Privacy Policy

This is a draft prepared for review. It must be checked against Stampora’s actual legal entity, registered address, operating jurisdiction, tax registration and fulfilment practices by a qualified lawyer before the store accepts real orders.

Stampora prints stamps from photographs you send us. That means we handle personal information and personal images. This policy explains what we collect, why we hold it, who else sees it and what you can ask us to do about it.

Last updated: this draft carries no effective date until legal review is complete.

1. Who is responsible for your data

The data controller for this store is [COMPANY LEGAL NAME], company number [COMPANY NUMBER], registered at [REGISTERED ADDRESS]. In this policy “Stampora”, “we” and “us” mean that entity. “You” means anyone who visits stampora.com, places an order, uploads a photograph, subscribes to email or contacts support.

For privacy questions, requests and complaints, write to support@stampora.us or call [SUPPORT PHONE]. A data protection officer has not been appointed at the time of this draft. Whether one is required depends on the final structure and volume of processing and should be confirmed during legal review.

2. What this policy covers

This policy covers the Stampora website, the stamps builder, the checkout, order fulfilment, customer support and our marketing. It does not cover third party websites you reach from links here. Those sites publish their own policies and you should read them.

3. The information we collect

3.1 Information you give us

• Identity and contact details. Name, email address, delivery address, billing address, phone number if you supply one.
• Account details. Username, hashed password, saved addresses, order history, saved designs and wishlists if you create an account.
• Order content. The photographs you upload, plus the names, numbers, positions, team names, dates, statistics and messages you type onto a stamp or a gift note.
• Payment details. Handled by our payment providers. We receive a confirmation, a payment reference, the stamps brand and the last four digits. We do not receive or store your full card number.
• Support correspondence. Emails, contact form messages, attachments and any images you send to show a print problem.
• Permission evidence. If you tell us you hold a licence or written permission to use a logo, mark or likeness, we keep the document or statement you send.

3.2 Information we collect automatically

• Device and connection data. IP address, browser type and version, operating system, screen size, language, referring URL.
• Usage data. Pages viewed, products viewed, builder steps completed, add to cart and checkout events, time on page, scroll depth, clicks.
• Session recordings and heatmaps. Microsoft Clarity records a reconstruction of how visitors move through pages so we can find broken steps in the builder and the checkout.
• Cookies and similar technologies. Set out in our Cookie Policy.

3.3 Information from other sources

Our payment providers send us fraud and chargeback signals. Advertising platforms send us aggregated campaign reporting. Shipping carriers send us tracking and delivery status. Where you reach us through a partner link, we may receive a referral identifier.

4. Photographs and other order details

order details are the most sensitive thing we hold, so we treat them separately.

• We use your image only to design, proof, print and reprint the item you ordered, and to resolve any dispute about that item.
• We do not sell images. We do not license them. We do not use them in advertising, on the website, on social media or in any sample without asking you first and getting a clear yes in writing. Consent given for marketing can be withdrawn at any time.
• Images pass to the print supplier that produces your stamp. They act on our written instructions and may not reuse the file.
• Images of children are handled only on the instruction of the parent or guardian placing the order. Do not place an order of a child you are not responsible for.
• A photograph can reveal health, racial or ethnic origin, or religious belief. Where a jurisdiction treats such an image as a special category of data or as biometric data, we rely on your explicit consent, given when you upload the file, and on the necessity of processing to supply the personalised item you bought.
• We do not run facial recognition, biometric matching, age estimation or emotion analysis on your images.

5. Why we use your data and our lawful bases

Where we rely on legitimate interests, we have weighed those interests against your rights and recorded the assessment. You can ask us for a summary of any assessment at support@stampora.us.

6. Cookies, analytics and advertising technology

We use cookies, pixels, local storage and software development kits. Non essential technologies load only after you accept them in the consent banner, and you can change your choice at any time. The full inventory, including provider, purpose and stated duration, is in the Cookie Policy.

Google Analytics 4, Google Ads, Meta, TikTok and Microsoft Clarity all receive data about your visit when you consent. Advertising platforms may combine that data with information they already hold about you, and they act as independent controllers or joint controllers for parts of that processing. Their own policies govern what they do next.

7. Who we share data with

We share personal data only with the categories of recipient below, and only with what each one needs.

If Stampora is sold or merged, records may transfer to the buyer under confidentiality terms, and you will be told before any change of controller takes effect. The specific vendor list above is provisional, pending supplier confirmation, and must be reconciled with the signed contracts before launch.

8. International transfers

Stampora sells internationally and several providers named above operate outside the United Kingdom and the European Economic Area, including in the United States. Where we move personal data out of the UK or the EEA, we rely on one of the following: an adequacy decision covering the destination, the UK International Data Transfer Agreement or the UK Addendum, the European Commission Standard Contractual Clauses, or your explicit consent for a specific transfer. We carry out a transfer risk assessment where one is required. You can request a copy of the safeguards used for a named provider by emailing support@stampora.us.

