Your data, handled with care.
Stamp'd LLC handles passport data, identity details, and travel documents — some of the most sensitive information you own. This policy explains exactly what we collect, why, and how we protect it.
Effective Date: July 6, 2026 · Last Updated: July 6, 2026
This policy applies to all websites, mobile applications, software, travel-readiness tools, document-storage services, and related products operated by Stamp'd LLC(collectively, the "Platform"). By accessing or using the Platform, you agree to the practices described here.
Introduction & Scope
Stamp'd LLC, an Indiana limited liability company ("Stamp'd," "Company," "we," "us," or "our"), respects your privacy and is committed to protecting your personal information. This Privacy Policy describes how we collect, use, disclose, process, store, retain, transfer, and protect information when you access or use the Platform.
The Platform is designed to assist travelers in organizing travel-related information and documentation, including passport information, visa information, travel authorizations, vaccination records, and other travel-related materials. Because the Platform may involve the storage and processing of sensitive travel-related information and documents, we encourage you to read this Privacy Policy carefully.
This Privacy Policy should be read together with our Terms of Use and any other policies incorporated therein. By accessing or using the Platform, submitting information to us, or uploading any User Content or Stored Content, you acknowledge that you have read and understood this Privacy Policy and you expressly agree to the collection, use, disclosure, processing, storage, retention, and transfer of your information as described herein.
This Privacy Policy applies to information collected through the Platform as well as our websites, mobile applications, and related services, regardless of how you access them. It does not apply to third-party websites, applications, or services that may be linked to or integrated with the Platform.
Information We Collect
We may collect information directly from you, automatically through your use of the Platform, from third-party providers and integrations, and from publicly available sources.
Account and Registration Information
When you create an account, subscribe to services, or otherwise interact with the Platform, we may collect your name, email address, username, password or authentication credentials, billing and payment information, and other information you choose to provide during registration or in your account profile.
Travel Information
To provide travel-readiness functionality and personalized travel-related services, we may collect:
- Passport details, including passport number, issuing country, issue date, and expiration date
- Nationality, citizenship, and country of residence
- Travel destinations, trip dates, and itinerary details
- Visa information, travel authorizations, and entry permit details
- Travel preferences and trip-planning information
Travel Documents and Stored Content
The Platform may permit users to upload, store, organize, manage, retrieve, and otherwise process photographs, scanned images, PDFs, and other digital files, including passport photographs and biographical pages, visas and entry permits, travel insurance documents, vaccination and immunization records, boarding passes, hotel reservations, and other travel-related documents (collectively, "Stored Content").
Communications and Customer Support
We may collect information contained in emails, support requests, customer service correspondence, feedback, survey responses, and other communications you submit to us.
Payment and Subscription Information
If paid services are offered, we may collect billing-related information and transaction records. Payment card information is processed by our third-party payment processors and is not stored directly by us.
Information Collected Automatically
When you access or use the Platform, we may automatically collect:
- IP address, device identifiers, and approximate geolocation
- Browser type, operating system, and device configuration
- Pages visited, features used, and session behavior
- Referring URLs and exit pages
- Authentication logs and access timestamps
Analytics Information
We may collect information regarding how users interact with the Platform, including clickstream data, feature usage patterns, and performance metrics, through first-party and third-party analytics tools.
Information From Third Parties
We may receive information from identity-verification providers, travel-information providers, government databases, authentication services (such as Google OAuth), and other third parties, to the extent permitted by applicable law.
How We Use Information
We may use personal information and other information collected through the Platform for any lawful purpose, including the following:
Provide and Operate the Platform
- Create and manage user accounts and subscriptions
- Provide personalized visa requirements and travel readiness information
- Store and display uploaded travel documents in the Document Vault
- Process payments and manage billing
- Authenticate users and maintain secure sessions
Improve and Develop the Platform
- Analyze usage patterns and feature engagement
- Conduct research and testing to improve functionality
- Develop new features, tools, and services
Communications
- Send transactional emails (account confirmation, password reset, booking updates)
- Respond to customer support inquiries
- Send newsletters, product announcements, and service updates (with your consent where required)
Security and Fraud Protection
- Detect, investigate, and prevent fraudulent or unauthorized activity
- Monitor for and respond to security incidents
- Enforce our Terms of Use and applicable policies
Legal Compliance
- Comply with applicable laws, regulations, and legal obligations
- Respond to lawful government requests, subpoenas, and court orders
- Establish, exercise, or defend legal claims
Other Business Operations
- Maintain records and conduct audits
- Support mergers, acquisitions, or other corporate transactions
- Pursue other legitimate business purposes consistent with this Privacy Policy
How We Disclose Information
We may disclose information as described below.
