← Back

🔒 Privacy Policy

Effective Date: March 25, 2026  ·  Last Updated: March 25, 2026

1. Introduction

XPRV OÜ ("we," "our," or "us") operates the StampHash platform. This Privacy Policy explains what personal data we collect, why, the legal basis under GDPR (EU) 2016/679 and equivalent UK / US state laws, and your rights. By using StampHash you acknowledge you have read this policy.

2. Data Controller

3. What We Collect & Why

3.1 Evidence & File Data

• SHA-256 hash of your file — embedded in a Bitcoin transaction (“OP_RETURN”). This is permanent and cannot be deleted.
• Encrypted file — your file is encrypted client-side with your PIN before upload. The server stores only encrypted ciphertext; only you hold the key.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) — these are the core deliverables of the Service.

3.2 Precise GPS Location

Legal basis: Explicit consent (Art. 6(1)(a) GDPR). Consent is freely given, specific, informed, and unambiguous — you may deny GPS permission and still use the service.

3.3 Device Information

• Browser user-agent string, platform, and language — embedded as tamper-evident metadata to support the evidentiary record.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR) — providing authenticated, court-ready evidence metadata. We have balanced this against your interests; you can review the exact data on the Capture screen before notarizing.

3.4 Payment Data

Mainnet payments are processed by Stripe, Inc. We do not receive or store your card number, CVV, or full billing details. We receive only a payment confirmation token. Stripe acts as an independent data controller for payment data; see Stripe's Privacy Policy.

Legal basis: Performance of a contract (Art. 6(1)(b) GDPR).

3.5 Technical & Server Logs

• IP addresses, request timestamps, API usage — retained for security and fraud prevention.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR) — security and abuse prevention.

3.6 Local Device Storage

We store your evidence history (transaction IDs, file names, hashes) in your browser's localStorage. This data never leaves your device and is under your control. You can clear it at any time from the "My Evidence" screen.

Legal basis: Consent via the first-use notice displayed when you first access the app (ePrivacy Directive / UK PECR).

4. Data Retention

• On-chain data (hashes, GPS, device metadata): Permanent — cannot be deleted.
• Encrypted evidence files on server: 90 days, then purged automatically.
• Server access logs: 90 days.
• Payment records: 7 years (financial regulations).
• localStorage on your device: Until you clear it.

5. International Transfers

Our servers are located in the EU (Estonia). Blockchain broadcast APIs (mempool.space, Blockstream) and Stripe (US) may process your data outside the EU under Standard Contractual Clauses (SCCs). Stripe holds a current EU–US Data Privacy Framework certification.

6. Your Rights (GDPR / UK GDPR)

Where technically feasible you have the right to: access, rectification, erasure (except on-chain data), restriction, portability, and to object to processing based on legitimate interests. To exercise any right contact privacy@stamphash.app. You may also lodge a complaint with your national supervisory authority (e.g., the Estonian Data Protection Inspectorate for EU residents, the ICO for UK residents).

7. California Residents (CCPA / CPRA)

We do not sell or share personal information for cross-context behavioural advertising. California residents may request disclosure of categories of personal information collected and request deletion (except for on-chain records). Contact privacy@stamphash.app.

8. Children

StampHash is not directed to children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided data, contact us immediately.

9. Changes to This Policy

Material changes will be notified by updating the "Last Updated" date and a notice inside the app.

10. Contact

Privacy enquiries: privacy@stamphash.app

← Back to StampHash

← Back

📋 Terms of Service

Effective Date: March 25, 2026  ·  Last Updated: March 25, 2026

1. Agreement

By using StampHash ("Service") you agree to these Terms. If you disagree, do not use the Service.

2. Service Provider

3. Description of Service

StampHash provides blockchain-based evidence notarization: capturing files, computing cryptographic hashes, and anchoring those hashes permanently on the Bitcoin blockchain via OP_RETURN transactions.

4. User Responsibilities

• You must not upload illegal, harmful, or copyright-infringing content.
• You are solely responsible for the content you notarize.
• You warrant you have the legal right to notarize the submitted content.
• You understand that blockchain records are permanent and irrevocable.

5. Payments

Mainnet notarizations require a one-time fee processed through Stripe. Test-net notarizations are free. Payments are non-refundable once a Bitcoin transaction has been broadcast. If you are charged but no transaction is confirmed due to a technical failure, contact support@stamphash.app within 48 hours for a review.

6. Blockchain Immutability

7. Privacy

Please read our Privacy Policy for information on how we handle your data.

8. Disclaimers

The Service is provided "as is" without warranties of any kind. We do not guarantee specific blockchain confirmation times or uninterrupted service availability.

9. Limitation of Liability

To the fullest extent permitted by law, XPRV OÜ's liability is limited to amounts paid for the Service in the 12 months preceding a claim. We are not liable for indirect, incidental, or consequential damages.

10. Governing Law & Disputes

These Terms are governed by Estonian law. Disputes shall be resolved first by good-faith negotiation, then by mediation, and finally by binding arbitration in Tallinn, Estonia.

11. Changes

We may update these Terms. Material changes will be notified inside the app. Continued use constitutes acceptance.

12. Contact

Legal enquiries: support@stamphash.app

← Back to StampHash