9. How long we keep things

Backups roll off on their own schedule, so a deleted item can persist in an encrypted backup for a short period after deletion from live systems.

10. Security

We use encryption in transit, access controls, role based permissions on the store, logging, and contracts that require the same of our processors. Uploaded files are stored in access controlled locations and shared with the print supplier through authenticated channels. No system is perfect. If a breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where the risk is high, we will notify you.

11. Your rights in the UK and the EEA

• Access. Ask for a copy of the personal data we hold about you, including your order details.
• Rectification. Ask us to correct data that is wrong or incomplete.
• Erasure. Ask us to delete data where we no longer need it, or where you withdraw the consent we relied on.
• Restriction. Ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
• Portability. Ask for the data you gave us in a structured, machine readable format, or ask us to send it to another provider where that is technically feasible.
• Objection. Object to processing based on legitimate interests, and object at any time to direct marketing.
• Withdraw consent. Withdraw consent for cookies, advertising or image processing without affecting what was lawful before you withdrew it.
• Complain. Complain to your national supervisory authority. In the United Kingdom that is the Information Commissioner’s Office.

Send requests to support@stampora.us. We answer within one month and can extend by two further months for complex requests, telling you if we do. We may ask for proof of identity before releasing data. We do not charge, unless a request is manifestly unfounded or excessive.

Note one limit. Once production on a personalised item has started, deleting the image will not stop or reverse the print run, because the file has already passed to the supplier for manufacture.

12. Your rights in California and other US states

If you live in California, the CCPA as amended by the CPRA gives you the rights below. Comparable rights apply in Colorado, Connecticut, Virginia, Utah, Texas and a growing list of other states, and we apply this section to residents of those states as well.

• Right to know. Request the categories and specific pieces of personal information we collected, the sources, the business purpose and the categories of recipient, covering the preceding 12 months and, on request, beyond that period where it is not impossible or disproportionate to provide.
• Right to delete. Request deletion, subject to the exceptions in the statute, including records we must keep for tax and legal reasons.
• Right to correct. Request correction of inaccurate personal information.
• Right to opt out of sale or sharing. We do not sell personal information for money. When advertising and analytics tags are active, some identifiers are shared with Google, Meta and TikTok for cross context behavioural advertising, which counts as sharing under the CPRA. Turn this off through the consent banner, through the “Do Not Sell or Share My Personal Information” control in the site footer, or by sending a Global Privacy Control signal from your browser, which we honour as a valid opt out.
• Right to limit use of sensitive personal information. Where an order details is treated as sensitive personal information, we use it only to supply the goods you ordered, which is a permitted purpose. We do not use it to infer characteristics about you.
• Right to non discrimination. Exercising any of these rights will not change your prices, your discounts or the service you receive.

Submit a request by emailing support@stampora.us or calling [SUPPORT PHONE]. We confirm receipt within 10 business days and respond within 45 calendar days, extendable once by a further 45 days with notice. An authorised agent may submit a request with written permission from you, and we may still ask you to verify your identity directly.

Categories of personal information collected in the last 12 months, using the statutory labels, are identifiers, customer records, commercial information, internet and network activity, approximate geolocation from IP address, visual information in the form of order details, and inferences drawn for advertising audiences.

13. Children

Stampora is sold to adults. The store is not directed at children and we do not knowingly let anyone under 16 open an account or place an order. stamps are often made of children, and that is fine, but the parent or guardian must be the one who uploads the photograph, approves the design and pays. If you believe a child has given us personal data directly, write to support@stampora.us and we will delete it.

14. Marketing preferences

You can unsubscribe from any marketing email using the link in the footer of the message, or by writing to support. Order confirmations, dispatch notices and messages about a problem with your order are service messages and continue even if you opt out of marketing.

15. Automated decisions and profiling

We do not make decisions about you by automated means alone that produce legal effects or similarly significant effects. Fraud tools used by our payment providers may flag a transaction for review, and a person then decides. Advertising platforms build audiences from the identifiers described above, which is profiling for marketing purposes, and you can stop it by withdrawing consent.

16. Changes to this policy

We will update this policy when our processing changes, when a new provider is added or when the law moves. The current version always sits on this page. Where a change materially affects your rights, we will tell account holders by email before it takes effect.

17. Contact

[COMPANY LEGAL NAME], [REGISTERED ADDRESS], company number [COMPANY NUMBER]. Email support@stampora.us. Phone [SUPPORT PHONE]. An EU or UK representative under Article 27 has not yet been appointed, and whether one is needed depends on where the final entity is established. Confirm this in legal review.

Clear on how your photograph is handled? Start your stamp whenever you are ready.

Create your stamp Ask a privacy question