop, create or use a web-app account, activate a Collection or redeem a Discount.
2. Information we collect
On citystack.co, our public website, we may collect your first name, last name and email address when you subscribe to our newsletter or use our contact form. We may also collect information you provide about whether you own a CityStack Pack and which type.
On shop.citystack.co, our online shop, we may collect your first name, last name, email address, delivery address, billing address, products and orders, payment status and other information needed to fulfil or support an order.
For physical-product orders, we share the name, delivery address, order details and other information needed for fulfilment and shipping with Hutch Logistics and relevant delivery providers.
On app.citystack.co, our web app, we collect your sign-up email address and authentication information. You may also provide an optional first name, last name, date of birth and separate communications email, together with your marketing preferences.
On app.citystack.co, we collect information about Top-Ups, Collections, activation, redemption venue, date, time and method. You may also choose to enter journal information, including spending, numbers of pints and meals, ratings, prior visits, notes and visit photos.
Across the services, we may collect emails or web-app chat messages you send us, including any photos you attach to chat messages; browser or device information, IP addresses, identifiers, page views, web-app activity and information obtained through analytics technologies.
Your date of birth is an optional profile field and is not used to verify your age. If you supply it, we may use it to personalise CityStack or, where permitted and consistent with your marketing choices, for birthday-related promotions. If you do not supply information needed for an order or account, we may be unable to provide the relevant service.
3. How we use information
We use information collected through the public website, online shop and web app to provide the service you request, including managing accounts, processing orders and payments, delivering products, activating Collections and recording and administering Discount redemptions. Our lawful basis is performance of our contract with you.
We use information to meet legal obligations such as accounting and tax record-keeping.
We use information to answer enquiries, operate and improve our services, investigate errors, maintain security, prevent fraud and misuse, and handle disputes. Our lawful basis is our legitimate interests, or performance of our contract where the activity is necessary to provide what you requested.
We use contact details to send promotional communications where you have subscribed or another legal permission applies. We send essential service messages, such as order confirmations, verification messages and password resets, separately from marketing. Rules for cookies and similar technologies apply independently of these UK GDPR lawful bases.
4. Orders, payments and marketing
The online shop at shop.citystack.co is operated using Shopify. App Top-Ups purchased through app.citystack.co are associated with the web-app account used to buy them. Payments are processed using Stripe. CityStack does not store full payment-card numbers; we may receive payment status, amount, payment references and limited information needed to administer a transaction.
Where you choose to save a payment method for later use, the payment provider manages the saved payment method under its own terms and privacy information.
We currently use Mailchimp for newsletters and use HubSpot to manage contact and customer-relationship records. You can unsubscribe from promotional emails using the link in the email or by contacting support@citystack.co. We may retain a limited suppression record so that we honour an unsubscribe request. We will update this policy as appropriate if our marketing providers change.
5. Web-app location, visits and redemptions
If you allow location access, app.citystack.co, our web app, uses your device’s precise location while relevant web-app screens are open to show you on the map, sort or display nearby pubs, check whether you are near a Partner Venue and identify a pub when you open the Redeem screen. It does not access location while the web app is closed or in the background. If you decline location access, you can search for and select a pub manually.
Distance calculations take place on your device. We do not store your latitude and longitude. For some pub-page views and location checks, we record the pub and screen concerned, time and date, whether location access was allowed, rounded distance to the pub, reported location accuracy and whether you were nearby. Events may include your account email, if signed in, or a browser identifier. A nearby-visit event is recorded when the web app determines you are within approximately 50 metres of a pub. These records can reveal information about where you were even without coordinates.
On redemption, we record the relevant Collection, venue, time and date, and whether the redemption was completed using NFC or manually. Partner Venue staff see the redemption display on your device; that display does not provide them with your email, activation code or location records.
Optional journal entries and photos are linked to your account. Our administrative dashboard reports account, order, web-app activity, page views, location checks, visits, redemptions and journal information. Underlying records are not necessarily anonymous.
