Privacy Policy

Your data is yours. This policy explains, in plain language, what Stacks collects, why, who we share it with, and the rights you have. We never sell your personal information.

1. Who We Are

Stacks is a product of Vantage Technologies, LLC, a Delaware limited liability company ("Vantage," "we," "us," or "our"). We operate the website stackscrm.com. Stacks is a multi-tenant software-as-a-service (SaaS) platform that gives small and mid-sized businesses CRM, scheduling, invoicing, review management, email marketing, and support tools. Each business customer ("tenant") receives its own isolated environment to manage its operations and customer relationships.

Business address: 204 37th Ave N, St Petersburg, FL 33704, USA

This Privacy Policy covers three categories of individuals:

• (a) Website visitors — anyone browsing stackscrm.com
• (b) Subscribers / account holders — businesses that sign up for a Stacks account ("tenants")
• (c) End users — customers of our tenants whose data is stored within the platform

2. Information We Collect

Website Visitors

When you browse stackscrm.com, we may automatically collect:

• Usage data — pages visited, time on site, referring URL, click behavior
• Device information — browser type, operating system, screen size
• IP address — for security, fraud prevention, and approximate geolocation
• Analytics cookies — Google Analytics (property G-KVSP90BC9E) sets _ga and _ga_* cookies to measure site usage, subject to your consent. See our Cookie Policy for details and controls.

Subscribers (Account Holders / Tenants)

When you create a Stacks account, we collect:

• Name and email address
• Company name
• Payment information — processed securely by Stripe. We never store your full card numbers on our servers.
• Account settings and preferences
• Integration credentials — such as email-provider API keys, which are stored encrypted at rest

End Users of Tenants

When a tenant uses Stacks to run its business, data about that tenant's customers may be stored within the platform, including:

• Contact information — name, email, phone number, address
• Communication records — emails, notes, interaction history
• Appointment data — bookings and scheduling records
• Invoice data — billing records and payment history
• Review data — customer reviews and feedback

All end-user data is stored in the tenant's dedicated, isolated database and is controlled by the tenant. See Section 4.

What We Do NOT Collect

We do not collect Social Security numbers, health information, or biometric data through our website or platform.

3. How We Use Your Information

• Provide and improve our services — operate the platform, deliver features, fix bugs, build new functionality
• Process payments — charge subscription fees and process transactions through Stripe
• Send transactional emails — booking confirmations, invoice notifications, password resets, and account alerts necessary to deliver the service
• Send marketing emails — newsletters and product updates, only if you have explicitly opted in. You can unsubscribe at any time.
• Respond to inquiries — answer support questions and contact-form submissions
• Analyze usage — understand how people use our website and platform to improve the experience
• Prevent fraud and abuse — detect and prevent unauthorized access, spam, and other malicious activity

Transactional vs. marketing emails: Transactional emails are required to deliver the service you requested and are sent regardless of your marketing preferences. Marketing emails are sent only with your opt-in consent and include an unsubscribe link in every message.

4. Our Role as Data Processor

Stacks serves two distinct roles depending on the data involved:

• Data controller — for data we collect directly from website visitors and subscribers (Sections 2a and 2b)
• Data processor — for end-user data that tenants store within the platform (Section 2c)

When tenants store their customers' data in Stacks, we act as a data processor on behalf of the tenant, who is the data controller. This means:

• We process end-user data only as instructed by the tenant and as necessary to provide the service.
• We do not use end-user data for our own marketing or analytics purposes.
• Each tenant's data is stored in a dedicated, isolated database. Tenant data is never commingled.
• We do not access tenant databases except as necessary to provide the service, perform maintenance, respond to support requests, or comply with applicable law.
• Tenants are responsible for obtaining appropriate consent from their end users and for complying with applicable privacy laws.

If you are an end user of a business that uses Stacks: for questions about how a specific business handles your data, please contact that business directly — they are the data controller.

A Data Processing Agreement (DPA) is available on request for enterprise tenants. Email support@stackscrm.com.

5. Sub-Processors

We use the following third-party services that may process data on our or our tenants' behalf:

• Stripe — payment processing (PCI DSS Level 1 compliant). Processes subscriber payment information and tenant transaction data.
• Email delivery provider (e.g., SendGrid) — delivery of transactional and marketing emails. Tenants may configure their own provider keys for sending to their customers.
• Google Analytics — website analytics only (property G-KVSP90BC9E), used to measure traffic on stackscrm.com. It does not process tenant customer data.
• Cloud hosting provider — infrastructure and database hosting for the platform and all tenant databases.

We notify tenants of material changes to our sub-processor list. Tenants may object to a new sub-processor within 30 days; if we cannot reasonably accommodate the objection, the tenant may terminate their subscription.

