Privacy Policy

Updated 27 September 2026 revision

Document ID: PRIVACY-PUBLIC-2026-09-27-v2

Revision date: 27 September 2026

1. Scope and contact

Stampwright is operated by Sunrise2D LLC, a Texas limited liability company doing business as Stampwright ("Stampwright," "we," "us," or "our"). This Policy explains how the Stampwright website, free catalog audit, artwork preflight, customer accounts, billing integration, product pages, GS1 Digital Link resolver, support channels, and monitoring handle information.

Privacy requests: hello@stampwright.com

Postal address: Sunrise2D LLC d/b/a Stampwright, 1910 E 9th St, Austin, TX 78702.

A business customer may submit information about its personnel or product users. That customer is responsible for having authority to provide the information and for its own notices and instructions.

2. Information we receive and keep

Website and funnel activity

Our marketing pages record first-party funnel events such as sample-view, audit-start, audit-complete, findings-view, and download stages, with a timestamp. These records are designed for aggregate product measurement. The application does not put a visitor identifier, raw IP address, raw User-Agent, uploaded catalog, or account email in funnel_events; automated User-Agents are excluded from that first-party funnel record.

Free catalog audit

Running the free audit sends us the CSV text, work email address, and optional company name. We process the CSV to create the report. We do not keep the original CSV as a file. We keep the email, optional company name, report score and counts, and derived row-level findings. Findings can include row numbers, GTIN values, product names on rows with findings, and issue descriptions.

We assign the report a random private link. Anyone with that link can open or download the report. The link is a bearer credential, not an authenticated customer account; share it only with people who should see the findings.

Artwork preflight

The selected image file stays in your browser. Browser code decodes the QR and sends derived data to Stampwright, including decoded QR text when found, image and symbol measurements, and an optional expected GTIN. We keep the verdict, decoded-text length, and measurement values when the check completes. We do not keep the image file, decoded text, or expected GTIN in the preflight-results table. The page loads its QR-decoding library from Stampwright's own domain.

Accounts and authentication

Opening customer access means we receive and keep your work email, Customer legal entity, representative name/title where required, optional company display name, account identifier, plan, account status, limits, Stripe customer/subscription/session identifiers, Order and acceptance records for exact document IDs and hashes, authority affirmations, and timestamps for account and billing events.

We use passwordless sign-in links. A sign-in link is valid once for 30 minutes. We keep a replay-prevention record after a link is used until the scheduled token-pruning process removes it. A successful sign-in sets a first-party session cookie that can last up to 30 days. The cookie is used for authentication and security, not advertising.

Controlled-pilot invitation tokens are stored only as cryptographic hashes with expiration, use status, and the associated account/email where applicable. The raw invitation works like a password and should not be shared.

Product, route, and service data

A customer account can provide and store GTINs, product names, brand names, descriptions, product attributes, destination links, route approvals, pending changes, product history, custom-domain information, webhook configuration, and related operational records.

We keep append-only or historical records where needed to show what product information or route was approved and when. We do not use customer product data to train a public generative-AI model.

Resolver scans and product pages

For each opening of a Stampwright resolver route, we keep the GTIN, a lot qualifier if present, the selected destination link type, coarse country code supplied by Cloudflare, a bot-or-human classification derived from the User-Agent, and a timestamp. Our application does not keep the raw IP address, raw User-Agent, requested link-type alias, or serial qualifier in the scan table.

The resolver redirects the visitor to the destination selected by the brand. That separate destination receives the visitor's request and any qualifiers forwarded in the destination URL. Stampwright does not control the destination's privacy practices.

Abuse prevention and security

Cloudflare provides a source IP address to our Worker when handling a request. Our application does not write the raw IP address to the audit or scan tables. For rate limiting, it converts the IP address to an HMAC-derived key and keeps the counter for the applicable window. It can also keep a normalized submitted email in a short-lived rate-limit key. Cloudflare may process request, device, network, and security metadata to provide and protect its services.