The web app uses Google Maps to show maps. Although our web app does not deliberately send precise device coordinates to Google Analytics, loading or centring a Google map may disclose information to Google; Google’s own privacy information applies.
6. Cookies and browser storage
Our websites, online shop and web app use cookies and similar storage to provide essential functions, including security, shopping and account access, and also use technologies for analytics and marketing.
The web app stores your sign-in session in browser local storage rather than a login cookie. It uses a short-lived access token renewed by a refresh token. Your sign-in normally remains active until you sign out, clear browser storage, change your password or the session is revoked. The web app’s sign-out currently signs you out on that device; it does not offer a “log out of all devices” control.
We use Google Analytics 4, Microsoft Clarity and Meta technologies, Wix and Shopify tools, and our own web-app analytics dashboard to understand use, improve services and measure campaigns. These technologies can collect pages viewed, interactions, device or browser information and identifiers.
We do not currently provide a cookie banner or cookie preference controls. You can block or remove some technologies through your browser or device settings, although this may affect functionality. Browser settings are not a substitute for consent or other controls where the law requires them. We are reviewing our use of analytics and advertising technologies and the controls required for them.
7. Sharing and providers
Depending on how you use CityStack, information may be processed by Wix for citystack.co, Shopify for shop.citystack.co, Stripe for payments, Hutch Logistics for order fulfilment and shipping, Lovable and Lovable Cloud for web-app hosting and managed database, authentication, email and storage powered in part by Supabase, Mailchimp for newsletters, HubSpot for contact records, Make.com for automations, and Google, Microsoft and Meta for maps, analytics or marketing. We may also use delivery, professional-advice and security providers where needed.
A provider may process information on our behalf or, depending on its role, for purposes explained in its own privacy information. We may disclose information where required by law or reasonably needed to investigate misuse, resolve disputes or protect legal rights. We do not sell your personal information.
8. International processing and security
Some providers may process or access information outside the UK. Where Citystack Ltd makes an international transfer for which safeguards are legally required, we use an applicable transfer mechanism or safeguard. Contact us for more information about a transfer relevant to your data.
We use technical and organisational measures intended to protect personal information, although no online service can guarantee absolute security. Contact support@citystack.co if you believe your account or activation code is compromised.
9. Retention and account deletion
We keep personal information for as long as it is needed for the purposes described here. The period depends on the information, the status of your account and Collections, and our legal, accounting, security, fraud-prevention and dispute-resolution needs.
We keep account, Collection, activation and redemption information while needed to provide the account, honour active entitlements, show your history, prevent duplicate redemptions and address enquiries or disputes. Current Collections have no expiry date. We keep order and payment-related records where needed for fulfilment, refunds, accounting, tax and legal claims; and journal entries and photos while needed to provide the account and journal, subject to applicable deletion rights.
We keep support information as needed to resolve enquiries and related issues. We keep marketing subscription records while needed for marketing and may retain limited suppression records after an unsubscribe.
We keep identifiable page-view, location-check and nearby-visit analytics events only for as long as reasonably necessary for the purposes described above, including operating and assessing the web app, investigating technical issues, preventing misuse and maintaining relevant service records. We are reviewing the appropriate retention periods for these event records and will delete or anonymise them when they are no longer necessary.
You can request closure and deletion of your web-app account by emailing support@citystack.co. We will assess and action your request under applicable law. We may need to retain limited records after closure for legal obligations, active entitlements, fraud prevention, disputes or legal claims.
10. Your rights and changes
Depending on the circumstances, you may have rights to access, correct or delete your personal information; restrict or object to processing; and receive certain information in a portable format. Where we rely on your consent, you may withdraw it. You may object to direct marketing at any time.
To exercise a right or ask a question, contact support@citystack.co. We may need to verify your identity. You can complain to the UK Information Commissioner’s Office if you are dissatisfied with our handling of your personal information.
CityStack is not intended for under-18s to purchase or use where that is prohibited by our Terms or applicable law. The optional date-of-birth field does not verify age.
We may update this policy when our services or practices change. We will publish the updated policy on our sites and change the last-updated date. Where legally required, we will provide additional notice.