Privacy Policy

1. Introduction

stackloader, Inc. (“stackloader”, “we”, “us”, or “our”) is committed to protecting your personal data. This Privacy Policy explains what information we collect when you visit stackloader.io or use our services, how we use it, and the rights you have over it.

For the purposes of the EU General Data Protection Regulation (GDPR) and the UK GDPR, stackloader, Inc. is the data controller. Our registered address is 123 Technology Way, London, EC1A 1BB, United Kingdom.

If you have questions about how we handle your data, contact us at privacy@stackloader.io.

2. Information We Collect

2.1 Information you provide directly

• Contact data — name, email address, company name, and message content when you submit a contact, demo, or careers enquiry form.
• Account data — if you create an account with us: email address, chosen password (stored as a salted hash), and profile information.
• Communications — records of correspondence when you contact us by email or through the site.

2.2 Information collected automatically

• Usage data — pages visited, features interacted with, time on site, referral URLs, and actions taken within our platform.
• Device and log data — IP address, browser type and version, operating system, screen resolution, and unique device identifiers.
• Cookie data — see Section 8 and our Cookie Policy for full details.

2.3 Payment data

We use Stripe to process payments. We never receive or store your full card number, CVC, or expiry date. Stripe processes payment data under their own privacy policy as an independent data controller.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve our services;
• Respond to your enquiries and manage your relationship with us;
• Send transactional emails (account confirmations, password resets, service notifications);
• Send marketing communications where you have given consent or where we have a legitimate interest;
• Analyse usage to improve performance and user experience;
• Detect, prevent, and investigate security incidents or fraud;
• Comply with legal obligations.

4. Legal Basis for Processing (GDPR)

Where the GDPR applies, we rely on the following legal bases for processing your personal data:

• Contract (Art. 6(1)(b)) — processing necessary to fulfil our contract with you, such as delivering the services you have requested.
• Legitimate interests (Art. 6(1)(f)) — fraud prevention, network and information security, service improvement, and direct marketing to existing customers where not overridden by your rights.
• Consent (Art. 6(1)(a)) — analytics and marketing cookies, and newsletter subscriptions. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation (Art. 6(1)(c)) — where we are required to retain data by law (e.g. financial records).

5. Data Sharing and Third Parties

We do not sell your personal data. We share it only with third-party service providers acting as data processors on our behalf, under appropriate contractual protections:

• Infrastructure and hosting — Vercel (hosting), AWS (cloud infrastructure);
• Analytics — where you have consented, we use anonymised analytics to measure site performance;
• Payments — Stripe, Inc.;
• Email delivery — transactional email via a third-party email provider;
• Error tracking — anonymised crash reports to diagnose and fix software defects.

We may also disclose personal data where required by law, court order, or regulatory authority, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you).

6. Data Retention

• Account data — retained for the duration of your account, then deleted or anonymised within 30 days of closure unless a longer period is required by law.
• Contact form submissions — retained for up to 24 months, then deleted.
• Analytics data — aggregated and anonymised; raw event data retained for up to 26 months.
• Financial records — retained for 7 years as required by UK tax law.
• Server logs — retained for 90 days for security and debugging purposes.

7. International Data Transfers

Some of our service providers are based outside the UK and EEA. When we transfer personal data internationally, we do so under appropriate safeguards, including the UK International Data Transfer Agreement (IDTA), EU Standard Contractual Clauses (SCCs), or an adequacy decision by the relevant regulatory authority.

8. Cookies

We use cookies and similar tracking technologies. Please see our Cookie Policy for full details of the cookies we use, their purpose, and how to manage your preferences.

9. Your Rights

Under the GDPR and UK GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15) — request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17) — request deletion of your data where we have no lawful basis to retain it.
• Right to restriction (Art. 18) — request that we limit how we process your data while a dispute is resolved.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent — where processing is based on consent, withdraw it at any time via our cookie preference centre or by emailing us.

To exercise any of these rights, email privacy@stackloader.io. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version on this page with an updated “Last updated” date. Where changes are material, we will notify registered users by email. Continued use of our services after the effective date constitutes acceptance of the revised policy.

12. Contact Us

For any privacy-related enquiries or to exercise your rights, contact our Data Protection Lead:

• Email: privacy@stackloader.io
• Post: stackloader, Inc., 123 Technology Way, London, EC1A 1BB, UK