Service Providers and Contractors
We may disclose information to third-party service providers that assist us with cloud hosting, database management, payment processing, email delivery, analytics, customer support, security, and other operational functions. These providers are authorized to use your information only as necessary to perform services on our behalf.
Travel-Related Integrations and Data Sources
We may disclose information to travel-related service providers, government databases, visa-processing services, and travel data providers to the extent necessary to provide the Platform's travel-readiness functionality.
Corporate Transactions
Information may be disclosed in connection with mergers, acquisitions, financings, reorganizations, bankruptcies, or sales of all or a portion of our business or assets, subject to customary confidentiality obligations.
Legal and Regulatory Compliance
We may disclose information when we believe disclosure is reasonably necessary to comply with applicable law, regulation, legal process, or governmental request; to enforce our Terms of Use; to protect the rights, property, or safety of Stamp'd LLC, our users, or others; or to detect, prevent, or address fraud, security, or technical issues.
With Your Direction or Consent
We may disclose information when you request, direct, authorize, or otherwise consent to such disclosure, including when you share trip information with collaborators or use third-party integrations.
Aggregated and De-Identified Information
We may use, disclose, publish, distribute, and otherwise process aggregated, anonymized, or de-identified information that cannot reasonably be used to identify any individual. Such information is not subject to this Privacy Policy.
User Content & Document Storage
The Platform may permit users to upload, store, organize, retrieve, and manage User Content and Stored Content, including sensitive travel documents, identity documents, and personal files.
Stored Content is accessed only by you and, where applicable, by team members or collaborators you authorize. We do not share your Stored Content with third parties except as required to operate the Platform or as described in this Privacy Policy.
Passport images are stored in a private, access-controlled storage bucket. They are never shared with third parties or used to train machine-learning models.
Data Retention
We retain personal information, User Content, Stored Content, and other information only for so long as we determine is reasonably necessary for the purposes described in this Privacy Policy, or as required by applicable law, regulation, legal process, or contractual obligation.
- Account and profile data — retained while your account is active
- Trip and document data — retained while active; deleted immediately upon account deletion
- Passport images — retained until you delete them or your account is closed
- Visa cache data — retained for 7 days (API response cache to reduce external calls)
- Analytics and usage data — retained for up to 12 months, then deleted or anonymized
- Waitlist emails — retained until early access launches or you unsubscribe
- Authentication and security logs — retained for 90 days
- Financial and billing records — retained as required by applicable tax and financial regulations
Upon account deletion, we will use commercially reasonable efforts to delete or anonymize your personal information within a reasonable period, except where retention is required by law or legitimate business necessity.
Data Security
We implement commercially reasonable administrative, technical, organizational, and physical safeguards designed to help protect information from unauthorized access, use, disclosure, alteration, and destruction.
Platform-level protections
- AES-256 encryption at rest for all database and storage data
- TLS 1.2+ encryption in transit for all connections
- Row-Level Security (RLS) — every database query is scoped to the authenticated user
- Supabase holds SOC 2 Type II certification
- All API routes validate authentication before processing requests
- Sensitive fields (e.g., passport numbers) are never logged
Operational practices
- Production access is restricted to authorized personnel only
- Regular security reviews of code and dependencies
- Multi-factor authentication required for internal system access
International Users & Cross-Border Data Transfers
Stamp'd LLC is headquartered in the United States and may process, store, transfer, and maintain information in the United States and other countries, which may have data protection laws that differ from those in your country of residence.
For users in the European Economic Area (EEA) or United Kingdom, we rely on appropriate legal mechanisms for cross-border transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure adequate protection consistent with GDPR Chapter V.
By using the Platform, you acknowledge and consent to the transfer, processing, and storage of your information in the United States and other jurisdictions as described in this Privacy Policy.
Marketing Communications & Automated Processing
Marketing Communications
We may use contact information to provide newsletters, product announcements, service updates, promotional communications, and other marketing materials. Where required by applicable law, we will obtain your consent before sending marketing communications. You may opt out of marketing emails at any time by clicking the unsubscribe link in any marketing email or by contacting us at info@gostampd.com. Opting out of marketing communications does not affect transactional or service-related communications.
Automated Processing and Platform Functionality
The Platform may utilize automated processes, algorithms, rules engines, software tools, machine-learning systems, artificial intelligence systems, and similar automated technologies to provide visa-requirement lookups, travel readiness assessments, document classification and organization, personalized recommendations, and other Platform functionality. These automated processes are used to deliver the core features of the Platform and to improve service quality.
Where required by applicable law, we will provide notice of and, where applicable, an opportunity to opt out of or object to significant automated decision-making that produces legal or similarly significant effects.
Your Privacy Rights
Depending on your jurisdiction of residence and applicable law, you may have certain rights regarding your personal information. These rights may include:
Right to Access
You may request information regarding the categories of personal information we collect, the sources from which it is collected, the purposes for which it is used, and the categories of third parties with whom it is shared. You may also request a copy of the specific personal information we hold about you.
