Legal

Privacy Policy

Effective date: April 26, 2026  ·  Tuff Ghost Media LLC

This Privacy Policy covers both getheadstash.com (brand inquiry site) and the Headstash consumer platform, both operated by Tuff Ghost Media LLC ("we," "us," or "our"). It explains how we collect, use, and protect information from brand partners and prospective partners who interact with our platform.

What we collect from brand partners

• Business contact information -- name, email address, and brand name submitted via inquiry forms.
• Campaign configuration -- reward thresholds, product details, and campaign settings you configure through the Headstash brand dashboard.
• Usage and access data -- IP address, browser type, and platform activity used to secure and operate your account.

What we collect from consumers (on your behalf)

When your brand campaign is active, Headstash collects consumer phone numbers, receipt images, and purchase data on your behalf. You, as the brand, are the data controller for your customer relationships. We process this data as your service provider under the terms of our brand agreement.

• Consumer data collected under your campaign is stored securely and accessible to your brand account only.
• You can export your full customer list at any time.
• Upon cancellation, you retain your data -- we do not delete it without your explicit instruction.

How we use brand partner data

• To onboard your brand and configure your loyalty campaign.
• To communicate with you about your account, billing, and platform updates.
• To send service-related emails via Resend.
• To improve the platform and develop new features.

Sub-processors

We use the following sub-processors to operate the Service: Supabase (database and auth), Resend (transactional email), Vercel (hosting and edge functions). All sub-processors are contractually bound to protect your data.

Data retention

Brand account data is retained for the duration of your account and for a reasonable period thereafter for legal and compliance purposes. You may request deletion by contacting us directly.

Your rights

You have the right to access, correct, or delete your personal data at any time. To exercise these rights, contact us at privacy@headstash.co.

Changes to this policy

We may update this policy periodically. Material changes will be communicated via email to your account address. Continued use of the platform constitutes acceptance.

Contact

Tuff Ghost Media LLC
privacy@headstash.co