Privacy Policy

1. Who We Are

Stempel ("we", "our", "us") is an AI-powered identification tool for antique and historical firearms, accessible at stempel.tools and as a mobile application. Stempel is operated as a besloten vennootschap in oprichting (B.V. i.o.) based in the Netherlands.

For privacy-related questions, contact us at: info@stempel.tools

2. What Data We Collect

Account information
When you create an account we collect your email address and, optionally, your name. Account authentication is handled by Clerk (see section 5).

Images you upload
Photos you submit for identification are sent to our AI model for analysis. With your consent, we may retain submitted images to improve the accuracy of our identification model over time. You will be asked separately for this consent, and you may withdraw it at any time. If you do not consent, your images are deleted immediately after processing.

Payment information
When you purchase a subscription or credits, payment is processed by Stripe. We never see or store your card number, CVC, or bank details. Stripe provides us only with a confirmation of payment and a customer reference.

Usage data
We collect anonymised usage statistics (page views, feature usage) via Vercel Analytics to understand how the service is used and to improve it. No personal identifiers are included in this data.

3. How We Use Your Data

• To provide and operate the Stempel identification service
• To manage your account and subscription
• To process payments and track credit usage
• To send transactional emails (e.g. purchase confirmations) — no marketing emails without explicit consent
• To improve the service through anonymised usage analytics
• To comply with legal obligations

We do not sell your data. We do not use your data for advertising.

4. Legal Basis (GDPR)

We process your personal data on the following legal bases:

• Contract — processing your account and payment data is necessary to provide the service you have signed up for
• Legitimate interest — anonymised analytics to improve the service
• Legal obligation — retaining financial records as required by Dutch law

5. Third-Party Processors

We share data with the following sub-processors, each bound by their own privacy commitments:

• Clerk (clerk.com) — account authentication and user management. Data stored in the EU/US. Privacy policy →
• Stripe (stripe.com) — payment processing. PCI-DSS compliant. Privacy policy →
• Vercel (vercel.com) — hosting and anonymised analytics. Privacy policy →
• OpenAI / AI provider — image analysis. Images are sent to the AI API for processing and are not retained. Privacy policy →

6. Cookies

We use only the following cookies:

• Authentication cookie — set by Clerk to keep you signed in. Strictly necessary, no consent required.
• Analytics — Vercel Analytics uses anonymised, cookieless measurement by default. No personal data is collected.

We do not use advertising cookies, tracking pixels, or third-party marketing cookies.

7. Data Retention

• Account data — retained for as long as your account is active, plus 30 days after deletion
• Uploaded images — deleted immediately after processing unless you have consented to retention for model improvement, in which case they are stored until you withdraw consent
• Payment records — retained for 7 years as required by Dutch tax law
• Usage analytics — anonymised; retained for 24 months

8. Your Rights (GDPR)

As a resident of the European Economic Area, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your account and personal data
• Portability — receive your data in a machine-readable format
• Restriction — request that we limit how we use your data
• Objection — object to processing based on legitimate interest

To exercise any of these rights, email info@stempel.tools. We will respond within 30 days. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

9. Children

Stempel is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. International Transfers

Some of our sub-processors (Clerk, Stripe, Vercel) may process data outside the European Economic Area, including in the United States. Where this occurs, transfers are safeguarded by Standard Contractual Clauses (SCCs) approved by the European Commission.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The effective date at the top of this page will always reflect the most recent version.