Privacy Policy

Updated August 2026

Stampwright is operated by Sunrise2D LLC, a Texas limited liability company ("Stampwright," "we," or "us"). This notice explains how the current Stampwright website, free catalog audit, artwork preflight, and resolver handle information.

Information we receive and keep

Catalog audit. When you run the free audit, we receive the CSV text, your work email address, and an optional company name. We process the CSV to produce the report. We do not keep the original CSV as a file. We keep your email, optional company name, report score, report counts, and derived row-level findings. Findings can include row numbers, GTIN values, product names on rows with findings, and issue descriptions.

Private report link. We assign the report a random link. Anyone who has the link can open or download the report, so share it only with people who should see the catalog findings. The link is not an authenticated customer account.

Abuse prevention. Cloudflare provides a source IP address to our Worker when it handles a request. Our application does not write the raw IP address to the audit or scan tables. For rate limiting, it converts the IP address to an HMAC-derived key and keeps the counter in Cloudflare KV for about 61 minutes. It also keeps a normalized version of the submitted email in a rate-limit key for about 61 minutes. Cloudflare may process request and network metadata to provide, secure, and operate its services.

Artwork preflight. The selected image file stays in your browser. Browser code decodes the QR and sends derived data to Stampwright, including the decoded QR text when found, image and symbol measurements, and an optional expected GTIN. We keep the verdict, the length of the decoded text, and measurement values when that check completes. We do not keep the image file, decoded text, or expected GTIN in the preflight-results table. The preflight page loads its QR-decoding library from our own domain; the image file itself stays in your browser.

Resolver scans. When a Stampwright resolver route is opened, we keep the GTIN, a lot qualifier if present, requested link type, coarse country code supplied by Cloudflare, a bot-or-human classification derived from the User-Agent, and a timestamp. Our application does not keep the raw IP address, raw User-Agent, or serial qualifier in the scan table. The resolver redirects the visitor to the destination selected by the brand; that destination receives the visitor's request and any qualifiers forwarded in the destination URL.

Accounts and payments. Customer account access and live billing are not currently open. Before activating them, we will update this notice to describe the account, payment, session, support, and product data that the activated service processes.

How we use information

We use the information described above to run and secure the requested audit or preflight, create and display the private report, operate resolver routes, provide aggregate scan counts, investigate errors or abuse, respond to requests, and maintain service continuity.

The report currently opens in the browser. We do not currently run automated audit follow-up or nurture email. We will not enable marketing follow-up until its notice, consent or other applicable basis, unsubscribe, suppression, bounce, complaint, and retention controls have been reviewed and tested.

What we do not do

We do not sell personal data. We do not run an advertising network, share scan data with advertisers, or build individual consumer advertising profiles.

Website analytics and cookies

Our marketing pages use Google Analytics 4 to count visits and see which guides people read. It is configured with Google advertising features off: no Google signals, no ad personalisation, no ad storage, and advertising data redaction on. We do not use it to build advertising audiences, and no advertising cookie is set.

Where consent is required, we do not set the cookie. In the EEA, the United Kingdom and Switzerland, analytics storage is denied by default, which means no analytics cookie is written and measurement falls back to cookieless requests that Google reports in aggregate. Elsewhere, Google Analytics sets its own first-party cookies to recognise a returning browser. You can block them in your browser settings or with Google's opt-out add-on, and blocking them does not change how the site works.

Where analytics is deliberately absent. There is no analytics on a private audit report, because the report URL is the only thing protecting it and sending that URL to a third party would hand over the key. There is also none on consumer product pages or resolver redirects, because the person scanning a brand's packaging is that brand's visitor rather than ours, and measuring them is not ours to do.

Apart from Google Analytics on the pages described above, this site sets no cookies of its own for advertising or cross-site tracking.

Service providers and destinations

Cloudflare currently provides the network, CDN, Worker runtime, D1 database, KV storage, R2 backup storage, and inbound email routing. Google provides website analytics as described above. Inbound messages are forwarded to an Angell-controlled Google Gmail mailbox. Stripe and Resend integrations exist in our software but live billing and automated email are not currently active. We will update this notice and verify the applicable provider terms before activating them.

When a resolver route redirects a visitor, the brand-selected destination is a separate site. Its operator controls that site's data practices.

Retention

The current automated deletion schedule for audit, preflight, scan, and email-queue records is not yet active. Those records remain until we complete a verified deletion or deploy a tested retention job. Our continuity backups include those tables. We keep daily backups for 30 days and then the first backup of each month for up to seven years. A record deleted from the live database may therefore remain in a restricted backup until that backup expires, unless a verified backup-deletion process removes it sooner. No automated retention schedule has been verified for inbound contact messages in the receiving Gmail mailbox.

We are publishing this current behavior rather than promising a shorter period that the system does not yet enforce. We intend to replace this paragraph with tested, purpose-specific schedules before opening customer accounts or automated email.

Requests

Email privacy@stampwright.com to ask what information is associated with your email or report, to request a correction or copy, or to request deletion. We will verify the request before disclosing or changing information. Some information may need to be retained for security, legal, fraud-prevention, backup-integrity, or resolver-continuity reasons. We will explain the result of the request.

The free-audit report and findings download are available through the private report link. This is not a complete self-service export of every record.

Contact

Sunrise2D LLC, operating as Stampwright
1910 E 9th St
Austin, TX 78702
privacy@stampwright.com