Privacy Policy

1. Information We Collect

We collect the following types of information:

• Account Information: When a parent or legal guardian registers, we collect basic information such as name, email address, and the child's first name.
• Purchase Information: When purchasing a physical product (such as the Stamplo World Map), we collect the name, email address, and shipping address provided during checkout. This information is shared with our payment processor (Stripe) and fulfilment partner (Gelato) solely to process payment and dispatch the order. No Stamplo account is required to make a purchase.
• Subscription Billing Information: When you subscribe to Stamplo Premium, your name and email address are shared with our payment processor (Stripe) to create a billing account. Stripe processes your payment card details directly and issues us a customer reference and subscription status only. Stamplo does not store card numbers, expiry dates, or CVV codes. Subscription billing is a parent-only process — no child data is shared with Stripe for this purpose.
• Voluntary Contributions: Parents may choose to make a one-off or monthly contribution towards Stamplo's running costs. The payment is taken on a page hosted by our payment processor (Stripe), which collects your name, email address and payment card details directly. Contributions are not linked to your Stamplo account, Stamplo does not store card details, and no child data is shared with Stripe for this purpose. Making a contribution is entirely optional and does not change anything about your family's use of Stamplo.
• Verification Data: When a parent or legal guardian completes age and identity verification, our verification partner (currently Didit Ltd) processes limited information to confirm adult and parental status. Stamplo stores the verification status, a minimal encrypted record of the outcome (including a provider reference ID, mapped status, and timestamp), and attempt metadata such as IP address and a provider-supplied risk score where available — for fraud prevention and safeguarding audit purposes. Stamplo never receives or stores ID documents, photos, or biometric data.
• Pen Pal Information: When children add a pen pal, we collect and store the invite code and pen pal details (e.g., name, country).
• Communication Data: We store the content of letters sent between pen pals, including any media (like photos) attached to the letters. All letters are stored encrypted; status fields (e.g., flaggedByChild) are recorded to track child reporting. We also record whether writing-aid tools (such as idea prompts) were used when composing a letter, to help us improve those features.
• Preferences and Flags: Parent or legal guardian settings for features such as Friend Finder and image permissions, as well as any flag/reason provided when a child reports a letter.
• Manual Review: In rare cases where verification fails (for example, poor lighting, incorrect angle, or suspected under-age attempt), a Stamplo safeguarding officer may view the verification media (such as the liveness video or document image) directly within our verification provider's secure dashboard. We never download, store, or copy this material, and all access is logged for safety and accountability.

