Privacy notice

The organiser who runs this site is the controller of your personal data under the EU General Data Protection Regulation (GDPR) and the national laws that follow it. They have not yet published their name on this page.

Until a contact address appears here, reach the organiser through the Luma page of the event you registered for, which lets you message its hosts.

The partners whose credits are handed out here do not operate this site and receive no personal data from it.

Most of it comes from Luma. When you registered for an event there, you gave your name and email address to its organisers. Stamp reads that guest list from the organiser's Luma calendar to check who is registered and who has been checked in at the door.

The rest comes from you: the email address you enter to sign in, and your vote, if you cast one.

Our legal basis for everything below is legitimate interests (Article 6(1)(f) GDPR): running the event you registered for, delivering the partner credits promised to its guests, and keeping the site secure. We have weighed those interests against yours, and each item is limited to what its purpose needs. You can object at any time, as set out under Your rights.

• Checking the guest list. Your email address, your name, your Luma guest ID, your registration and approval status, and when you registered. Used to show you whether you are on the list and what is waiting for you.
• Handing out partner credits. When you were checked in at the door, which partner codes were assigned to you, and when. Codes unlock only after check-in, one per partner.
• Email. A sign-in link when you ask for one, and one message when you are checked in to tell you your credits are ready. When Luma names a new host, the organisers get one message asking them to confirm that person. Nothing else is sent: no newsletters and no marketing.
• Open mic voting. If you vote, the project you voted for, linked to your guest record so that each guest has one vote. Organisers see totals, not who voted for what. Voting is optional. Project names, and the builders' names that organisers type in with them, appear on the ballot and in the public showcase.
• Hosts and organisers. Your email address, who confirmed your access and when, and a record of the changes you make in the admin area, such as uploading codes, confirming hosts or opening the ballot.
• Security. Your IP address, held briefly to limit how often sign-in links can be requested. The sign-in cookie described below.

This site sets one cookie, stamp_session, and only once you sign in. It holds your email address and an expiry time, signed so that it cannot be altered, and it keeps you signed in for up to 90 days or until you sign out.

If you switch between light and dark mode, that choice is saved in your browser's local storage. It never leaves your device.

Both are strictly necessary for a service you asked for, so they are exempt from consent under Article 5(3) of the ePrivacy Directive and the national laws that implement it. That is why there is no cookie banner. There are no analytics, advertising or tracking cookies, and no third-party scripts.

Two providers run the site for us and process data only on our instructions, under their data processing terms:

• Render hosts the site and its database, in Frankfurt, Germany.
• Resend delivers the emails listed above, so it receives your email address and the message.

Luma, where your registration lives, is responsible for its own processing under its own privacy policy. We read the guest list from it and send nothing back. Event cover images load directly from Luma's image servers, so viewing an event page shares your IP address with Luma.

Confirmed hosts and organisers of an event can see its guest list in the admin area. Partners never see it: when you redeem a code, you deal with that partner directly, under its own privacy policy. We do not sell your data, and we disclose it to authorities only where the law requires us to.

Render and Resend are based in the United States, so your data may be accessed or processed there. Where it is, the transfer relies on the EU–US Data Privacy Framework for providers certified under it, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.

• Guest records, including the codes assigned to you and your vote: 12 months after the event ends, then deleted. Each project's vote total stays in the showcase, with nothing left that says who voted.
• Host records are kept while you have access. If your access is revoked, or your request to host is never confirmed, the record is deleted 12 months later, or 12 months after the last event it was named on if that is later.
• The admin activity log: each entry is deleted 12 months after it was written.
• Project and builders' names stay in the public showcase as the record of what was presented. Ask us and we will remove yours.
• Sign-in links stop working after 20 minutes, or 12 hours for the link in a credits email, and are deleted routinely after that. We store only a one-way hash of each link, never the link itself.
• IP addresses used for rate limiting are deleted routinely once the limit period has passed.
• The sign-in cookie lasts 90 days, or until you sign out.
• Delivery and server logs are kept by Resend and Render under their own retention settings. Server logs can include IP addresses and, when a delivery fails, an email address.

If you ask us to delete your data sooner, we will, unless the law requires us to keep it.

Under the GDPR you can ask us to:

• tell you what data we hold about you, and give you a copy;
• correct it. Your name and email address come from Luma, so the quickest fix is to change them there. The next sync brings the change here;
• delete it;
• restrict how we use it;
• stop using it. Because we rely on legitimate interests, you can object at any time, and we will stop unless we have compelling grounds that override yours;
• give it to you in a portable format, where that right applies.

Contact the organiser as set out above. We answer within one month. We may first ask you to confirm that the email address is yours, so that your data does not go to someone else.

You also have the right to complain to a data protection authority, in particular the one where you live, where you work, or where you believe the problem occurred.

Credits are assigned automatically when Luma reports that you were checked in. That is the only automated step, and it has no legal or similarly significant effect on you within the meaning of Article 22 GDPR. If something looks wrong, tell the organisers at the event or write to us.

The site is served only over HTTPS. The sign-in cookie is signed and cannot be read by scripts on the page. Sign-in links are stored only as one-way hashes. Only hosts an organiser has confirmed can open the admin area, and what they change there is logged.

This site is for adults attending events. It is not directed at children under 16, and we do not knowingly hold their data.

When this notice changes, the date at the top changes with it. If a change affects how we use data we already hold, we will say so here before it takes effect.