Right to Correct
You may request correction of inaccurate personal information maintained by Stamp'd.
Right to Delete
You may request deletion of certain personal information, subject to legal, operational, contractual, or regulatory retention obligations. You can delete your account directly from Settings — all profile data, passport data, documents, and trip history will be permanently erased.
Right to Data Portability
Where applicable, you may request a copy of certain personal information in a portable, machine-readable format (JSON/CSV).
Right to Restrict or Object
Depending on applicable law, you may request restrictions on certain processing activities or object to processing based on legitimate interests.
Right to Withdraw Consent
Where processing is based upon consent (e.g., analytics cookies), you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
Right to Appeal
Where required by applicable law, you may have the right to appeal certain privacy-rights determinations. Appeal instructions will be provided in our response to any privacy-rights request.
United States State Privacy Rights
Residents of certain U.S. states may possess additional privacy rights under applicable state privacy laws. Depending upon your state of residence, you may have rights to access, correct, delete, or obtain a portable copy of your personal information; opt out of certain processing activities; and appeal our privacy-rights decisions.
California (CCPA/CPRA)
- Right to know what personal information is collected and how it is used
- Right to opt out of sale or sharing of personal information — we do not sell or share your personal information for cross-context behavioral advertising
- Right to limit use of sensitive personal information
- Right to non-discrimination for exercising your privacy rights
Other States (Virginia, Colorado, Connecticut, Texas, and others)
Residents of states with enacted comprehensive privacy laws may have similar rights to access, correct, delete, obtain a portable copy of, and opt out of certain processing of personal information. We will respond to verifiable requests consistent with applicable state law.
To submit a privacy-rights request, contact us at info@gostampd.com with "Privacy Rights Request" in the subject line. We will verify your identity before processing your request.
GDPR & UK GDPR Supplemental Notice
This section applies solely to the extent the General Data Protection Regulation ("GDPR"), United Kingdom General Data Protection Regulation ("UK GDPR"), or other applicable European data protection law applies to our processing of your personal information.
Legal Bases for Processing
- Performance of a Contract — processing necessary to create accounts, provide Platform functionality, store travel documents, and fulfill subscription services
- Legitimate Interests — processing necessary to improve the Platform, maintain security, prevent fraud, analyze Platform usage, and pursue other legitimate business purposes, where such interests are not overridden by your rights
- Compliance with Legal Obligations — processing necessary to comply with legal requirements and respond to lawful government requests
- Consent — where required, processing occurs based upon user consent, which may be withdrawn at any time
Rights of EEA and UK Residents
Subject to applicable law, individuals located within the European Economic Area or United Kingdom may have rights to access, rectify, erase, restrict, object to, and port their personal data. You also have the right to lodge a complaint with your local supervisory authority.
Data Subject Requests
Requests relating to privacy rights may be submitted using the contact information provided in this Privacy Policy. We may require you to verify your identity before processing your request. We will respond to verifiable requests within the timeframes required by applicable law (generally 30 days, with a possible extension of an additional 60 days where reasonably necessary).
For questions about our GDPR compliance or to contact our data protection point of contact, email info@gostampd.com.
Biometric, Identity Verification & Document Processing
The Platform may now or in the future provide functionality that permits users to upload, scan, organize, classify, verify, and manage identity documents, including passports, visas, and government-issued identification. Such functionality may involve automated processing of document images, including optical character recognition (OCR), document classification, and data extraction.
Where the Platform processes information that constitutes biometric data or biometric information under applicable law, we will collect and process such information only as necessary to provide the features you have requested, in accordance with applicable biometric privacy laws.
You may request deletion of your biometric or identity document data at any time by contacting us at info@gostampd.com or by deleting the relevant documents within the Platform.
Third-Party Websites, Governmental Resources & Integrations
The Platform may contain links to, integrate with, or otherwise utilize information, services, or functionality provided by third-party websites, governmental databases, embassy resources, official travel-advisory portals, and other external services. These third-party resources are governed by their own privacy policies and terms of service.
Stamp'd LLC is not responsible for the privacy practices, content, accuracy, or security of any third-party websites or services. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Platform.
Children's Privacy
The Platform is intended solely for individuals who are at least eighteen (18) years of age or the age of majority in their jurisdiction of residence, whichever is greater. We do not knowingly collect, use, or disclose personal information from individuals under the age of 18.
If you believe that a minor has provided personal information to us or created an account, please contact us immediately at info@gostampd.com and we will take steps to delete such information as promptly as practicable.