2. How We Use Your Information

• To Provide Our Service: Facilitating pen pal connections and letter exchanges.
• Child Reporting: Enabling children to flag letters that worry them; updating letter status and notifying parents or legal guardians via email with a secure review link.
• Escalation: If a parent or legal guardian escalates a flagged letter, we temporarily decrypt its content for our support team and send an email notification to support@stamplo.kids.
• Parent Supervision: Ensuring all letters are reviewed by parents or legal guardians before final delivery.
• Checking Pictures for Known Child Sexual Abuse Material: When a child adds a picture to a letter, we check it automatically, before it is stored, against lists of pictures already known to be child sexual abuse material. A code is calculated from the picture on our own server, and only that code is sent to Microsoft's PhotoDNA service, on its UK datacentre, for the check. The picture itself, the letter, and any details about the child or family are never sent, and we do not keep the code. Stamplo uses PhotoDNA technology licensed by Microsoft at no cost. If a picture matches, the letter is not delivered, and our safeguarding reviewer deals with it as section 5 explains. In that case only, we also keep the picture's original file as it was uploaded, including its metadata and file name, encrypted and never shown to anyone, because a report to the National Crime Agency must include it. Every other picture is stored only after its metadata is removed. If the check cannot be completed, the letter carries on as normal and is still reviewed by both parents.
• Order Fulfilment: When a physical product is purchased, we use the name, email address, and shipping address to process payment via Stripe and to instruct Gelato to print and dispatch the order. Purchase data is used solely for fulfilment and is not linked to any Stamplo account.
• Service Reminder Emails: We may send parents or legal guardians automated service emails to support their use of the platform — for example, reminders to approve a pending pen pal request or a letter awaiting review, a notification when a letter has been approved by both parents and is ready to read, reminders to log in for the first time, to add a child to their account, or to write a first letter to a matched pen pal. These emails are sent once per event and are not marketing communications. The one exception is the reminder to complete identity verification, which can be sent up to three times in a parent's first fortnight (around day 1, day 4 and day 10 after registration) and stops as soon as verification is complete, a check is declined, or the parent opts out. You can opt out of these reminders at any time via the unsubscribe link in any reminder email, or in your account settings. Security and safeguarding emails (such as password reset, letter flagging, and identity verification) are always delivered regardless of opt-out preference.
• Feedback Requests: Occasionally we may email parents or legal guardians to ask how Stamplo is working for their family, for example how they heard about it and what they would change. These emails only ask for feedback; they never promote anything or ask for payment, and they are not marketing communications. They are only sent to parents who have not opted out of reminder emails, each includes an unsubscribe link, and you can also simply reply asking us to stop. Replying is entirely optional, and we use replies only to improve the service.
• Testimonials: We only publish a parent's words on our website or elsewhere with their clear permission, and we credit them only in the way they agree to, such as a first name and country. We never publish anything that identifies a child. You can ask us to remove a testimonial at any time by emailing support@stamplo.kids.
• Subscription Billing: Processing and managing your Stamplo Premium subscription — including monthly payments, billing status updates, payment failure handling, and providing access to the Stripe Customer Portal for subscription management (cancellation, payment method updates).
• Voluntary Contributions: Processing one-off and monthly contributions you choose to make, sending you a receipt, and letting you change or cancel a monthly contribution through Stripe's customer portal. Stripe keeps payment records for as long as the law requires for accounting purposes.
• Improvements: Using aggregated, anonymised data to improve Stamplo's services and user experience.
• Safeguarding and Verification Review: When a verification attempt fails, we may conduct a manual safety review by viewing the verification media directly inside our verification provider's secure platform. This ensures only genuine adults create parent or legal guardian accounts. Stamplo does not store these images or videos; access is limited, audited, and used solely for safeguarding purposes. Separately, authorised Stamplo personnel may review the encrypted outcome records stored in Stamplo's own system (verification status, provider reference, risk score, and attempt timestamp) to investigate pending or failed cases — for example, to identify whether a case is in review with our provider. This access is logged in our internal audit trail.

3. Legal Basis for Data Processing

Under GDPR, we process personal data based on:

• Consent (e.g., account creation, communication, sponsored participation)
• Contractual Necessity (providing Stamplo's services, including processing and fulfilling product purchases)
• Legal Obligation (compliance with laws and regulations, for example reporting child sexual abuse content to the National Crime Agency, as the Online Safety Act 2023 requires)
• Legitimate Interest (e.g., identity verification to protect child safety, checking pictures against known child sexual abuse material to protect children, automated cleanup of unverified accounts)

When a reported letter contains sensitive information, or information about a possible crime, or a picture matches known child sexual abuse material, we rely on the conditions in the Data Protection Act 2018 for safeguarding children and for preventing or detecting crime. Our appropriate policy document explains how we handle that information and is available on request.

4. How We Protect Your Data

• Encryption: All personal information is encrypted during transmission and at rest.
• Access Control: Only authorised parents or legal guardians can manage their children's accounts, with double parental approval required for letter exchanges.
• Data Minimisation: We collect only the minimum information necessary to operate Stamplo.

