Stackie Privacy Policy

This Privacy Policy explains how Stackie Ltd processes Personal Data for Stackie Services, including Stackie websites, applications, command-line tools, daemon components, embedded Dashboard experiences, documentation, APIs, package delivery, support, marketing, and cloud services. The privacy schedule below describes current data categories, purposes, lawful bases, retention, and rights operations.

Defined Terms

These Stackie-specific definitions supplement the document that embeds this section. If an incorporated Common Paper Standard Term, Cover Page, Key Terms, Order Form, signed agreement, or non-waivable law gives a capitalized term a different meaning for a specific agreement or notice, that more specific meaning controls for that agreement or notice.

Term	Meaning
Customer	The individual acting for business or professional development purposes, business, enterprise, organization, or other entity that accepts, accesses, or uses Stackie under the applicable agreement or notice.
Customer Content	Data, code, packages, configuration, instructions, logs, support materials, and other materials submitted to, stored in, or processed through Stackie by or for Customer.
Dashboard	Embedded, local, or hosted Stackie dashboard experiences covered by the applicable agreement or notice.
Local Software	Stackie Software installed or run on Customer-controlled systems, including local command-line, daemon, embedded Dashboard, package, update, support, and integration components.
Personal Data	Information relating to an identified or identifiable individual.
Protected Persons	Stackie Ltd and its directors, officers, employees, contractors, affiliates, agents, successors, assigns, shareholders, and members.
Provider	Stackie Ltd, unless the applicable agreement or signed order form identifies a different provider for the covered offering.
Services	Stackie websites, applications, APIs, package delivery, documentation, support, hosted services, and related service components covered by the applicable agreement or notice.
Software	The software identified as Software in the applicable Cover Page, Key Terms, Order Form, EULA, signed agreement, or other accepted Stackie document.
Stackie	The Stackie products and services covered by the applicable agreement or notice, including Stackie websites, applications, command-line tools, daemon components, Dashboard experiences, cloud services, APIs, package delivery, documentation, support, and related services.
Stackie Cloud	Hosted Stackie services, including cloud APIs, package delivery, account management, billing workflows, subscriptions, support, hosted Dashboard experiences, and related hosted features.
Stackie Software	Stackie software provided by or for Stackie Ltd, including the stackie command-line application, the stackied daemon, embedded Dashboard components, local support components, update components, and related local software.
Usage Data	Operational, telemetry, diagnostics, analytics, provider-derived service metadata, and service-use data generated from access to or use of Stackie. This includes only bounded operational diagnostic categories disclosed in Stackie's current privacy and subprocessor materials and does not reclassify Customer Content as Usage Data merely because Customer Content appears in a diagnostic context.
User	An individual authorized by Customer to access or use Stackie, or an individual who otherwise accesses or uses Stackie under Customer's account, device, environment, authority, or control.

Who We Are

Stackie Ltd is the controller for account, billing, security, support, website, product analytics, marketing, and business administration processing that Stackie Ltd decides. Stackie Ltd may act as processor, service provider, or contractor when it processes Customer-controlled personal data only to provide the contracted service under Customer's instructions.

Where Stackie Ltd must appoint a representative, data protection officer, or similar local contact under applicable law, Stackie Ltd will publish or provide those contact details before relying on that route for the affected processing.

Personal Data We Process

Stackie processes the categories listed in the privacy schedule, which may include account identifiers, email addresses, authentication and session data, organization and billing metadata, subscription events, device tokens, package usage, download logs, support communications, security audit data, local acceptance receipts, local settings, daemon operational data, dashboard state, diagnostics, and tracking preferences.

Stackie does not intentionally request special-category, sensitive, protected health, payment card primary account number, children's, or government-identification data unless a specific feature, agreement, or lawfully documented workflow says otherwise. Customers must not submit data that Stackie is not designed or approved to process.

How We Use Personal Data

Stackie uses personal data to provide, secure, maintain, troubleshoot, improve, and support Stackie; authenticate users; manage accounts and subscriptions; deliver packages and updates; record legal acceptances; prevent abuse; comply with law; communicate with users; administer billing; process support requests; measure product usage; and send marketing where permitted.

Legal Bases

For UK, EEA, Swiss, and similar regimes, Stackie relies on the legal bases listed in the schedule. These generally include contract performance, legitimate interests, consent, legal obligation, and establishment or defense of legal claims. For jurisdictions using other terminology, Stackie processes personal data for the disclosed business and operational purposes and with required notices, consent, opt-outs, or other lawful grounds.

Cookies, Analytics, Marketing, and Tracking

Cookies and similar technologies are described in the Cookie and Tracking Notice. Analytics, marketing emails, newsletters, support desks, customer chat, crash reporting, diagnostics, and session replay may be used only when represented in the current inventory and configured under the required consent, opt-out, or legitimate-interest posture for the applicable region and surface.

Where required, Stackie will request consent before placing non-essential cookies or using similar tracking technologies. Users may unsubscribe from marketing emails using the unsubscribe mechanism in those emails or by contacting Stackie.

Technical Error Reporting

Stackie uses Sentry for bounded technical-error reporting on approved development, staff-only pre-production (ppt), UK/US public-live services, and separately enabled UK/US releases of the Stackie command-line tool and daemon. Released software reporting is disabled by default on each machine. No customer-machine event may be sent unless a person first receives the current just-in-time notice and actively chooses one report or automatic reporting; that choice may be withdrawn at any time. The product choice is an additional transparency and control measure, not Stackie's data-protection lawful basis. Temporary per-spec branch reporting, EU/EEA launch reporting, customer-content diagnostics, and user-submitted reports remain disabled. Sentry receives only source-owned allowlisted error codes, bounded enums, release and environment identifiers, and separately approved normalized source frames. Stackie does not send Sentry unrestricted error objects or messages, user-submitted feedback, logs, request or response data, customer content, local variables, filesystem paths, command arguments, environment values, user or customer identifiers, screenshots, replay, attachments, profiling data, source uploads, or arbitrary context. Sender IP address and Sentry transport or service metadata are treated conservatively as potential personal data; provider-side scrubbing and prevention of new-event IP storage are required controls.

