Privacy notice
1. Who handles your data
Stampwyn is operated by the entity identified in the Contact section. The operator determines how account administration, service security and support data are used. For report data processed on a customer's instructions, the customer ordinarily determines the purpose and the operator acts as its processor, subject to the applicable agreement.
2. Information processed
- Account details: email address, optional name, verification status, organization memberships, invitations and permissions.
- Sign-in data: temporary login tokens, sessions and identifiers from identities you explicitly connect.
- Domain and report data: domain names, DNS verification records, source IP addresses, sending organizations, authentication results, message counts, TLS outcomes and reporting timestamps.
- Original submissions: uploaded files or report emails and their attachments, which may contain headers, contact addresses and information supplied by a reporting provider.
- Operational information: activity records, request metadata, errors and communications you send for support.
The reporting service is not intended to collect ordinary email message bodies or read users' personal mailboxes. Avoid including unrelated personal information in reports or support requests.
3. Purposes and legal grounds
Data is used to provide requested reporting and account access, verify domain control, manage permissions, investigate failures and protect the service. Depending on the relationship and data involved, the operator relies on performance of a contract with the individual, legitimate interests in administering and securing an organizational service, or compliance with legal obligations. Processing on a customer's behalf follows that customer's documented instructions and processing agreement.
No advertising analytics or cross-site marketing trackers are included in the current application. Report processing does not make decisions with legal or similarly significant effects about individuals.
4. Microsoft and Google sign-in
If enabled and chosen, these providers authenticate you and return basic identity information using the openid, email and profile scopes. Stampwyn stores a stable identity reference to recognize a connected account. It does not request permission to read your Microsoft or Google mailbox, and does not retain provider access or refresh tokens. The provider also processes your sign-in under its own privacy terms. Email-link sign-in remains a separate access method, subject to organization policy.
5. Access and recipients
Data is accessible to authorized members and delegates according to their permissions and to authorized operators where required to run and support the service. Reports and account data are hosted on Devoro-managed infrastructure. Email delivery, identity providers you choose, and infrastructure operations may process the information needed for their roles. Data may also be disclosed where legally required.
Before external customer onboarding, the operator must confirm the processing locations, applicable providers and any international-transfer safeguards in the relevant processing information and agreement. Self-hosting alone does not establish that all processing stays within one country.
6. Retention
The current application schedules cleanup of accepted raw report submissions after 90 days, rejected or failed originals after 7 days, and parsed report data after 12 calendar months. Processing queues and daily cleanup runs can delay removal; these are application retention rules, not a promise of immediate deletion from every storage layer.
Account records, audit trails, support correspondence, infrastructure logs and backups have separate operational requirements. Their retention and account-closure deletion arrangements must be confirmed before this draft becomes final. Backup expiry is not controlled by the application's report-cleanup task.
7. Essential cookies
The app uses a session cookie to maintain sign-in and a CSRF cookie to protect requests. Session access is configured for up to eight hours and browser-close expiry, though a browser may restore sessions. CSRF cookie lifetime follows the application configuration. These cookies are used for service functionality, not advertising. The public pages do not require an analytics or marketing cookie.
8. Security
Controls include HTTPS, short-lived single-use email links, explicit identity connection, tenant permissions and access logging. No system can guarantee absolute security. Keep your account and identity-provider access secure and report suspected incidents using the contact below.
9. Your rights
Where applicable, you may request access, correction, erasure, restriction or portability of personal data and object to processing based on legitimate interests. These rights depend on the processing context and legal exceptions. Contact the operator; proportionate identity verification may be required. For data controlled by your organization, requests may need to be handled with that organization.
You may lodge a complaint with the competent data-protection supervisory authority, including one in the place of your habitual residence, work or the alleged infringement. You do not need to contact us first.
10. Updates
This notice will be updated when processing practices change. Material changes will be communicated through appropriate service channels. The version and preparation date appear above.
Contact
Devoro, UAB
Elbingo 33-1, Vilnius, Lithuania
support@devoro.com