6. Data Sharing

We do not sell your personal information as defined by the California Consumer Privacy Act (CCPA), the California Privacy Rights Act (CPRA), or any other applicable state privacy law.

We share personal information only:

• With sub-processors in Section 5, solely to provide and support our services
• For legal requirements — when required by law, subpoena, court order, or government request
• To protect rights — the rights, property, or safety of Stacks, our users, or the public
• In business transfers — in connection with a merger, acquisition, or sale of assets, with notice to affected users

We never trade or rent personal information to third parties for their marketing purposes.

7. Cookies and Tracking

We use essential cookies to run the site and, with your consent, Google Analytics cookies to measure usage. Analytics are consent-gated: visitors in the EU, UK, EEA, and Switzerland are asked to opt in before any analytics cookies are set, and visitors elsewhere can opt out at any time. Full details, the exact cookies, and controls (including our "Cookie settings" link) are in our Cookie Policy. We honor Global Privacy Control (GPC) signals as an opt-out of analytics where applicable.

8. Data Retention

• Website analytics data — retained per our Google Analytics configuration (up to 14 months), then automatically deleted
• Newsletter subscribers — retained until you unsubscribe
• Active accounts — retained while your workspace is active, including on Free after AI Pro ends
• After explicit workspace closure — Closing a workspace is a separate request from its owner. Closure disables ordinary workspace access. We retain the workspace for 90 days from closure. During that window, the original owner may contact support to request restoration or an export supported by our current tools, subject to ownership verification. After the window ends, restoration and retained export are unavailable and the workspace's live database and uploaded files enter permanent deletion.
• Tenant customer data — retained while the tenant's workspace is active, then subject to the workspace closure process above
• Payment records — retained as required by tax law, typically 7 years

9. Data Security

• Encryption in transit — all data transmitted via HTTPS/TLS
• Encrypted database connections between our application and databases
• Secure password hashing — passwords are hashed with industry-standard algorithms, never stored in plaintext
• Database-per-tenant isolation — each tenant's data lives in a dedicated database, preventing cross-tenant access
• Encrypted credential storage — tenant integration keys and other sensitive credentials are encrypted at rest
• Access controls — access to production systems and customer data is restricted to authorized personnel
• Regular security practices — dependency updates, code review, and security monitoring

While we take reasonable measures to protect your information, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Your Privacy Rights

Wherever you live, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Delete your account and associated data
• Unsubscribe from marketing emails at any time
• Export your data in standard formats

To exercise any of these, email support@stackscrm.com with "Privacy Request" in the subject line.

California Residents (CCPA/CPRA)

• Right to know the categories and specific pieces of personal information we collect
• Right to delete the personal information we have collected
• Right to opt out of sale or sharing — we do not sell personal information; Google Analytics may constitute "sharing" under the CPRA, and you may opt out via Global Privacy Control or by contacting us
• Right to non-discrimination for exercising your rights
• Right to limit use of sensitive personal information — we do not collect sensitive personal information through our website

You may designate an authorized agent with written authorization. We verify identity via email before processing and respond to verified requests within 45 days.

Virginia, Colorado, Connecticut, and Utah Residents

You have rights to access, correct, delete, and port your personal data, and to opt out of targeted advertising and profiling. Colorado and Connecticut residents: we honor Global Privacy Control signals as a universal opt-out. If we deny a request, you may appeal by emailing support@stackscrm.com with "Privacy Appeal" in the subject line.

End Users of Tenants

If your personal data is stored by a business that uses Stacks, that business is the data controller. To exercise your rights, please contact that business directly. We will assist the tenant in responding as required by law.

11. Children's Privacy

Our services are not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child under 16 has provided us personal information, email support@stackscrm.com and we will promptly delete it.

12. Data Breach Notification

In the event of a data breach affecting your personal information, we will notify affected individuals within 72 hours of discovery, notify applicable regulators as required, and — if tenant customer data is involved — notify affected tenants so they can inform their customers.

13. International Data

Stacks is based in the United States, and all data is processed and stored in the United States. By using our website or services, you consent to the transfer of your information to the United States. Enterprise customers with specific data-handling requirements may contact support@stackscrm.com.

14. Changes to This Policy

We may update this Privacy Policy from time to time, posting changes here with a new "Last updated" date. For material changes, we will provide 30 days' notice via email to active subscribers before they take effect. Continued use after changes are posted constitutes acceptance.

15. Contact Us

Questions or requests? Contact us at:

Vantage Technologies, LLC (Stacks)
204 37th Ave N
St Petersburg, FL 33704
Email: support@stackscrm.com

For privacy requests, include "Privacy Request" in the subject line. We respond within 15 business days, or within the timeframe required by applicable state privacy law (typically 45 days) for formal requests.