We keep security, availability, job, incident, billing-event, and decision records needed to detect abuse, investigate failures, support customers, and demonstrate operational changes. Some records can refer to an account, GTIN, event identifier, or destination.

Payments and invoices

Stripe processes checkout, payment methods, recurring subscriptions, invoices, taxes, refunds, and disputes. Stampwright receives and keeps provider identifiers, subscription and invoice status, plan/price identifiers, payment-success or failure events, refund/dispute events, and related timestamps. Stampwright does not receive or store the full card number or card security code.

Information entered on Stripe's pages is also governed by Stripe's privacy notice and terms.

Email and support

Resend processes transactional messages such as sign-in links and delivery events. We keep queued-message and delivery-event records needed to send, suppress, investigate, and support those messages. Google Workspace processes inbound and outbound business communications sent to Stampwright addresses, including support, billing, privacy, security, sales, and partner inquiries.

AI agents operated for Stampwright read messages sent to our business addresses and draft replies. The model providers they use, currently Anthropic, OpenAI, and OpenRouter, process that content to provide the service. An agent sends a message only when Angell has approved it or delegated that kind of message in writing, and a message an agent writes says that it comes from an AI agent.

A support or privacy message can contain whatever information the sender chooses to include. Do not send payment-card details, government identifiers, health information, or other sensitive personal information by email.

Marketing consent, if offered later, will be separate from service signup. Running an audit, creating an account, or accepting Terms is not itself consent to marketing email. Suppression records may be retained to honor opt-outs, bounces, or complaints.

3. How we use information

We use information to:

• provide and secure the requested audit, preflight, account, checkout, resolver, product page, monitoring, export, and support services;
• authenticate users and prevent replay, fraud, unauthorized access, and abuse;
• calculate and enforce plan limits and account state;
• create reports, store approved product information, publish authorized routes, and measure aggregate scans;
• process billing, tax, refunds, disputes, and payment recovery through Stripe;
• send requested transactional messages and respond to inquiries;
• monitor availability and destinations, back up the system, recover from failures, and keep an audit trail;
• understand aggregate product use and improve the service; and
• comply with law, enforce agreements, and protect customers, visitors, Stampwright, and others.

We do not sell personal data, run an advertising network, share resolver scan data with advertisers, or build individual consumer advertising profiles.

4. Analytics and cookies

Marketing pages use Google Analytics 4 to count visits and see which pages and guides people use. Google advertising features are configured off: no Google signals, ad personalization, or ad storage, with advertising-data redaction enabled. We do not use the data to build advertising audiences.

Where consent is required, analytics storage is denied by default. In the EEA, United Kingdom, and Switzerland, no analytics cookie is written unless the applicable consent state allows it, and measurement can fall back to cookieless aggregate requests. Elsewhere, Google Analytics can set first-party cookies to recognize a returning browser. You can block them in browser settings or use Google's opt-out tools without changing the core service.

There is no Google Analytics on private audit reports, customer account pages, consumer product pages, or resolver redirects. Apart from Google Analytics on the described marketing pages and the necessary first-party account session cookie, Stampwright does not set advertising or cross-site tracking cookies.

5. Service providers and disclosures

We disclose information only as needed to operate the service, follow customer instructions, protect rights and security, complete a business transaction, or comply with law.

Current provider categories include:

• Cloudflare: network, CDN, security, Worker runtime, D1 database, KV storage, R2 backup storage, DNS, and related infrastructure;
• Stripe: checkout, payment methods, subscriptions, invoices, tax calculation where enabled, refunds, disputes, fraud prevention, and the customer billing portal;
• Resend: transactional email delivery and delivery events;
• Google: Google Workspace business email and Google Analytics on the limited marketing pages described above; and
• customer-selected destinations: sites to which resolver routes redirect visitors.

Providers process information under their own agreements and privacy practices. They may process information in the United States and other places where they or their subprocessors operate.

