Your customers’ data,
handled like it matters.
Punchd holds the loyalty relationship between you and your customers. We treat that data as yours, kept in India, encrypted, access- controlled, and exportable whenever you want it. Here’s exactly how, and exactly who we rely on to run the service.
How we protect it
Data residency in India
Your data lives on infrastructure in the Mumbai region, Neon Postgres, deployed via Vercel. It does not leave India in normal operation.
Encryption in transit & at rest
All traffic is TLS-encrypted. Sensitive credentials (like POS access tokens) are encrypted at rest with AES-256-GCM before they touch the database.
Verified webhooks
Every incoming POS and payment webhook is verified with an HMAC signature and de-duplicated, so a replay or a forged request can't award points or change balances.
Role-based access control
Owners, managers and cashiers get exactly the access their role needs. Staff are invited, scoped, and removable, nobody shares a login.
Full audit trail
Every stamp, redemption, reversal and admin action is recorded and attributable to a specific staff member, with timestamps you can review.
Data ownership & export
Your customer list is yours. Export every customer and visit to CSV in one click, any time. Cancel and walk away with all of it.
Subprocessors
The third-party services Punchd uses to deliver the product. We share only the data each one needs to do its job, and we keep this list current. Questions? Email ops.punchd.cards@gmail.com.
| Provider | Purpose |
|---|---|
| Vercel | Application hosting & edge delivery |
| Neon | Primary Postgres database |
| Anthropic (Claude) | AI marketing campaign drafting |
| Razorpay | Subscription billing & GST invoicing |
| Apple (APNs) | Apple Wallet pass updates / push |
| Google Wallet API | Android wallet pass issuance & updates |
| Resend | Transactional email delivery |
| WhatsApp Business (Meta) | Business broadcast messaging |
| Inngest | Background jobs (reminders, triggers) |
| Sentry | Error monitoring & diagnostics |
| Vercel Blob | Logo & media storage |
| Google Maps Platform | Geofence address lookup |
Regions reflect where each provider primarily processes data and may use global edge networks for delivery. See our Privacy Policy for how data is handled end to end, including our DPDP responsibilities.
Built on serious rails.
Priced for the corner shop.
The same infrastructure a multi-outlet brand runs on, without the enterprise invoice. Go live the same day.
Start free