5. Sharing Your Information

We do not sell, rent, or share your personal information except:

• Parents or Legal Guardians: The responsible adult managing a child's account can review letter content in order to approve incoming and outgoing communication. This parental supervision is a core safety feature of the service.
• Safeguarding Review: When a child reports a letter, or a parent flags or escalates one, Stamplo's safeguarding reviewer reads it to decide whether there is a concern. When a picture matches known child sexual abuse material (section 2), the reviewer reads the letter's words, and does not open the picture. Only the reviewer has this access, every view is logged in the platform's Audit Log, and it is handled under strict confidentiality. Queries can be directed to support@stamplo.kids.
• Legal Requirements: If disclosure is required by law or lawful authority. In particular, the Online Safety Act 2023 requires us to report child sexual exploitation and abuse content to the National Crime Agency, with the information the law sets out about the accounts involved, including the content itself and the whole exchange of letters it was part of, and we contact the police straight away if a child is in danger. Where telling the account holder could put a child at risk or harm an investigation, we will not tell them.
• Service Providers: With trusted service providers under strict confidentiality agreements, only where necessary to operate Stamplo (for example identity verification, hosting infrastructure, or email delivery). For the picture check in section 2, Microsoft receives only a code calculated from the picture, never the picture or anything that identifies a person.

We use a small number of carefully selected service providers (including hosting, storage, email delivery, and identity verification providers). A full list of sub-processors is available here or on request at support@stamplo.kids.

6. Data Retention

We retain personal information only as long as needed to fulfil our service obligations or comply with legal requirements. A full breakdown is available on our Data Retention page.

• Account deletion: When a parent or legal guardian deletes their account, all associated parent, child, letter, and media data is permanently and irreversibly deleted from active systems within 30 days, except where the law requires us to keep it (see "Records we must keep by law" below).
• Anonymous activity statistics: We keep a non-identifying record of activity events — for example, that a letter was written or delivered, or that a family joined — recording only the type of event and the date it happened. These records contain no names, no account or message identifiers, and no letter content, and they cannot be linked back to any person. We use them to measure how the service is used over time. Because they hold no personal data, these records are retained permanently and are not removed when an account is deleted.
• Unverified accounts: Parent accounts where email verification is not completed are automatically deleted after 14 days. Reminder emails are sent at day 3 and day 7 before deletion.
• Identity-unverified accounts: Parent accounts where email verification is complete but identity verification has not been completed are automatically deleted after 90 days if the account has had no active letter exchange. Up to three reminders to complete verification are sent in the first fortnight, and warning emails are sent at day 60 and day 75.
• Letters and media: Letters and attached images are retained for up to 12 months after creation. Families are notified 30 days before deletion so they can save any letters they wish to keep. After 12 months, letters are permanently deleted. Letters that remain stuck awaiting parental approval for 90 days are automatically cancelled — the letter content and any attached image are permanently deleted and the sender's parent is notified. A warning is sent to the blocking parent at day 60 stating the cancellation date.
• Pending pen pal requests: Unanswered pen pal connection requests are automatically withdrawn after 14 days. The parent who initiated the request is notified by email when this happens. Withdrawn requests do not permanently prevent children from connecting in future.
• Identity verification attempt records: Where a parent account has been deleted, the associated verification attempt metadata (IP address, device information, and verification outcome) is retained for 12 months from the date the verification was completed, then permanently deleted by a scheduled automated process.
• Audit and safety records: Audit and safeguarding records are retained for as long as necessary to fulfil our safeguarding and accountability obligations. IP addresses are automatically removed from audit records after 12 months.
• Backups: Deleted data may persist in infrastructure backups for up to 30 days before backup rotation removes it permanently.
• Records we must keep by law: Where content has been, or may need to be, reported to the National Crime Agency, the law requires us to keep the content and the related records of the accounts involved, including letters, pictures, pen pal requests and activity records, for one year from the report, and the report's reference number for five years. This applies even if the account is deleted in the meantime: the account is closed straight away and the records are kept securely, then deleted when the period ends.

7. Your Rights Under GDPR

As a user, you have the right to:

• Access: Download your personal and family data via your account settings.
• Rectification: Correct inaccuracies in your data.
• Erasure: Delete your account and all related data ("Right to be Forgotten"), except anything the law requires us to keep (see section 6).
• Restriction of Processing: Request limits on data use.
• Data Portability: Obtain your data in a machine-readable format.
• Object: Object to certain types of processing, including marketing communications.

8. How to Exercise Your Rights

To exercise any rights, please contact us at support@stamplo.kids. We will respond within 30 days and may request verification of identity to protect your privacy.

