Last updated: 31st March 2026
Stamplo Limited uses a small number of carefully selected third-party service providers (“sub-processors”) to operate its platform. Each sub-processor operates under GDPR-compliant data processing terms, including Data Processing Agreements (DPAs) where applicable, and handles personal data only as instructed by Stamplo, in accordance with UK GDPR.
The majority of sub-processors are based in the UK or EU. Where data is transferred outside the UK or EU (currently only to Stripe, Inc. in the United States for payment processing), appropriate safeguards are in place as described in the International Transfers section below.
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Neon, Inc. (PostgreSQL database hosting) | Primary database — stores all account, letter, and relationship data | All platform data (encrypted at rest) | London, UK |
| Vercel, Inc. (Application hosting & scheduled jobs) | Hosts the Stamplo web application and runs scheduled background tasks (cron jobs) | Request data, IP addresses, application logs | London, UK |
| Supabase, Inc. (File storage) | Stores encrypted letter images uploaded by children | Encrypted image files (AES-256-GCM); no plaintext content stored | London, UK |
| Resend, Inc. (Transactional email) | Delivers transactional emails (account verification, letter notifications, parental approvals, and order confirmations) | Email addresses, names, notification content | Ireland, EU |
| Upstash, Inc. (Redis — rate limiting) | Provides in-memory rate limiting to protect the platform from abuse | IP addresses and request counters (no personal content) | London, UK |
| Didit Ltd (Identity verification) | Performs age and identity verification for parent or legal guardian accounts before children can access cross-family features | Government-issued ID and liveness data (processed by Didit only; Stamplo receives verification status only) | Spain, EU |
| Stripe, Inc. (Payment processing — World Map product) | Processes payments and collects shipping address for Stamplo World Map orders. No Stamplo account is required to purchase. | Name, email address, shipping address, payment card details | United States — see International Transfers below |
| Gelato AS (Print-on-demand fulfilment — World Map product) | Prints and dispatches the Stamplo World Map poster to the customer's shipping address | Name, shipping address, email address | Norway, EEA — see International Transfers below |
Gelato AS (Norway): Norway is a member of the European Economic Area (EEA). The UK Government has granted an adequacy decision for EEA countries, meaning transfers to Gelato are treated as equivalent to transfers within the UK. No Standard Contractual Clauses are required.
Stripe, Inc. (United States): Stripe is certified under the EU-US Data Privacy Framework and offers a UK GDPR Addendum to its Data Processing Agreement. Transfers of personal data to Stripe are protected by Standard Contractual Clauses incorporated into Stripe's DPA and by Stripe's UK GDPR Addendum. Stripe processes only the data necessary to complete and confirm a payment transaction; no Stamplo account data is involved.
We will update this page whenever we add, remove, or change a sub-processor. Material changes that affect how personal data is handled will be communicated to users in advance where required under UK GDPR.
If you have any questions about our sub-processors or data processing arrangements, please contact us at support@stamplo.kids.