Approved Sentry technical-error events remain actively searchable for no more than 30 days. Sentry's separate provider backup and deletion lifecycle is documented in Stackie's internal vendor evidence, and no extended legal-hold or source-artifact retention path is approved. Reporting can be stopped through environment gates, destination removal, and the emergency kill switch without falling back across environments.

Stackie relies on legitimate interests for proportionate reliability and security diagnostics where the documented purpose, necessity, balancing, minimization, retention, transparency, objection, and access safeguards support that basis. Staff agreement, a disclaimer, or a reporting toggle is not treated as consent or as a substitute for a lawful basis. The approved browser integration deliberately uses no cookie, SDK identity, local-storage identifier, session-storage identifier, replay token, or similar browser storage. The separately enabled UK/US command-line and daemon path is covered by the same minimized controller-purpose assessment and adds a current per-machine choice and withdrawal route. EU/EEA activation and any diagnostic processing of customer-controlled personal data remain blocked pending their own role, purpose, lawful-basis, PECR, rights, retention, notice, customer-agreement, and transfer decisions.

Sharing and Recipients

Stackie shares personal data with Stackie personnel and service providers only as needed for the purposes described in this policy. The Subprocessor List below identifies approved public subprocessors and third-party recipients. Stackie may also disclose personal data to comply with law, enforce agreements, protect rights and security, complete corporate transactions, or with Customer's instruction or consent.

Stackie does not sell personal data for money. Stackie does not knowingly share personal data for cross-context behavioral advertising unless the Cookie and Tracking Notice, consent tooling, and applicable opt-out mechanisms support that processing.

International Transfers

Stackie may process and transfer personal data in the United Kingdom, European Economic Area, United States, and other locations where Stackie or its service providers operate. Where data protection law requires transfer safeguards, Stackie uses appropriate mechanisms such as adequacy decisions, UK international data transfer terms, standard contractual clauses, contractual safeguards, technical measures, and transfer assessments as reflected in the DPA and transfer schedules.

Retention

Stackie keeps personal data for the retention periods and business reasons listed in the schedule, unless law, dispute, security, billing, tax, audit, backup, legal claim, or fraud-prevention needs require a longer period. When personal data is no longer needed, Stackie deletes, anonymizes, aggregates, or retains it only in a legally permitted form.

Security

Stackie uses administrative, technical, and organizational measures designed to protect personal data, including access controls, least-privilege practices, transport security where applicable, secure development review, logging, incident response, and release gates for high-risk processing. No system is perfectly secure, and Customer remains responsible for securing Customer devices, accounts, credentials, environments, and local installations.

Individual Rights

Depending on location and relationship with Stackie, individuals may have rights to access, correct, delete, port, restrict, object to, or opt out of certain processing; withdraw consent; appeal a privacy decision; limit use of sensitive data; receive privacy notices; or complain to a regulator. UK individuals may complain to the UK Information Commissioner's Office where applicable. Stackie applies required browser privacy-preference signal handling only for surfaces where that handling is implemented and legally required.

Requests can be sent to [email protected]. Stackie may verify identity, ask for information needed to locate records, reject requests that are unlawful or abusive, and preserve data where retention is legally permitted or required.

United States Privacy Notices

For California and other U.S. state privacy laws, this policy and the schedule describe categories of personal data, purposes, retention, recipients, sources, current launch-scale applicability, and rights. Stackie provides or will activate state-specific disclosures, notices at collection, appeal workflows, opt-out links, universal opt-out signal handling, and sensitive-data controls where the applicable law requires them for Stackie's processing and thresholds.

California residents may have rights under CalOPPA and, when applicable, the CCPA/CPRA depending on processing and legal thresholds. Users in Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, Florida, and other U.S. states may have similar rights where those laws apply.

UK, EEA, Swiss, Brazilian, and Other Privacy Notices

For UK GDPR, the Data Protection Act 2018, PECR, the Data (Use and Access) Act 2025, EU GDPR, ePrivacy, Swiss FADP/nFADP, Brazilian LGPD, and similar laws, this policy identifies controller roles, processing purposes, legal bases, transfers, retention, recipients, complaint routing, and rights at a general level, with source-specific details in the schedule. Stackie will add representative, regulator, cross-border, consent, and local notice details where required before the relevant processing begins or expands.

Children's Data

Stackie is not directed to children and should not be used by anyone under the age required to form a binding account or provide valid consent in their jurisdiction. If Stackie learns that it has collected children's personal data without required consent, it will take reasonable steps to delete or de-identify it.

Business Transfers

Stackie may disclose or transfer personal data in connection with financing, merger, acquisition, restructuring, insolvency, sale of assets, corporate transaction, or diligence, subject to appropriate confidentiality and legal safeguards.

Changes to This Policy

Stackie may update this policy prospectively, including to reflect changes to services, data practices, subprocessors, recipients, consent-management tools, legal notice publication methods, support providers, analytics providers, marketing providers, security providers, and other vendors. Material changes will be handled according to applicable law and the legal change classification maintained in Stackie's governance registers. Stackie will provide notice, request consent, preserve opt-out choices, or apply additional rights workflows where applicable law requires that posture for the affected processing.

Contact

Privacy questions and rights requests can be sent to [email protected]. Security concerns can be sent to [email protected].