Security Incidents & Changes in Business Ownership
Security Incidents
Although Stamp'd LLC employs administrative, technical, organizational, and physical safeguards designed to help protect information from unauthorized access, use, disclosure, alteration, or destruction, no information system can be guaranteed to be completely secure. In the event of a security incident involving your personal information, we will notify you and applicable regulatory authorities as required by applicable law.
Changes in Business Ownership
Stamp'd LLC reserves the right to transfer or disclose information collected through the Platform in connection with mergers, acquisitions, reorganizations, asset sales, financings, or other corporate transactions, subject to customary confidentiality obligations. In such cases, we will use commercially reasonable efforts to ensure that the acquiring entity agrees to honor this Privacy Policy or provides you with notice and, where required by law, an opportunity to opt out prior to the transfer of your personal information.
Do Not Track Signals
Certain web browsers permit users to transmit "Do Not Track" ("DNT") signals. Because there is currently no uniform industry standard for recognizing or honoring DNT signals, the Platform does not currently respond to browser-initiated DNT signals. We will continue to monitor developments in DNT technology and industry standards and may update our practices accordingly.
Data Accuracy & Minimization
Data Accuracy
Stamp'd LLC endeavors to maintain personal information in a manner reasonably appropriate for the purposes described in this Privacy Policy. If you believe that any personal information we hold about you is inaccurate or incomplete, you may update your information within the Platform or contact us at info@gostampd.com to request correction.
Data Minimization
Stamp'd LLC endeavors to collect, use, retain, and disclose only the information that is reasonably necessary for the legitimate purposes described in this Privacy Policy and consistent with applicable law. We periodically review our data collection and retention practices to identify opportunities to minimize unnecessary data collection and processing.
User Representations, Warranties & Assumption of Risk
You are solely responsible for the information and documents you choose to provide, upload, or store through the Platform. By using the Platform, you represent and warrant that:
- You have the legal right and authority to upload and store all documents and information you submit through the Platform
- All information and documents you provide are accurate and not fraudulent or misleading
- Your use of the Platform complies with all applicable laws, regulations, and the Terms of Use
- You will safeguard your account credentials and promptly notify us of any unauthorized access or security breach
You understand and acknowledge that the electronic transmission, storage, and processing of sensitive travel, identity, and document information involves inherent risks, including the risk of unauthorized access, data breaches, and system failures, despite the security measures we implement. You assume all risks associated with your use of the Platform to store and manage sensitive personal and travel-related documents.
Consumer Health Data
Certain information that users choose to upload or provide — such as vaccination records, immunization records, and other health-related travel documents — may constitute "consumer health data" under applicable state health privacy laws, including the Washington My Health My Data Act and similar statutes in other jurisdictions.
The consumer health data we process consists of health-related information contained in documents and information that users voluntarily upload or provide to the Platform for the purpose of managing travel-related documentation and satisfying travel entry requirements. We collect and process consumer health data only to the extent necessary to provide the travel-readiness services you have requested.
Where required by applicable health privacy law, we will obtain your consent before collecting or processing consumer health data. You may request deletion of your consumer health data at any time by contacting us at info@gostampd.com.
Disclaimers & Limitation of Liability
The Platform and all information, tools, and functionality made available through it are provided on an "as is" and "as available" basis without warranties of any kind, either express or implied, including without limitation warranties of merchantability, fitness for a particular purpose, title, or non-infringement. Visa requirements, entry rules, travel advisories, and related travel information provided through the Platform are based on third-party data sources and may not reflect the most current government requirements. You are solely responsible for independently verifying all travel-related information with the applicable governmental authorities before making any travel decisions.
To the fullest extent permitted by applicable law, Stamp'd LLC and its affiliates, and their respective members, managers, officers, employees, agents, licensors, and service providers shall not be liable for any indirect, incidental, special, consequential, punitive, or exemplary damages arising out of or related to your use of or inability to use the Platform, including damages related to loss of data, security incidents, or reliance on Platform information.
Changes to This Privacy Policy
Stamp'd LLC may revise, amend, or otherwise modify this Privacy Policy from time to time in its sole discretion. When changes are made, we will update the "Last Updated" date at the top of this page. For material changes, we will provide more prominent notice, which may include email notification to registered users.
Continued use of the Platform after changes take effect constitutes your acceptance of the revised Privacy Policy. If you do not agree to the revised Privacy Policy, you must stop using the Platform.
This Privacy Policy is incorporated by reference into, and should be read together with, our Terms of Use. In the event of a conflict between this Privacy Policy and the Terms of Use with respect to privacy matters, this Privacy Policy shall control.
Contact Us
Questions regarding this Privacy Policy or Stamp'd LLC's privacy practices may be directed to:
If you are submitting a privacy-rights request, please include sufficient information to enable us to identify you, verify your identity, and understand the nature of your request. We aim to respond to all privacy requests within 30 days.