Privacy Notice

1. Who we are

The Virtual Stamp Academy (stampdetectives.co.uk) is operated by Colin Allan Proctor, a sole trader in the United Kingdom. We are the data controller for the personal data described in this notice. Contact: hq@stampdetectives.com.

2. What we collect and why

• Sponsor account data (name or display name, email address, password credentials, optional club or school name, type, and town) — to create and secure your account and to run the service. Legal basis: performance of our contract with you.
• Child profile data (first name or nickname chosen by the sponsor, an Academy Passcode, quiz answers, scores, badges, and album contents) — to run the game and report progress to the sponsor. Children never give us email addresses. Legal basis: contract with the sponsor, who provides this information.
• Purchase records (credit pack bought, amount, order status, credit balance) — to credit your vault and keep order history. Legal basis: contract and legal obligation. We never store card details.
• Support messages — to answer your questions. Legal basis: legitimate interests in supporting customers.
• Technical and usage data (IP address, device and browser information, error reports, pages used) — for security, fraud prevention, and improving the service. Legal basis: legitimate interests.

3. Who we share data with

• Service providers / subprocessors — hosting, database and authentication providers, and AI providers used to generate stamp briefings and quiz questions (stamp images and case text only, not children's personal details).
• Stripe — our payment processor. When you buy a credit pack, your payment details are entered directly into Stripe's secure checkout; we never see or store your card number. Stripe processes your payment and sends us a confirmation containing your email and the pack purchased.
• Professional advisers (legal, accounting) where needed.
• Authorities where we are required to disclose by law.

We do not sell personal data and we do not run advertising.

4. International transfers

Some of our providers process data outside the UK/EEA. Where that happens we rely on appropriate safeguards such as UK adequacy decisions or standard contractual clauses.

5. How long we keep data

We keep sponsor accounts, child profiles, and case records for as long as your account is active. If you close your account, we delete or anonymise personal data within 90 days, except records we must keep for tax and accounting purposes (normally six years).

6. Security

We use appropriate technical and organisational measures, including encryption in transit, access controls, and row-level database security so each sponsor can only see their own account and detectives.

7. Cookies and local storage

We use only essential cookies and browser storage — to keep you signed in, remember the active detective profile, and keep the site secure. We do not use advertising or third-party tracking cookies. You can clear these at any time in your browser settings, though signing in will then be required again.

8. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, or port your personal data, to object to processing based on legitimate interests, and to withdraw consent where we rely on it. Sponsors may exercise these rights on behalf of the child profiles they created. Email hq@stampdetectives.com and we will respond within one month. You may also complain to the UK Information Commissioner's Office (ico.org.uk).