Privacy Schedules

Personal Data Categories and Uses

Personal Data	Source	Current Status	Why We Use It	Legal Basis	Retention	Recipients	Transfer Summary
account information	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	account creation, administration, and service access	contract necessity	kept while the account is active and then for the legal record period that applies	Stackie personnel, approved service providers, and independent controller recipients listed separately where applicable	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, adequacy decision or equivalent lawful transfer basis, Data Privacy Framework or equivalent certified transfer basis, contractual transfer terms.
authentication and session data	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	authentication, sessions, and security	contract necessity	kept for the session period and a limited security audit period	Stackie personnel, approved service providers, and independent controller recipients listed separately where applicable	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis, contractual transfer terms.
billing and subscription data	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	billing and subscription administration	contract necessity	kept during the customer relationship and then for tax, accounting, dispute, and legal record periods	Stackie personnel, approved service providers, and independent controller recipients listed separately where applicable	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis, contractual transfer terms.
product usage data	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	service operation and product improvement	legitimate interests	kept for a limited analytics period, then aggregated or deleted	Stackie personnel and first-party systems	No approved external provider transfer is active until the provider is enabled and listed
device notification data	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	device linking, notifications, and security	contract necessity	kept while the device is registered and then for a limited security audit period	Stackie personnel and first-party systems	No approved external provider transfer is active until the provider is enabled and listed
support data	Collected only if the feature is later enabled after required notice, consent, and provider approval where required.	planned or available only after activation	customer support	contract necessity	kept while the support matter is active and then for the legal record period that applies	Stackie personnel and first-party systems	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, adequacy decision or equivalent lawful transfer basis.
behavioural analytics data	Collected only if the feature is later enabled after required notice, consent, and provider approval where required.	planned or available only after activation	product improvement, support, and debugging	consent	kept for a short review period, then deleted	Stackie personnel and approved providers only when the relevant feature is enabled and the provider is listed	No approved external provider transfer is active until the provider is enabled and listed
marketing communication data	Collected only if the feature is later enabled after required notice, consent, and provider approval where required.	planned or available only after activation	marketing emails and newsletters	consent	kept while subscribed, then limited suppression records are kept to honor opt-outs	Stackie personnel and approved providers only when the relevant feature is enabled and the provider is listed	No approved external provider transfer is active until the provider is enabled and listed
local settings and configuration	Provided by the customer or generated locally in the Stackie product; sent to Stackie only if a connected cloud, support, or diagnostic feature is used.	local or customer-controlled	local dashboard operation	contract necessity	kept until local deletion or product uninstall	Customer-controlled local environment; Stackie receives it only when the customer connects a cloud, support, or diagnostic feature	Processed locally unless the customer chooses a connected cloud, support, or diagnostic feature
account information	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	cloud account identity and profile management	contract necessity	kept while the account is active and then for the legal record period that applies	Stackie personnel, approved service providers, and independent controller recipients listed separately where applicable	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, adequacy decision or equivalent lawful transfer basis, Data Privacy Framework or equivalent certified transfer basis, contractual transfer terms.
authentication and session data	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	cloud authentication, session, and credential management	contract necessity	kept for the session period and a limited security audit period	Stackie personnel, approved service providers, and independent controller recipients listed separately where applicable	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis, contractual transfer terms.
authentication workflow data	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	registration, account-readiness, auth email, session, and credential management	contract necessity	kept while the account is active and then for operational audit, dispute, and legal defence periods	Stackie personnel and first-party systems	No approved external provider transfer is active until the provider is enabled and listed
billing and subscription data	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	cloud billing and subscription record administration	contract necessity	kept during the customer relationship and then for tax, accounting, dispute, and legal record periods	Stackie personnel, approved service providers, and independent controller recipients listed separately where applicable	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis, contractual transfer terms.
billing and subscription data	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	plan catalog publication and release integrity	legitimate interests	kept while plan catalog records are active and then for release integrity and legal record periods	Stackie personnel, approved service providers, and independent controller recipients listed separately where applicable	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis, contractual transfer terms.
package metadata	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	package build metadata publication	legitimate interests	kept while package artifacts or metadata are served and then for release integrity, provenance, and legal record periods	Stackie personnel and approved service providers listed separately where applicable	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis.
service usage data	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	service usage, entitlement display, and abuse controls	contract necessity	kept while the account is active and then for usage, billing dispute, abuse-prevention, and legal record periods	Stackie personnel and approved service providers listed separately where applicable	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis.
operational audit data	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	security, audit, abuse prevention, and operational diagnostics	legitimate interests	kept for the applicable security, accounting, tax, dispute, legal claim, or short operational audit period	Stackie personnel and approved service providers listed separately where applicable	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis.
legal and compliance evidence	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	legal acceptance and compliance evidence	contract necessity	kept during the customer relationship and then for statutory limitation, dispute, and legal defence periods	Stackie personnel and approved service providers listed separately where applicable	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis.
legal and compliance evidence	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	legal document publication and release integrity	legitimate interests	kept while the legal document or publication record is active and then for release integrity and legal record periods	Stackie personnel and approved service providers listed separately where applicable	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis.
security data	Provided by the customer or generated through Stackie Cloud account, service, billing, support, security, or usage activity.	currently active	cloud security and device credential management	contract necessity	kept for the session, credential, or device-token period and then for a limited security audit period	Stackie personnel and approved service providers listed separately where applicable	May be processed in United Kingdom, European Union and EEA, United States; safeguards include EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis.
authentication credentials	Provided by the customer or generated locally in the Stackie product; sent to Stackie only if a connected cloud, support, or diagnostic feature is used.	local or customer-controlled	local authentication to Stackie Cloud	contract necessity	kept until logout, credential expiry, credential-store deletion, or cleanup	Customer-controlled local environment; Stackie receives it only when the customer connects a cloud, support, or diagnostic feature	Processed locally unless the customer chooses a connected cloud, support, or diagnostic feature
local operational history	Provided by the customer or generated locally in the Stackie product; sent to Stackie only if a connected cloud, support, or diagnostic feature is used.	local or customer-controlled	local stack, sandbox, and build operation	contract necessity	kept until local state is deleted, cleaned up, or replaced by product retention controls	Customer-controlled local environment; Stackie receives it only when the customer connects a cloud, support, or diagnostic feature	Processed locally unless the customer chooses a connected cloud, support, or diagnostic feature
diagnostic logs and process metadata	Provided by the customer or generated locally in the Stackie product; sent to Stackie only if a connected cloud, support, or diagnostic feature is used.	local or customer-controlled	troubleshooting, search, and process recovery	legitimate interests	kept until storage cleanup, configured log retention, or user deletion	Customer-controlled local environment; Stackie receives it only when the customer connects a cloud, support, or diagnostic feature	Processed locally unless the customer chooses a connected cloud, support, or diagnostic feature
local settings and configuration	Provided by the customer or generated locally in the Stackie product; sent to Stackie only if a connected cloud, support, or diagnostic feature is used.	local or customer-controlled	local settings, source preferences, and plugin operation	contract necessity	kept until edited, reset, migrated, or deleted by the user	Customer-controlled local environment; Stackie receives it only when the customer connects a cloud, support, or diagnostic feature	Processed locally unless the customer chooses a connected cloud, support, or diagnostic feature
package inventory data	Provided by the customer or generated locally in the Stackie product; sent to Stackie only if a connected cloud, support, or diagnostic feature is used.	local or customer-controlled	local package management and cleanup	contract necessity	kept until package removal, cache cleanup, or user deletion of Stackie state	Customer-controlled local environment; Stackie receives it only when the customer connects a cloud, support, or diagnostic feature	Processed locally unless the customer chooses a connected cloud, support, or diagnostic feature
third-party package license acceptance data	Provided by the customer or generated locally in the Stackie product; sent to Stackie only if a connected cloud, support, or diagnostic feature is used.	local or customer-controlled	local third-party package license prompting	contract necessity	kept until the package or license identity changes, the acceptance is replaced, or Stackie state is deleted	Customer-controlled local environment; Stackie receives it only when the customer connects a cloud, support, or diagnostic feature	Processed locally unless the customer chooses a connected cloud, support, or diagnostic feature
MCP agent authentication data	Provided by the customer or generated locally in the Stackie product; sent to Stackie only if a connected cloud, support, or diagnostic feature is used.	local or customer-controlled	local agent enrollment, sessions, and token management	contract necessity	kept until unenrollment, rotation, state cleanup, or local configuration deletion	Customer-controlled local environment; Stackie receives it only when the customer connects a cloud, support, or diagnostic feature	Processed locally unless the customer chooses a connected cloud, support, or diagnostic feature
local diagnostic notifications	Provided by the customer or generated locally in the Stackie product; sent to Stackie only if a connected cloud, support, or diagnostic feature is used.	local or customer-controlled	diagnostic notifications	contract necessity	kept for the configured notification retention period or until local deletion	Customer-controlled local environment; Stackie receives it only when the customer connects a cloud, support, or diagnostic feature	Processed locally unless the customer chooses a connected cloud, support, or diagnostic feature
process audit metadata	Provided by the customer or generated locally in the Stackie product; sent to Stackie only if a connected cloud, support, or diagnostic feature is used.	local or customer-controlled	daemon recovery and process cleanup	legitimate interests	kept until Stackie state deletion or product cleanup removes old process audit records	Customer-controlled local environment; Stackie receives it only when the customer connects a cloud, support, or diagnostic feature	Processed locally unless the customer chooses a connected cloud, support, or diagnostic feature