9. Parent or Legal Guardian Control and Child Safety

The adult creating and managing a child account must be the child's parent or legal guardian.

Parents or legal guardians have full control over their child's account settings, including:

• Managing Friend Finder visibility
• Enabling or disabling image sending and receiving
• Approving or rejecting every pen pal letter

Stamplo staff do not access child messages except where a letter is reported by a child, or flagged or escalated by a parent, for safeguarding review, in which case access is strictly limited and audited.

To maintain match quality and protect children from unanswered connection requests, Stamplo limits visibility in Friend Finder. Newly created child accounts may appear in Friend Finder for a short introductory period (typically up to 7 days). After this period, visibility depends on recent family activity so that children are more likely to connect with active pen pals.

10. Organisations and Community Networks

Stamplo may be used by organisations such as schools, community groups, charities, or companies to invite families to participate in a shared pen-pal network.

When families join Stamplo through an organisation invitation, their children may be able to discover and connect with other children whose families have joined the same organisation network. These networks are designed to allow communities to connect while maintaining Stamplo's existing safety and parental supervision protections.

• Families join organisation networks using invitation links or codes provided by the organisation.
• Each family account remains privately managed by the child's parent or legal guardian.
• Children in organisation networks can only discover other children whose families have joined the same organisation.
• Organisations do not have access to children's letters, images, or private communications.
• Organisations may only see limited administrative information such as the number of participating families.

All safeguarding protections described in this Privacy Policy — including parental approval of letters, reporting tools, and restricted staff access — apply equally to organisation networks.

11. Cookies and Tracking Technologies

Stamplo uses only essential cookies required for secure login and basic functionality. We do not use personalised advertising cookies, cross-site trackers, or behavioural profiling. Fonts are hosted locally to protect your privacy.

We use Vercel Analytics to collect privacy-preserving, anonymous page-view data. Vercel Analytics does not use cookies, does not track individual users across sessions, and does not share data with advertisers. Analytics are enabled by default for authenticated parent accounts and can be disabled at any time in your account settings. Analytics are never enabled for children, and all child-facing pages are excluded from analytics entirely, regardless of who is visiting them. Anonymous, cookieless page-view analytics are also collected for unauthenticated visitors to public pages; no personal data is involved.

Using Stamplo as an app and storage on your device: You can add Stamplo to your phone's or tablet's home screen and open it like an app. Only when you open it that way does Stamplo place a small helper on your device (a "service worker"), which keeps a copy of the site's fixed files and an "offline" screen so the app opens quickly and shows a friendly message if you lose your connection. It never stores your pages, letters, pictures or any other private information. While your child is writing a letter, the words they have typed are kept on that device so they are not lost if they switch apps or lose signal. This unfinished letter never leaves the device until your child presses Send. It is deleted when the letter is sent, when your child chooses to start again, when anyone signs out on that device, and automatically after 7 days. We use these only because they are needed for the features you are using, and nothing is used to track you. Stamplo never prompts children to install the app.

We are committed to data minimisation and comply fully with the ICO Children's Code.

12. Data Transfers

Personal data relating to Stamplo's core pen-pal platform (accounts, letters, identity verification) is stored and processed exclusively within the UK or EU. The picture check in section 2 uses Microsoft's PhotoDNA service on its UK datacentre, and only a code calculated from the picture is sent to it.

Stamplo uses Stripe, Inc. (US) as its payment processor for three purposes: (1) purchases of the Stamplo World Map, (2) Stamplo Premium subscription billing, and (3) voluntary contributions towards Stamplo's running costs. In each case, your name, email address, and payment details are processed by Stripe under Standard Contractual Clauses and Stripe's UK GDPR Addendum. For World Map purchases only, shipping address and contact details are additionally passed to Gelato AS (Norway, EEA) for print-on-demand fulfilment; this transfer is covered by the UK Government's adequacy decision for EEA countries. No child data is transferred to Stripe or Gelato for any purpose.

A full list of sub-processors and their locations is available at stamplo.kids/legal/sub-processors.

