Privacy Policy

Last updated 2026-10-01

1. What we collect

• Organizer account data: name, email address and the one-time sign-in codes we email you. Stamp.Show has no passwords.
• Expo data: the expos you create, their settings, registrations, judge teams and the results you publish.
• Exhibitor data: what an exhibitor or the organizer enters to register an exhibit, such as name, email, country, exhibit title and class, and the sheet images uploaded.
• Judge data: the email and name a judge is invited with, their team assignments, and the scores and comments they enter in the Jury Room.
• Evaluation data: the automatic evaluation results generated for exhibits (scores, commentary) and your frame balance and ledger.
• Payment data: purchases and add-ons are processed by Stripe. We store the amount, package or add-on and status, never your full card number.
• Technical data: basic request logs, your IP address and security events (for example failed sign-in attempts), used to run the Service, rate-limit abuse and investigate fraud.
• API key data: for each key, a label, a one-way hash of the key and when it was used, never the key itself after it is shown once.

2. How we use it

We use your data to operate the Service: sign you in, run expos, deliver invitations and notices by email, store exhibit images, run the evaluations you request, process payments, maintain your frame balance, keep add-ons and domains working and protect the Service from abuse. We do not sell your data, we do not show advertising, and we do not use uploaded images or results to train our own models.

3. Third parties we share data with

• Stripe, to process payments.
• Our grading engine (Exhibit Grader, run by the same team), which receives the sheet images and exhibit details needed for an evaluation you requested, and in turn uses an AI model provider (currently Google Gemini or an OpenAI-compatible model) and a compute provider (currently Modal), each only for the duration of that evaluation.
• Our hosting providers: InterServer (application, database and uploaded files) and Cloudflare (DNS, content delivery, website hosting and custom-domain connections).
• Our email delivery provider, which transmits the messages we send you.
• Other participants of an expo: an organizer sees the exhibitors and judges of their own expo; judges see the exhibits assigned to them; whatever the organizer publishes (for example results) is public.

We do not share your data with advertisers or data brokers.

4. Organizers, exhibitors and judges

The organizer of an expo decides who takes part and what is collected, and is responsible for the way they use that data. We process exhibitor and judge data on the organizer's behalf to run the Service. If you are an exhibitor or a judge and have a request about your data, you can contact the organizer or us, and we will help the organizer answer it.

5. Cookies and local storage

We do not use advertising or analytics tracking cookies. Your session, or an exhibitor's or judge's personal-link session, is kept using a token stored in your browser's local storage, and your language and theme choices are kept there too. Stripe may set its own cookies during checkout for fraud prevention, governed by Stripe's own privacy policy.

6. Data retention

We keep your account, expos and results for as long as your account is active. Frames expire one year after purchase, but the record of the purchase is kept for your history and for our accounting. When an organizer deletes an expo, its registrations, judging data and domain connection are removed. Payment and frame accounting records are kept for bookkeeping, detached from your identity if you ask us to delete your account. Security logs are kept for a limited period.

7. Your rights

You can review and update your account details from your profile. To request an export of your personal data, a correction or the deletion of your account, write to us at legal@stamp.show; we verify the request through the email address on the account before acting on it. Remaining frames at the time of deletion are forfeited.

8. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to know what personal information we have collected about you, to request its deletion and to correct inaccurate information. In the preceding 12 months we have collected the categories listed in Section 1 (identifiers, account and commercial information, and internet or network activity) for the purposes in Section 2. We have not sold or shared personal information, so there is nothing to opt out of, and we do not use sensitive personal information in a way that gives a right to limit it. We will not deny you service or charge you a different price for exercising these rights. An authorized agent may make a request for you; we may ask for proof of authorization and verify your identity directly. Contact us at the address in Section 12.

9. Brazilian Privacy Rights (LGPD)

If you are located in Brazil, the Lei Geral de Proteção de Dados (LGPD) gives you the rights of access, correction, deletion, portability, information about who we share data with, and review of decisions made solely by automated processing. Evaluation results are reports to be reviewed by people; we do not use them to make automated decisions about your account. Our legal bases are performance of a contract (running your account, expo and payments), legitimate interest (security and abuse prevention) and legal obligation (bookkeeping records). Our providers in Section 3 are located outside Brazil and receive data because it is necessary to perform the contract (Art. 33). The contact for LGPD purposes is legal@stamp.show; you may also complain to the Autoridade Nacional de Proteção de Dados (ANPD).

10. Children

The Service is intended for people aged 16 and older. A younger person may take part only through a parent, legal guardian or other responsible adult who registers the exhibit and accepts our Terms of Service on the child's behalf. We do not knowingly collect personal information directly from a child under 16 outside that arrangement. If you believe we have, contact us and we will delete it.

11. Changes

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above.

12. Contact

Questions about this policy or your data? Reach us at legal@stamp.show.