Email Communications

Communication	Type	Current Status	Purpose	Legal Basis	Personal Data	Retention	Controls
Transactional account emails	Transactional account email	In use for account, security, and service messages	Account verification, password reset, and account lifecycle security emails.	contract necessity	account information, authentication and session data, email contact data, security data	Email payloads are sent for delivery; Stackie keeps account and verification records under the authentication retention schedules.	Service and security emails used for account verification, password reset, and account lifecycle notices. These are separate from marketing messages and are not used for newsletter or promotional campaigns.
Marketing emails	Marketing email	Not currently active; will not be used unless lawfully enabled and disclosed	Marketing emails and lifecycle campaigns.	consent	marketing communication data, email contact data	Not applicable while inactive	Marketing email campaigns are not currently active and will not be used unless lawfully enabled and disclosed. Runtime disablement evidence is recorded.
Newsletters	Newsletter	Not currently active; will not be used unless lawfully enabled and disclosed	Newsletter subscription messages and product updates.	consent	marketing communication data, email contact data	Not applicable while inactive	Newsletter subscriptions are not currently active and will not be used unless lawfully enabled and disclosed. Runtime disablement evidence is recorded.

Provider Payload Controls

Data Category	Current Status	Purpose	Personal Data	Information Retained	Information Excluded	Retention	Controls
Billing provider event records	In use with minimization controls	Verify billing-provider subscription events, prevent duplicate billing changes, reconcile subscriptions, and preserve billing and legal evidence.	billing and subscription data, subscription data, account information	event identifier, event type, billing subscription identifier, billing customer identifier, subscription status, organization identifier, billing-period timestamps, cancellation timestamp	signature headers, raw request headers, raw request body after verification and parsing, unrecognized provider fields, full source IP address, payment card primary account number	Billing event records are kept for the contract period plus tax, accounting, dispute, and legal defence windows.	Stores only a verified, bounded billing event envelope needed for subscription reconciliation. Signature headers, raw request headers, oversized bodies, and unrecognized provider fields are not retained. Access is limited to need-to-know operations, and deletion or anonymization follows the applicable retention rule.
Retired billing provider event records	Retired from active collection	Maintain or retire legacy billing event evidence under billing and legal-retention controls.	billing and subscription data, subscription data	event identifier, user identifier, event type, legacy billing event details if retained before migration, processed timestamp	new webhook request headers, new signature headers, newly submitted provider payload bodies, payment card primary account number	Retired provider-event records, if present, are kept only as billing or legal evidence until deletion, anonymization, or migration is completed under the applicable billing evidence window.	Retired billing event record class; no current customer-facing workflow adds new records. If records exist, they are limited to billing or legal evidence and subject to deletion or migration controls. Access is limited to need-to-know billing or legal review, and deletion, anonymization, migration, or legally permitted retention follows the recorded retention rule.
Minimized Sentry technical-error events	In use with minimization controls	Detect, diagnose and remediate technical faults and security failures using minimized operational diagnostics.	diagnostics and reliability data, operational audit data, security data	generated error code and stable fingerprint, severity and schema version, service, runtime, platform, component, route-template and status classes where approved, logical environment and release class, immutable full-commit release and environment-qualified dist, up to 32 JavaScript compiled frames containing only a source-owned module class, same-origin /assets or /_astro path or fixed /worker.js, /worker.mjs, /index.js or /index.mjs bundle name, and bounded line/column numbers, random event identifier and event timestamp, Sentry-generated receipt/processing timestamps, SDK/protocol/envelope facts, validation outcomes, rate limits, grouping hashes, issue identifiers/status, project/release/dist associations, counts, aggregates and retention/deletion state, transient sender IP and browser/client-generated User-Agent, Origin, Referer or client-hint headers where the platform sends them, plus possible network-derived region and abuse/risk classifications	user or customer identifiers and account or organization identifiers, raw error messages, exception values, function names, stack locals and arbitrary context, customer content, prompts, terminal output and workspace content, request or response URLs, query strings, headers, cookies and bodies, original-source, filesystem, customer-controlled or cross-origin paths, query strings, command arguments and environment values, logs, breadcrumbs, screenshots, attachments, replay, profiling, User Feedback and Seer or AI content	Sentry technical-error events use a maximum 30-day active searchable retention after the applicable environment, legal, portal and release gates pass. Temporary per-spec branch reporting is not provisioned. Provider backup and deletion follow a separate documented lifecycle.	Sentry receives a generated error code, severity, service/runtime/platform classes, coarse component or route/status classes where approved, bounded compiled-frame coordinates needed for private JavaScript source-map correlation, logical environment/release class, immutable deployment release, random event identifier, and provider transport metadata. It does not receive raw errors, free text, customer content, requests, arbitrary URLs or paths, headers, cookies, bodies, arguments, locals, environment values, logs, screenshots, attachments, replay, profiles, or User Feedback. Access is limited to need-to-know operations, and deletion or anonymization follows the applicable retention rule.
Bounded custom Sentry trace transactions	Not currently active; will not be used unless lawfully enabled and disclosed	Measure bounded software operations to diagnose and remediate reliability faults.	diagnostics and reliability data, operational audit data	enumerated operation and route-template classes, coarse duration and outcome buckets, random trace, root-span and child-span identifiers, bounded timestamps and sampled flag, logical environment/release class, immutable full-commit release and environment-qualified dist, Sentry-generated transaction/performance classification, receipt/processing timestamps, SDK/protocol/envelope facts, project/release/dist associations, counts, aggregates, rate limits and retention/deletion state, transient sender IP and browser/client-generated User-Agent, Origin, Referer or client-hint headers where the platform sends them, plus possible network-derived region and abuse/risk classifications	user, customer, account, organization, device or persistent session identifiers, raw URLs, query strings, request or response content and headers, free text, customer content, file paths, arguments, locals and environment values, automatic browser or Worker instrumentation and trace propagation, logs, breadcrumbs, replay, screenshots, attachments, profiling, User Feedback and Seer or AI content	Minimized operational telemetry used to detect, diagnose, measure and remediate faults is actively searchable for no more than 30 days.	Custom sampled traces contain only enumerated operation and route-template classes, coarse duration and outcome buckets, random trace/span identifiers, timestamps, logical environment/release class, immutable full-commit release, environment-qualified dist, and provider-generated processing metadata. Automatic instrumentation and propagation are disabled. Access is limited to need-to-know operations, and deletion or anonymization follows the applicable retention rule.
