At a glance
- Stamped Technologies LLC operates Stamped and administers the infrastructure used for application records.
- Microsoft hosts Microsoft sign-in and verifies your credentials; Stamped does not receive your Microsoft password.
- Stamped does not sell personal information or use it for behavioral advertising.
- If a customer is a U.S. educational institution, some student-linked records may be education records under FERPA. Stamped does not certify FERPA compliance in this notice.
- There is no end-user self-service deletion of an account and all associated records.
1. Scope and roles
This Privacy Notice applies to Stamped's websites, application, and related support and administrative services. Stamped Technologies LLC, a Florida limited liability company, operates the Stamped service. For Institution workflow content, the Institution generally decides why the information is used and who may access it. Stamped operates the service and processes that content for the Institution's authorized purposes. For account security, service telemetry, agreement records, and operation of the platform, Stamped also determines the processing needed to run and protect the service.
2. Records Stamped keeps
Identity and access records
Name, institutional email address, Microsoft directory object identifier when Microsoft sign-in is used, tenant, role, account status, department and organization memberships, assigned permissions, onboarding state, and application session information. Stamped does not receive or store your Microsoft password.
Workflow and operational records
Records created in enabled modules, which may include purchase and travel requests; descriptions and justifications; item, vendor, URL, quantity, price, date, status, destination, event, and traveler-count fields; advisor or approver names and email addresses; approval decisions and notes; organization, department, budget, funding, allocation, cost-center, project, invoice, and coding records; schedule resources, jobs, assignments, and related change history; comments, messages, imported spreadsheet content, email content used in approval or status workflows, and uploaded files.
Administrative and security records
Tenant configuration, invitations, access and role requests, audit history, status changes, email delivery and integration configuration, request paths and methods, response status and duration, error details, AI feature and token-usage metadata, and timestamps. Agreement evidence includes the accepted document versions, acceptance time, account and tenant identifiers, email address at acceptance, IP address, browser or device user-agent, and the specific acknowledgements made.
Information you choose to provide
Free-text fields and uploads may contain additional information. Do not submit grades, Social Security numbers, medical records, banking credentials, card data, or other sensitive information unless an authorized workflow expressly requires it and your Institution has approved that use.
3. Where records come from
Stamped receives information from you; other authorized users; Institution administrators and imports; Microsoft identity claims; configured mailboxes and email services; and the browser, device, and network used to access the service. A record submitted about another person may also come from an advisor, organization lead, approver, finance user, or administrator.
4. How records are used
- Authenticate users, assign roles, and enforce tenant and record-level access.
- Create, route, approve, fulfill, schedule, reconcile, and report on activity in enabled modules.
- Send and interpret workflow email, produce authorized exports, and provide support.
- Maintain audit history, investigate errors or abuse, secure the service, and enforce the Terms.
- Operate optional AI features, measure technical performance and usage cost, and improve reliability.
- Comply with lawful process, Institution direction, and applicable recordkeeping obligations.
5. Microsoft sign-in
Microsoft hosts its own sign-in pages and checks your Microsoft credentials. After successful authentication, Microsoft sends Stamped identity claims within a signed token. Stamped currently requests the OpenID Connectopenid, profile, and email scopes and uses the resulting name, email address, and stable directory identifier to find or create your Stamped account. Stamped then uses its own session cookie to keep you signed in and its own role records to decide what you may access.
Microsoft processes the authentication transaction under its own privacy terms. Stamped is not affiliated with or endorsed by Microsoft merely because it supports Microsoft sign-in.
6. Hosting and limited disclosures
Stamped's primary system of record is hosted within infrastructure selected and administered by Stamped Technologies LLC. It is separate from Microsoft's identity service and from the Institution's own systems. Stamped may disclose information only as needed to:
- the Institution and its authorized users;
- hosting, database, authentication, email, monitoring, and security providers supporting the service;
- Anthropic when an enabled AI feature needs to interpret email or spreadsheet content, summarize a queue, or answer an in-app question;
- comply with law, valid legal process, safety needs, or a binding Institution instruction; or
- address a reorganization or transfer of the service, subject to the same applicable restrictions.
Email addresses and phone-number patterns are removed from several AI workflows before transmission, but automated redaction is not guaranteed to identify every person or sensitive detail. AI prompts, request titles, organization names, user-entered chat messages, and other workflow content may still contain identifiable information. Institution administrators are responsible for authorizing optional AI use, and users should not enter unnecessary personal information into AI features.
7. Education records and confidentiality
This notice does not certify compliance with FERPA or any other privacy statute, and it does not designate Stamped as a school official. If the Institution is a U.S. educational agency or institution covered by FERPA, a Stamped record may be an education record when it is directly related to an identifiable student and maintained by or for that Institution. Not every Stamped record meets that definition.
If the Institution has separately arranged for Stamped to process FERPA-covered records, Stamped uses them only for the authorized institutional function, remains subject to the Institution's direction over their use and maintenance, and limits redisclosure as described in the Terms and any controlling Institution agreement. Stamped does not decide whether a student has a right to inspect or seek amendment of a record. Submit those requests to the Institution.
8. Retention and deletion
Stamped currently has no end-user control that deletes an account and all associated records. Records are retained for the longest period reasonably needed and permitted to support institutional recordkeeping, audits, finance, security, disputes, backups, legal obligations, and the home Institution's applicable policies and directions. Agreement evidence may be kept after access ends so Stamped can document the terms that governed prior use.
Individual operational records may be corrected, removed, voided, or replaced by authorized roles in ordinary workflows. Backups and audit records may persist after a live record changes. A legal requirement, binding Institution direction, or controlling agreement may require a different retention period or deletion and will take precedence. Account termination alone does not delete an official record.
9. Security
Stamped uses role-based access, tenant separation, authentication, request logging, and other administrative and technical safeguards intended to protect records. No online system can guarantee absolute security. Users must protect their accounts and report suspected unauthorized access to their Institution administrator promptly.
10. Choices and requests
You may choose not to accept the governing terms, but you cannot use authenticated Stamped features without accepting the current versions. For access, correction, amendment, export, retention, or deletion questions about Institution records, contact your Institution's Stamped administrator. The Institution will determine the request under its policies and applicable law and may direct Stamped to assist.
11. Changes
Stamped may update this notice as the service changes. If an update materially changes the agreement governing authenticated use, Stamped may require acceptance of a new version. The effective date above identifies the current notice.