Privacy Policy

1. Who we are

Stamporo is an international stamp collecting platform operated by Stamporo, accessible at stamporo.com.

As operator, we act as the data controller for personal data collected through the platform.

Contact: admin@stamporo.com · stamporo.com/contact

2. What data we collect

Account information

• Full name (optional)
• Username and email address
• Date of birth (age verification — minimum 13 years)
• Country of residence, preferred currency (prices stored internally in EUR, displayed in your chosen currency) and language preference (used to send system emails in your language)
• Collector type (beginner, hobby, serious, professional)
• Last login timestamp (security monitoring)
• Encrypted password — we cannot read or recover it

Stamp collection data

• Stamp images you upload (publicly visible on individual stamp pages if marked for trade/exchange)
• Stamp metadata: name, country, year, condition, estimated value (stored in EUR; publicly visible on stamp pages if listed for trade)
• AI analysis results generated from your images

Activity data

• Messages sent to other users on the platform
• Bids placed on stamps and accepted trade prices
• In-app notifications (new bids, accepted/declined bids, new messages) stored in our database
• Email notifications sent to you (verification, password reset, new message, new bid)
• Login timestamps and IP addresses (security purposes only)

3. Legal basis for processing

Under GDPR Art. 6, we process your data on the following legal bases:

4. AI processing and your images

When you upload a stamp image for analysis, it is sent to Anthropic's Claude API (anthropic.com) for identification and valuation. Anthropic processes data under their own privacy policy and does not retain images to train their models.

Analysis results — name, country, year, condition, estimated value — are stored in your account on our servers (Simply.com, Denmark).

Web search during analysis may use general stamp descriptions (e.g. "Greenland 1963 stamp") but never any personally identifiable information.

4b. Public stamp pages

• When you mark a stamp as \"for trade\" or \"for sale\", a public page is created at stamporo.com/stamp/?id=[id] containing: stamp name, country, year, condition, estimated price range, and your username.
• This page is indexed by search engines and can be shared on social media. If you do not want a stamp to be publicly discoverable, do not mark it for trade/sale.
• Removing the \"for trade\" flag or deleting the stamp removes it from public visibility immediately.

5. Who we share data with

We do not sell, rent or trade your personal data. Data is shared only with:

All transfers outside the EU/EEA are governed by Standard Contractual Clauses (SCCs) approved by the European Commission (GDPR Chapter V).

6. Data retention

• Account data — kept while active; deleted within 30 days of account deletion
• In-app notifications — kept for 12 months then automatically deleted
• Stamp images and collection data — deleted when you remove the stamp or close your account
• Messages — kept until deleted by you or the other party
• IP addresses (rate limiting) — automatically purged after 24 hours
• Login timestamps — kept for 90 days for security purposes
• Anonymised trade prices — kept indefinitely; contain no personal identifiers

7. Cookies

We use only strictly necessary cookies — no advertising, no tracking, no third-party analytics.

Because we use only strictly necessary cookies, a consent banner is not required under the ePrivacy Directive.

8. Your rights under GDPR

As a data subject you have the following rights, exercisable by contacting admin@stamporo.com:

• Right of access (Art. 15) — request a copy of all data we hold about you
• Right to rectification (Art. 16) — correct inaccurate data from your profile page
• Right to erasure (Art. 17) — delete your account via profile settings to permanently remove all your data (stamps, images, bids, messages, notifications) within 30 days — delete your account and all data within 30 days
• Right to restriction (Art. 18) — pause processing while a dispute is resolved
• Right to data portability (Art. 20) — request a JSON/CSV export of your data
• Right to object (Art. 21) — object to legitimate-interest processing

We will respond within 30 days. If unsatisfied, you may lodge a complaint with Datatilsynet (datatilsynet.dk), the Danish supervisory authority.

9. Security

• HTTPS/TLS encryption on all connections (Let's Encrypt)
• Passwords hashed with bcrypt (cost factor 12) — unrecoverable
• Session tokens bound to IP address and browser fingerprint
• Rate limiting on login, registration and password reset
• CSRF tokens on all forms
• SQL injection protection via prepared statements
• PHP execution blocked in the uploads directory
• Configuration files stored outside the web root

In the event of a data breach we will notify affected users and Datatilsynet within 72 hours (GDPR Art. 33–34).

10. Children

Stamporo requires users to be at least 13 years old (GDPR Art. 8, Danish law). Date of birth is verified at registration. Accounts found to belong to users under 13 will be deleted immediately.

11. Changes to this policy

We may update this policy periodically. Significant changes will be communicated by email and via a notice on the platform. Continued use after changes take effect constitutes acceptance.