Low-cardinality Sentry metric transactions	Not currently active; will not be used unless lawfully enabled and disclosed	Measure coarse reliability signals to diagnose and remediate faults.	diagnostics and reliability data, operational audit data	enumerated metric name and unit, coarse count or duration bucket, approved component and outcome dimensions, random transaction and span identifiers and bounded timestamps, logical environment/release class, immutable full-commit release and environment-qualified dist, Sentry-generated aggregation, receipt/processing timestamps, SDK/protocol/envelope facts, project/release/dist associations, counts, rate limits and retention/deletion state, transient sender IP and browser/client-generated User-Agent, Origin, Referer or client-hint headers where the platform sends them, plus possible network-derived region and abuse/risk classifications	raw numerical timings or measurements, user, customer, account, organization, device or persistent session identifiers, arbitrary tags, labels, dimensions or free text, customer content, requests, URLs, headers, cookies, bodies, paths, arguments, locals and environment values, logs, replay, screenshots, attachments, profiling, User Feedback and Seer or AI content	Minimized operational telemetry used to detect, diagnose, measure and remediate faults is actively searchable for no more than 30 days.	Metric transactions contain only an enumerated metric name/unit, coarse value bucket, approved component and outcome dimensions, random transaction/span identifiers, timestamps, logical environment/release class, immutable full-commit release, environment-qualified dist, and provider-generated processing metadata. Access is limited to need-to-know operations, and deletion or anonymization follows the applicable retention rule.
Aggregate Sentry application release health	Not currently active; will not be used unless lawfully enabled and disclosed	Compare aggregate software release health to diagnose regressions.	diagnostics and reliability data, operational audit data	minute-rounded aggregate interval start, one exited, errored or crashed aggregate count, logical environment and immutable full-commit release, Sentry-generated aggregation, receipt/processing timestamps, SDK/protocol/envelope facts, project/release associations, counts, health classifications, rate limits and retention/deletion state, transient sender IP and browser/client-generated User-Agent, Origin, Referer or client-hint headers where the platform sends them, plus possible network-derived region and abuse/risk classifications	session identifier, user, customer, account, organization or device identifier, page-view, request, Worker interval or navigation history, exact session start/end, duration, sequence or interaction content, customer content, requests, URLs, headers, cookies, bodies, logs, replay, screenshots, attachments and profiling	Minimized operational telemetry used to detect, diagnose, measure and remediate faults is actively searchable for no more than 30 days.	The embedded application may send aggregate counts for one minute interval and one exited, errored or crashed status, together with logical environment and immutable release. Requests, page views and Worker intervals are not relabeled as sessions. Access is limited to need-to-know operations, and deletion or anonymization follows the applicable retention rule.
Sentry runtime check-ins and live uptime results	Not currently active; will not be used unless lawfully enabled and disclosed	Detect service availability failures using bounded runtime and uptime checks.	diagnostics and reliability data, operational audit data, security data	random check-in identifier, fixed monitor slug, five-minute UTC schedule and bounded thresholds, in-progress, ok or error status, logical environment and immutable full-commit release, live health endpoint origin/path, request timestamp, availability, status class and provider monitor/incident metadata, sender IP and network/service metadata generated by Sentry or Cloudflare, including possible User-Agent, probe location, DNS/connect/TLS/response timing or failure class, network-derived region and abuse/risk classifications, Sentry-generated receipt/processing timestamps, project/release associations, check-in/uptime identifiers, incidents, alert/delivery facts, access/audit records and retention/deletion state	user, customer, account, organization, device or persistent session identifiers, query strings, request body, custom headers, cookies, credentials and tracing headers, response body, customer content, database content or internal health details, dev or PPT external uptime requests, logs, screenshots, attachments, replay, profiling, User Feedback and Seer or AI content	Minimized operational telemetry used to detect, diagnose, measure and remediate faults is actively searchable for no more than 30 days.	Dev, ppt and live Workers send a source-owned five-minute Cron check-in containing a random check-in identifier, fixed monitor slug and schedule, status, environment and immutable release. One live uptime monitor requests only the public health endpoint and records availability/status metadata without credentials, body content, query strings, cookies or tracing. Access is limited to need-to-know operations, and deletion or anonymization follows the applicable retention rule.
Private Sentry JavaScript release artifacts	Not currently active; will not be used unless lawfully enabled and disclosed	Correlate minimized technical faults with an exact software release using private diagnostic build artifacts.	diagnostics and reliability data, private diagnostic build artifacts, confidential software build data	byte-exact compiled and minified JavaScript deployed for one surface, with only a private upload-time map association appended to the Sentry copy, source-map version, opaque source identifiers, bounded safe symbol names or deterministic opaque replacements, and encoded mappings, immutable full-commit release and environment-qualified dist, surface, project and logical environment routing metadata, Sentry-generated artifact, release, upload, file name or opaque-source identity, size/digest, correlation, access, API audit, deletion and service metadata, build sender IP/client metadata and authorized-user account, role/team, login/MFA/session, source IP/device/browser, administrative change and support/security audit records where generated by Sentry	sourcesContent and original source files, absolute, home, workspace, repository or developer paths, secrets, credentials, tokens and environment values, customer or production-derived data and personal content, native debug symbols, Rust source upload and SCM source integration, public source-map files or public sourceMappingURL references	Private diagnostic build artifacts are retained for no more than 30 days to correlate minimized technical faults with an exact software release; they are not published with Stackie software or websites.	Build-only pipelines upload a private copy containing the byte-exact deployed compiled JavaScript plus only an upload-time map association, and sanitized maps containing opaque source identifiers, bounded safe symbol names or opaque replacements, and mappings for App, Cloud, Dashboard and Website. Original source content, absolute paths, secrets, customer data, production-derived content and native debug symbols are excluded; maps and source-map directives are absent from publication. Access is limited to need-to-know operations, and deletion or anonymization follows the applicable retention rule.

