Privacy policy

Last updated 13 October 2026

This explains what personal information SheffPoints collects, why we collect it, who sees it and what you can do about it. SheffPoints is run by TapMate Ltd (“we”, “us”), a company registered in England and Wales, company number 16353666, registered office 18 Gaunt Drive, Bramley, Rotherham, S66 3YJ. We run the SheffPoints loyalty network at sheffpoints.com and are responsible for your information. You can reach us any time through our contact page.

What we collect

If you join as a customer

Your name, email address and password. Your password is stored scrambled, so nobody — including us — can read it.
Your mobile number and home area, if you choose to add them.
Whether you want emails about new rewards near you.
Your points activity: points you earn (where and when), rewards you claim, rewards you save as favourites, and taps on SheffPoints tags.

If you join as a business

Your business name, your name, email address, password (stored scrambled) and the Sheffield area you're in.
The bank account you want to be paid into. We store the sort code and account number encrypted and only use them to pay you.
The rewards you offer, points you give out, rewards claimed with you and payments we make to you.

If you apply or ask us to get in touch

The details you put in the form, such as your name, business details, address, email or phone number and message.

When you use the website

Your IP address and basic details about your browser, which our hosting provider records in its logs and which we use briefly to stop misuse, such as repeated log-in attempts.

How we use it

To run your account — adding and spending points, showing you rewards and your history. We need this to provide SheffPoints to you.
To show businesses activity with them — a business sees a shortened version of your name (for example “J. Smith”) and the points you earned or spent with them, and when. They don't see your other activity.
To pay businesses for rewards claimed and keep the accounting records the law requires.
To keep SheffPoints safe — spotting fake accounts and misuse, such as copied tag links. This is in our legitimate interests and yours.
To reply to applications and enquiries — in our legitimate interests, and to take steps before working with you.
To email you about new rewards — only if you've asked us to. You can turn this off at any time in your profile.

We don't sell your information, and we don't use advertising or tracking cookies.

Who we share it with

The businesses where you earn or spend points, as described above.
The companies that run SheffPoints' technology for us: Vercel (website hosting), Neon (database), GitHub (encrypted nightly backups of the database, kept for 14 days) and Resend (email). They only use your information to provide their service to us.
Anyone we're required to share it with by law.

Some of these companies store or process information outside the UK, including in the United States. Where they do, we rely on the protections UK data protection law requires for international transfers.

Cookies

We use one cookie, to keep you logged in. It's essential for the site to work, so we don't ask for consent for it. Your browser also remembers a few small things on your device, like whether you've closed the guided tour. We don't use analytics or advertising cookies.

How long we keep it

Account details and points activity: while your account is open.
If you close your account, we delete or anonymise your personal details within 30 days, except records we have to keep for accounting (such as rewards we paid businesses for), which we keep for up to six years.
Applications and enquiries: up to two years, unless you go on to join SheffPoints.

Your rights

You can ask us for a copy of your information, to correct it, to delete it, to limit or object to how we use it, or to send it to you in a format you can take elsewhere. If you've given consent (for reward emails), you can withdraw it at any time. To do any of this, get in touch. We'll reply within one month. You can close your account yourself at any time from your profile.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put it right first.

Changes

If we change this policy we'll update this page and the date at the top. If a change is significant, we'll let you know before it takes effect.