We can disclose information to authorities or other parties when we reasonably believe disclosure is required by law, needed to protect a person or the service, or necessary to investigate fraud, abuse, security, infringement, or a legal claim. When legally permitted and practical, we will notify the affected business customer of a compelled disclosure.

If Sunrise2D LLC or Stampwright is involved in a merger, financing, reorganization, bankruptcy, or sale of assets or the service, information may be reviewed or transferred as part of that transaction, subject to appropriate confidentiality and notice requirements.

6. Retention and deletion

We keep information only for the purposes described here, but the current system does not enforce a single automatic deletion schedule for all audit, preflight, account, product, scan, email, support, billing, and incident records. Those records can remain until a verified deletion is completed, the account or relationship ends and the applicable operational/legal need expires, or a tested purpose-specific retention process removes them.

Rate-limit counters and used sign-in-token records are pruned according to their operational windows. Suppression records may be retained to prevent unwanted future email. Payment, invoice, tax, refund, dispute, contract, and acceptance records may be kept as needed for financial reporting, legal claims, fraud prevention, and compliance.

Continuity backups include service tables but redact selected secrets. We keep daily backups for 30 days and then the first backup of each month for up to seven years. A record deleted from the live database may remain in a restricted backup until that backup expires, unless a verified backup-deletion process removes it sooner. Restoring a backup can require reapplying a verified deletion.

Google Workspace and Stripe retain information under their provider settings and legal obligations. We do not currently claim a verified automatic retention schedule for inbound business email.

7. Access, correction, export, and deletion requests

Email hello@stampwright.com to ask what information is associated with your email, account, or report, request correction, request a copy, or request deletion. We will verify the request before disclosing or changing information. We may ask for information reasonably needed to confirm identity and authority for the business account.

The account interface provides bounded JSON exports only for the collections and fields identified on the export screen. Where pagination is offered, each collection has its own stable cursor. This is not a guarantee that one download or the current export includes every record held by Stampwright and its providers.

We may deny, limit, or delay a request where permitted or required for another person's rights, security, fraud prevention, tax/payment records, legal claims, contractual records, backup integrity, or resolver continuity. We will explain the result when legally permitted.

Depending on where you live and whether applicable thresholds or exemptions apply, you may have additional privacy rights. We will evaluate verified requests under applicable law. This Policy does not claim that a particular privacy statute applies or does not apply based only on current size.

You may appeal a denied privacy request by replying to the decision or writing "Privacy appeal" to hello@stampwright.com. The appeal will be reviewed by the owner or a different reviewer where practical.

8. Security

We use measures designed for the service's risk, including provider access controls, TLS, purpose-bound signed tokens, single-use sign-in links, rate limiting, restricted secrets, tenant checks, provider webhook signatures, monitoring, backups, and incident handling.

No internet system is completely secure. Do not use Stampwright to store payment-card details, Social Security numbers, health information, consumer account passwords, or other sensitive information the service does not request. Report suspected security issues to security@stampwright.com or through https://stampwright.com/.well-known/security.txt.

9. Children

Stampwright is a business service and is not directed to children under 13. We do not knowingly request personal information from children. Contact hello@stampwright.com if you believe a child provided personal information.

10. Changes to this Policy

We will post the current Policy with its document ID and revision date. For a material change affecting an account, data use, provider, retention, or customer rights, we will give reasonable notice through the account email or service. Where renewed agreement is appropriate, we will request affirmative acceptance rather than treating continued use alone as consent.

11. Acceptance and version evidence

For controlled-pilot signup, the Customer's Order and acceptance record identify the exact Privacy notice and other documents acknowledged. We preserve their versions and hashes, the completed Order, document-hash manifest, Customer and representative identity and authority, exact statement acknowledged, affirmative action, and server timestamp. Optional marketing consent is separate.

Publication of this page does not silently replace the notice recorded with an existing Customer Order. Material changes are handled as described in Section 10.

Read the exact source document

Source SHA-256: 494e119ea093980d10472d02e19d089a75c5cfa2a6cd619d220f92945adcb1d8