Rights Operations

Jurisdiction	Launch Availability	Rights	Deadline Days	GPC	Opt Out	Contact
United Kingdom	currently available for the Stackie surface covered by this notice	access, rectification, erasure, restriction, portability, objection, automated decision review, supervisory authority complaint	30	where implemented and legally required	yes	[email protected]
European Union and EEA	not offered through Stackie's initial self-serve launch in this jurisdiction; future availability requires separate review	access, rectification, erasure, restriction, portability, objection, automated decision review, supervisory authority complaint	30	where implemented and legally required	yes	[email protected]
United States baseline with state privacy overlays	currently available for the Stackie surface covered by this notice	access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination	45	where implemented and legally required	yes	[email protected]

Jurisdiction Applicability

Jurisdiction	Regime	Current Launch Assessment	Rights and Controls
United Kingdom	UK GDPR	Applies to the current launch posture. UK GDPR applies to Stackie's UK controller and processor processing without a user count threshold.	Stackie publishes controller, processor, lawful basis, rights, retention, transfer, and recipient information for UK personal data. Current rights: access, rectification, erasure, restriction, portability, objection, automated decision review, supervisory authority complaint. Appeal or complaint: UK individuals may escalate privacy requests internally and may complain to the Information Commissioner's Office where applicable. GPC or universal opt-out: Browser privacy-preference signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request special-category data for launch.
United Kingdom	Data Protection Act 2018	Applies to the current launch posture. The Data Protection Act 2018 supplements UK GDPR and applies without a launch size threshold.	Stackie preserves non-waivable UK data protection rights and transfer safeguards alongside UK GDPR disclosures. Current rights: access, rectification, erasure, restriction, objection, supervisory authority complaint. Appeal or complaint: UK individuals may complain to the Information Commissioner's Office where applicable. GPC or universal opt-out: Browser privacy-preference signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request special-category data for launch.
United Kingdom	UK PECR	Applies to the current launch posture. PECR applies to covered cookies, similar tracking technologies, and electronic marketing without a launch size threshold.	Stackie discloses cookie, tracking, marketing email, consent, unsubscribe, and browser preference signal posture for UK users. Current rights: privacy notice, objection. Appeal or complaint: UK users may raise cookie or marketing complaints through Stackie and may complain to the Information Commissioner's Office where applicable. GPC or universal opt-out: Browser privacy-preference signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: PECR launch controls concern tracking and electronic marketing rather than intentional sensitive-data collection.
United Kingdom	Data (Use and Access) Act 2025	Tracked as an amendment to another applicable privacy law. The Act is tracked as an amendment layer for UK GDPR, the Data Protection Act 2018, and PECR.	Stackie tracks UK statutory changes as amendments to the applicable UK privacy and electronic communications regimes. Rights tracked through the amended regime: privacy notice, objection, supervisory authority complaint. Appeal or complaint: UK complaint routing remains available through Stackie and the Information Commissioner's Office where applicable. GPC or universal opt-out: Browser privacy-preference signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request special-category data for launch.
United States baseline with state privacy overlays	California Online Privacy Protection Act	Applies to the current launch posture. CalOPPA applies to covered websites and online services that collect personal information from California residents.	Stackie publishes an online privacy notice describing categories, uses, choices, updates, and contact routes for California users. Current rights: privacy notice. Appeal or complaint: Privacy questions may be escalated internally through the privacy contact. GPC or universal opt-out: Preference-signal handling is disclosed where a surface supports it or where another state privacy law requires it. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	California Consumer Privacy Act and CPRA amendments	Below the current launch threshold. Current launch is below the California revenue, resident/household, and sale/share revenue thresholds.	Stackie offers baseline California style transparency and opt-out wording while tracking CCPA/CPRA threshold status for launch. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: California requests may be escalated internally through the privacy contact. GPC or universal opt-out: GPC or legally required universal opt-out signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Virginia Consumer Data Protection Act	Below the current launch threshold. Current launch is below the Virginia consumer and consumer plus revenue thresholds.	Stackie tracks Virginia access, correction, deletion, portability, opt-out, appeal, and sensitive data consent posture. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: Universal opt-out signal handling is tracked and activated where a covered state law requires it. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Colorado Privacy Act	Below the current launch threshold. Current launch is below the Colorado consumer and sale of data thresholds.	Stackie tracks Colorado rights, appeal handling, sensitive data consent, and universal opt-out mechanism obligations. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: GPC or legally required universal opt-out signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Connecticut Data Privacy Act	Below the current launch threshold. Current launch is below the Connecticut consumer and consumer plus sale revenue thresholds.	Stackie tracks Connecticut rights, appeals, sensitive data consent, and opt-out obligations. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: GPC or legally required universal opt-out signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Utah Consumer Privacy Act	Below the current launch threshold. Current launch is below Utah's revenue and consumer data thresholds.	Stackie tracks Utah access, deletion, portability, opt-out, and sensitive data notice posture. Tracked rights if the regime applies: access, deletion, portability, opt out of sale, sharing, or targeted advertising, non-discrimination. Appeal or complaint: Utah requests may be escalated internally through the privacy contact. GPC or universal opt-out: Universal opt-out signal handling is tracked and activated where a covered state law requires it. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Oregon Consumer Privacy Act	Below the current launch threshold. Current launch is below Oregon's consumer and consumer plus revenue thresholds.	