13. Automated Decision-Making

Stamplo does not use profiling, and does not make decisions about anyone by automated means alone. All approvals and key decisions involve human review.

There is one automatic step. If the picture check in section 2 finds that a picture matches known child sexual abuse material, the letter is held straight away, so that it is not delivered, and Stamplo's safeguarding reviewer is told. The reviewer then decides what happens, including any report to the National Crime Agency and any action on the account. If you think the check was wrong, you can ask for the decision to be looked at again as our Terms of Service explain (section 7A, How to appeal).

14. U.S. Families and COPPA Compliance

Stamplo is operated by Stamplo Limited, a UK company regulated under UK GDPR and the ICO Children's Code (Age Appropriate Design Code). These standards provide strong protections for children's privacy and data.

Important Note for U.S. Families: Stamplo requires a one-time age and identity verification for all parent or legal guardian accounts. Verification is conducted by an independent provider (Didit Ltd) using government-issued ID and biometric liveness checks. Stamplo receives only a verification status and does not store identity documents. Stamplo is governed under UK GDPR and the ICO Children's Code, and our identity verification requirement is designed to satisfy the verifiable parental consent standard under COPPA (16 CFR § 312.5). We believe our safeguards meet COPPA's core requirements for services accessible to U.S. children.

• Parental Control: Parents or legal guardians must create accounts, verify their email, and approve every pen pal connection and letter before children can send or receive communications.
• Data Minimisation: We collect only limited information necessary to operate the service (family code, child's first name, country, and letters). We do not use behavioral advertising or third-party cookies. Privacy-preserving analytics (see Section 11) are enabled by default for authenticated parent accounts and can be disabled at any time in account settings; analytics are never enabled for children.
• Rights and Deletion: Parents or legal guardians can access, correct, or delete their child's account and data at any time by contacting support@stamplo.kids.
• Notice to Schools: Stamplo is not intended to replace school district parental consent obligations. Teachers introducing Stamplo in U.S. classrooms must ensure parental consent is obtained consistent with COPPA.

By using Stamplo in the United States, you acknowledge that data is processed in the UK under GDPR and the ICO Children's Code. For questions about COPPA compliance, please contact: Stamplo Limited, 124 City Road, London, EC1V 2NX, United Kingdom · support@stamplo.kids · +44 02080885498.

15. Age and Identity Verification

Stamplo partners with Didit Ltd, an independent verification provider, to perform this check. Didit Ltd acts as a data processor under a written agreement and complies with UK GDPR and the ICO Children's Code. The verification process may involve presentation of an identity document or other proof of age directly to Didit Ltd. Stamplo receives only a confirmation flag (verified / not verified) and does not receive or store copies of any documents.

In some cases where verification fails (for example due to low lighting, camera angle, or a failed liveness match), a trained Stamplo safeguarding officer may view the verification media directly inside Didit's secure dashboard to determine whether the attempt was genuine. Stamplo does not download, copy, or store any images, videos, or documents. All access is strictly limited, used only for safeguarding, and recorded in our Audit Log for accountability.

The lawful basis for processing this data is legitimate interest (ensuring child safety and compliance with age-appropriate access standards) and, where required, legal obligation. The information is retained only as long as necessary to confirm verification status and is then deleted or anonymised.

Verification session data held by Didit Ltd (identity document images and liveness captures) is deleted once verification completes: immediately when verification is approved, and within 7 days in all other cases, allowing time for safeguarding review of failed attempts. Didit Ltd permanently erases deleted sessions within 30 days. Stamplo retains only the verification outcome, its date, and a session reference number — never the documents themselves.

Parents or legal guardians can view their verification status within their dashboard and may request deletion of verification data by contacting support@stamplo.kids.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post any updates here. For significant changes we will notify you by email before they take effect. Continued use of Stamplo after minor updates indicates your acceptance of the revised policy.

17. Contact Us

Data Controller: Stamplo is developed and maintained by "Stamplo Limited" (Co. No. 16555069).

If you have any questions about this Privacy Policy, please contact us at:

support@stamplo.kids