StampRise Pty Ltd engages the sub-processors listed below to help deliver the StampRise platform. Each is engaged under a data processing agreement with obligations comparable to those in our Data Processing Agreement. This page is updated at least ten days before any new sub-processor begins processing personal data. Transfers out of the EEA, UK and Switzerland are protected by the EU-US Data Privacy Framework (with the UK Extension) where the provider is certified, and otherwise by Standard Contractual Clauses with the UK Addendum (see our DPA). Replit and OpenAI are not Data Privacy Framework certified; transfers to them rely on Standard Contractual Clauses with the UK Addendum.
| Sub-processor | Purpose | Location | Personal data processed |
|---|---|---|---|
| Replit | Application hosting, managed PostgreSQL database, and object storage (Replit App Storage, on Google Cloud Storage) for uploaded photos, files, artwork and export archives | North America | All participant and organiser data |
| Cloudflare | DNS, content delivery, web application firewall, TLS termination and bot protection; R2 object storage for encrypted backups; Turnstile bot protection on public forms | Global edge network; R2 backup storage in Asia-Pacific | IP addresses and request metadata in transit; encrypted backup copies of the platform database, which holds organiser and participant records (not readable by Cloudflare). Uploaded photos and files are not included in these backups. |
| Render | Runs the automated job that creates encrypted backups of the platform database | Singapore | The platform database (organiser and participant records), processed transiently during each backup and encrypted before storage; no data retained. Uploaded photos and files are not backed up through Render. |
| OpenAI (via Replit AI Integrations) | AI-assisted passport editing and translation for organisers | United States | Organiser prompts, attached images, selected Passport content and translation content, which may include personal data entered by the organiser. Participant records are not sent. |
| xAI (SpaceXAI LLC) | AI model provider used for AI processing in StampRise's operations and support | United States | Content StampRise submits for AI processing in its operations and support, which may include personal data in that content |
| PostHog | Product analytics, only with Analytics consent: pageviews and selected events on the marketing website and Organiser pages; masked session recordings on public marketing pages and sign-up only. Automatic error capture is disabled. Not initialised on Participant-facing pages. | United States | Organiser account ID, pages visited, selected events, account properties (company, plan), country derived from IP. |
| Google (Google Wallet) | Issues digital event passes when a participant requests one | United States | Participant name, event name, station progress and reward status, and a link to the participant's passport. |
| Google (Sign in with Google) | Optional Organiser sign-in (openid, email and profile scopes) | United States | Organiser name, email, Google account ID (no profile photo stored) |
| SendGrid (Twilio) | Transactional email delivery | United States | Name, email address, message content, delivery metadata |
| Stripe | Payment processing for Event packages; paid Event registration through Organisers' own Stripe Connect Standard accounts (StampRise takes no application fee) | United States | Organiser billing contact and payment details; for paid registration, the registrant's email (passed to Stripe Checkout), amount, currency, payment, charge and refund identifiers. Card details are entered on Stripe-hosted pages. |
| Intercom | Customer support ticketing and in-app messaging | United States | Organiser name, email address, support conversation content |
| Aircall (Aircall SAS) | Cloud phone calls and SMS used by StampRise to contact Organisers for support, onboarding and sales. Processes StampRise's own Organiser contact data only. Not used for Participant data. | United States (primary hosting). Call recordings and voicemails may be stored in Australia or Germany depending on account settings. Aircall's own sub-processors may process data in other countries. | Organiser name, phone number, call and message records, and call recordings and voicemails where recording is enabled. |
| Google Workspace | Corporate email, identity, and document storage; Google Calendar (paid Event and Passport names, dates, time zone and management link, synced through Replit's connector; no participant lists) | United States | Organiser and business contact details |
Integrations enabled by Organisers
Swoogo: where an Organiser enables badge-based Passport recovery, StampRise sends the badge or registrant identifier to the Organiser's Swoogo account and receives the registrant ID, event ID, name and email. Swoogo is engaged by the Organiser.
Last updated 29 October 2026. To be notified of changes, email privacy@stamprise.com.