Stackie tracks Oregon rights, appeals, opt-outs, and sensitive data consent posture. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: GPC or legally required universal opt-out signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Texas Data Privacy and Security Act	Below the current launch threshold. Current launch is treated as small business exempt, with sensitive data sale consent restrictions preserved.	Stackie tracks Texas rights, appeals, universal opt-out mechanism, and sensitive data restrictions before growth beyond startup scale. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: GPC or legally required universal opt-out signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Montana Consumer Data Privacy Act	Below the current launch threshold. Current launch is below Montana's consumer and consumer plus sale revenue thresholds.	Stackie tracks Montana rights, appeals, universal opt-out mechanism, and sensitive data consent posture. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: GPC or legally required universal opt-out signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Delaware Personal Data Privacy Act	Below the current launch threshold. Current launch is below Delaware's consumer and consumer plus revenue thresholds.	Stackie tracks Delaware rights, appeals, universal opt-out mechanism, and sensitive data consent posture. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: GPC or legally required universal opt-out signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Iowa Consumer Data Protection Act	Below the current launch threshold. Current launch is below Iowa's consumer and consumer plus revenue thresholds.	Stackie tracks Iowa access, deletion, portability, opt-out, and sensitive data notice posture. Tracked rights if the regime applies: access, deletion, portability, opt out of sale, sharing, or targeted advertising, non-discrimination. Appeal or complaint: Iowa requests may be escalated internally through the privacy contact. GPC or universal opt-out: Universal opt-out signal handling is tracked and activated where a covered state law requires it. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Nebraska Data Privacy Act	Below the current launch threshold. Current launch is treated as small business exempt, with sensitive data sale consent restrictions preserved.	Stackie tracks Nebraska rights, appeals, opt-outs, and sensitive data restrictions before growth beyond startup scale. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: Universal opt-out signal handling is tracked and activated where a covered state law requires it. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	New Hampshire privacy law	Below the current launch threshold. Current launch is below New Hampshire's consumer and consumer plus revenue thresholds.	Stackie tracks New Hampshire rights, appeals, opt-outs, and sensitive data consent posture. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: Universal opt-out signal handling is tracked and activated where a covered state law requires it. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	New Jersey Data Privacy Act	Below the current launch threshold. Current launch is below New Jersey's consumer and consumer plus revenue thresholds.	Stackie tracks New Jersey rights, appeals, opt-outs, universal opt-out mechanism, and sensitive data consent posture. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: GPC or legally required universal opt-out signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Tennessee Information Protection Act	Below the current launch threshold. Current launch is below Tennessee's revenue and consumer data thresholds.	Stackie tracks Tennessee rights, appeal handling, opt-outs, and privacy program safe harbor requirements before growth. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: Universal opt-out signal handling is tracked and activated where a covered state law requires it. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Minnesota Consumer Data Privacy Act	Below the current launch threshold. Current launch is below Minnesota's consumer and consumer plus revenue thresholds.	Stackie tracks Minnesota rights, appeals, opt-outs, universal opt-out mechanism, and sensitive data consent posture. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: GPC or legally required universal opt-out signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Maryland Online Data Privacy Act	Below the current launch threshold. Current launch is below Maryland's consumer and consumer plus revenue thresholds.	Stackie tracks Maryland rights, opt-outs, data minimization, and sensitive data restrictions before growth. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: GPC or legally required universal opt-out signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Indiana Consumer Data Protection Act	Below the current launch threshold. Current launch is below Indiana's consumer and consumer plus revenue thresholds.	Stackie tracks Indiana rights, appeals, opt-outs, and sensitive data consent posture. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: Universal opt-out signal handling is tracked and activated where a covered state law requires it. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Kentucky Consumer Data Protection Act	Below the current launch threshold. Current launch is below Kentucky's consumer and consumer plus revenue thresholds.	Stackie tracks Kentucky rights, appeals, opt-outs, and sensitive data consent posture. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: Universal opt-out signal handling is tracked and activated where a covered state law requires it. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Rhode Island Data Transparency and Privacy Protection Act	Below the current launch threshold. Current launch is below Rhode Island's consumer and consumer plus revenue thresholds.	Stackie tracks Rhode Island transparency, rights, opt-outs, and sensitive data posture before growth. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: Universal opt-out signal handling is tracked and activated where a covered state law requires it. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.
United States baseline with state privacy overlays	Florida Digital Bill of Rights	Below the current launch threshold. Current launch is below Florida's high revenue and covered digital business thresholds.	Stackie tracks Florida rights, opt-outs, children's data, and sensitive data restrictions before any covered high scale processing. Tracked rights if the regime applies: access, deletion, correction, portability, opt out of sale, sharing, or targeted advertising, limit use of sensitive data, non-discrimination. Appeal or complaint: State-law appeals are provided where an applicable state privacy law requires them. GPC or universal opt-out: GPC or legally required universal opt-out signals are honored where technically implemented and legally required. Tracking posture: Nonessential tracking and targeted advertising remain disabled unless applicable consent and preference-signal controls are implemented. Sensitive data: Stackie does not intentionally request sensitive data for launch.

