Data Retention Policy
Last updated: 1st June 2026
Stamplo keeps data only for as long as it's genuinely needed. The table below explains what we keep, how long we keep it, and why — in plain language.
You can delete your account and all associated data at any time from your dashboard. If you have any questions, contact us at support@stamplo.kids.
| Data | Kept for | Why | How it's deleted |
|---|---|---|---|
| Parent account | Until you delete it | Running your account and pen pal service | Within 30 days of deletion request |
| Child profiles | While your parent account is active | Running the pen pal service for your child | Deleted when parent account is deleted |
| Letters and images (approved and delivered) | 12 months from the date written | Pen pal service delivery and parental review | Automatically deleted after 12 months. We notify you 30 days before so you can save anything you'd like to keep. |
| Letters awaiting approval (never approved) | 90 days | Data minimisation — letters that were never reviewed or delivered serve no ongoing purpose | Final warning sent at day 60 with the specific cancellation date. Automatically cancelled at 90 days if still unapproved. The sending family is notified. |
| Pending pen pal requests | 14 days if unanswered | Platform integrity and child experience | Automatically withdrawn after 14 days. Both families are notified. |
| Email-unverified accounts | 14 days | Data minimisation — accounts that were never confirmed | Reminder emails sent at day 3 and day 7. Account deleted at day 14 if not verified. |
| Identity-unverified accounts (dormant) | 90 days | Data minimisation — accounts where verification was never completed and no letters were exchanged | Warning emails at day 60 and day 75. Account deleted after day 90. |
| Identity verification records | 12 months after account deletion | Fraud prevention and safeguarding audit | Stamplo's verification record (status and timestamps only — never documents) is automatically deleted 12 months after the verification was completed. The underlying ID documents and liveness captures are deleted from our verification provider once verification completes — immediately when approved, within 7 days otherwise — and permanently erased by the provider within 30 days of that deletion. |
| Login sessions | 30 days after expiry (parents) · 7 days (children) | Security | Automatically expired and cleared |
| Audit and safety records | As long as necessary | Safeguarding and regulatory accountability | Reviewed annually. Personal identifiers are removed when the related account is deleted; IP addresses are automatically removed from audit records after 12 months; event records are retained for safeguarding purposes. |
| Billing and subscription data | Until account deletion | Processing subscription payments and managing billing history | Stripe customer record and all associated subscription data deleted when your account is deleted. Stripe may retain transaction records for its own legal obligations independently of Stamplo. |
| Infrastructure backups | Up to 30 days after deletion | Disaster recovery | Removed automatically as backup rotation cycles complete. |
| Anonymous activity statistics | Permanently | Measuring how the service is used over time | These records hold only the type of activity event — for example, that a letter was written or delivered, or that a family joined — and the date it happened. They contain no names, no account or message identifiers, and no letter content, and they cannot be linked back to any person. Because they hold no personal data, they are retained permanently and are not removed when an account is deleted. |
Changes to This Policy
We will update this page if retention periods change. Material changes will be communicated to registered families by email before they take effect.
Questions
Contact us at support@stamplo.kids or view our full Privacy Policy.