Approved Subprocessors and Service Providers

Vendor Legal Name	Service Category	Role	Purpose	Regions	Transfer Mechanism	Transfer Coverage	Transfer Notice Days	Change Notice Days	Notice/Objection Route	Replacement Notice
Cloudflare, Inc.	Package and encrypted infrastructure state storage	processor	Stores package artifacts and delivery metadata for Stackie downloads, plus encrypted infrastructure state needed to operate the service.	United Kingdom, European Union and EEA, United States	EEA Standard Contractual Clauses	EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis	30	30	Email [email protected] for DPA, subprocessor, transfer, or objection notices.	Stackie will publish notice before material replacement where required by the DPA or applicable law.
Cloudflare, Inc.	Cloud application hosting and request handling	processor	Runs Stackie Cloud request handling, rate limiting, and service runtime operations.	United Kingdom, European Union and EEA, United States	EEA Standard Contractual Clauses	EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis	30	30	Email [email protected] for DPA, subprocessor, transfer, or objection notices.	Stackie will publish notice before material replacement where required by the DPA or applicable law.
Cloudflare, Inc.	Transactional email delivery	processor	Sends account verification, password reset, and account lifecycle emails.	United Kingdom, European Union and EEA, United States	EEA Standard Contractual Clauses	EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis	30	30	Email [email protected] for DPA, subprocessor, transfer, or objection notices.	Stackie will publish notice before material replacement where required by the DPA or applicable law.
Neon, Inc.	Managed database hosting	processor	Stores Stackie Cloud account, authentication, billing, audit, security, usage, and package metadata records.	United Kingdom, European Union and EEA, United States	EEA Standard Contractual Clauses	EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis	30	30	Email [email protected] for DPA, subprocessor, transfer, or objection notices.	Stackie will publish notice before material replacement where required by the DPA or applicable law.
Functional Software, Inc. d/b/a Sentry	Operational fault monitoring and private diagnostic release artifacts	processor	Receives minimized operational telemetry and private JavaScript release artifacts needed to detect, diagnose, measure and remediate faults on approved Stackie surfaces.	European Union and EEA, United States	EEA Standard Contractual Clauses	EEA Standard Contractual Clauses, UK Addendum to the EEA SCCs, UK International Data Transfer Agreement, Data Privacy Framework or equivalent certified transfer basis	30	30	Email [email protected] for DPA, subprocessor, transfer, or objection notices.	Stackie will publish notice before material replacement where required by the DPA or applicable law.

Independent Controllers and Payment Providers

Vendor Legal Name	Service Category	Role	Purpose	Regions	Transfer Mechanism	Transfer Coverage	Transfer Notice Days	Change Notice Days	Notice/Objection Route	Replacement Notice
Google LLC	Optional account sign-in provider	independent controller	Provides Google account sign-in when a user chooses that method.	United States, European Union and EEA, United Kingdom	Data Privacy Framework or equivalent certified transfer basis	Data Privacy Framework or equivalent certified transfer basis, contractual transfer terms	30	30	Email [email protected] for third-party recipient privacy questions.	Independent controller sign-in provider entry; disclosed separately from subprocessor approvals.
Paddle.com Market Limited	Merchant-of-record billing and tax services	independent controller	Provides checkout, subscription management, invoicing, tax, and billing support as merchant of record.	United Kingdom, European Union and EEA, United States	Data Privacy Framework or equivalent certified transfer basis	Data Privacy Framework or equivalent certified transfer basis, contractual transfer terms	30	30	Email [email protected] for billing-recipient privacy questions.	Stackie will publish notice before material replacement where required by the DPA or applicable law.

Notice and Transfer Evidence

Recipient	Role	Notice Days	Recipient Terms Posture
Paddle.com Market Limited - Merchant-of-record billing and tax services	independent controller	30	Covered by recipient-specific written terms
Google LLC - Optional account sign-in provider	independent controller	30	Independent controller terms apply; no processor addendum is required for this disclosed role
Cloudflare, Inc. - Cloud application hosting and request handling	processor	30	Covered by written processor or subprocessor terms
Cloudflare, Inc. - Transactional email delivery	processor	30	Covered by written processor or subprocessor terms
Cloudflare, Inc. - Package and encrypted infrastructure state storage	processor	30	Covered by written processor or subprocessor terms
Neon, Inc. - Managed database hosting	processor	30	Covered by written processor or subprocessor terms
Functional Software, Inc. d/b/a Sentry - Operational fault monitoring and private diagnostic release artifacts	processor	30	Covered by written processor or subprocessor terms