Draft — pending review. This is a placeholder template and is not final or legally binding. It must be reviewed and completed (including the bracketed TODO items) before launch.

Privacy Policy

Effective date: [EFFECTIVE DATE — TODO]

This Privacy Policy explains how Stackly Suite LLC ("StacklySuite", "we", "us", or "our") collects, uses, and shares information when you use StacklySuite (the "Service").

Summary

We collect the information you give us — your account, your billing details, and the business records you put into the tools — plus basic technical information our servers record when you use the Service.
We use it to run the Service for you: to sign you in, bill you, power the tools, send the emails you ask us to send, and keep everything secure.
We don’t sell personal information, we don’t use your workspace content for advertising, and we don’t use third-party analytics or advertising trackers.
Information about your own customers (such as contacts, invoice recipients, and booking guests) belongs to your business. We process it only on your behalf.
We share information only with the service providers listed in section 5, and only so they can help us run the Service.

1. Who this policy covers

This policy applies to two groups of people:

Account holders and team members — people who sign up for StacklySuite or are invited to join an organization on it. For this information, we decide how it is used and are responsible for it.
People whose information our customers store in the Service — for example, a business’s contacts, the people it sends invoices to, and the people who book appointments through its public booking page. We process this information on behalf of that business and only under its instructions. If this describes you, the business you dealt with is responsible for how your information is used, so please contact them first; we will help them respond to your request.

2. What we collect, how we collect it, and how we use it

Each category below lists the information involved, where it comes from, and what we use it for. We use information only for the purposes listed for its category.

Account and organization information

What we collect: Your name, email address, and profile details; your organization’s name; your role in the organization (admin or member); and which tools you have been assigned a seat in. Your password is handled by our authentication provider — we never receive or store it.
How we collect it: You provide it when you sign up or edit your profile, or a teammate provides your email address when they invite you. Our authentication provider (Clerk) then shares your name, email address, and organization membership with us.
How we use it: To create and secure your account, sign you in, apply your organization’s roles and seat assignments, and send you account and service notices.

Billing and subscription information

What we collect: The tools your organization subscribes to, your billing period, seat counts, applied discounts, and your payment and refund history. Card details are entered directly with our payment provider (Stripe). We never see or store full card numbers; we keep only references to your Stripe customer and subscription records and a summary of each charge.
How we collect it: You enter it on checkout and billing pages hosted by Stripe. Stripe then notifies us when a payment succeeds, fails, or is refunded.
How we use it: To charge for your subscription, apply pricing and multi-tool discounts, decide which tools your organization can access, send receipts and billing notices, process refunds, and prevent fraud.

Content you put into the tools

What we collect: The business records you create, import, or upload — for example, contacts (names, companies, email addresses, phone numbers, and addresses), invoices and estimates, products and services, CRM deals, activities, and follow-ups, bookkeeping accounts and journal entries, imported bank-transaction files, receipt attachments, notes, and scheduling services, availability, and appointments.
How we collect it: You and your team enter it directly, import it from files (such as CSV), or upload attachments.
How we use it: Only to provide the tools to your organization: storing, displaying, and searching it, generating PDFs and reports, and sending the emails you ask us to send (such as invoices, estimates, overdue-payment reminders, and appointment notices). We look at it ourselves only to fix a problem you report to us, or when needed for security or to comply with the law.

Information from people who book through a booking page

What we collect: The guest’s name, email address, and (optionally) phone number; the service and time they chose; and the IP address the booking came from.
How we collect it: The guest submits it on the business’s public booking page.
How we use it: On the business’s behalf: to create the appointment, add the guest to that business’s contact list, send the guest a confirmation, reminders, and notices if the appointment changes, and notify the staff assigned to it. The IP address is used to limit how often the page can be used and to block automated abuse.

Support requests

What we collect: Your name, email address, organization name, and whatever you include in your message.
How we collect it: You send it through the in-app support form or by emailing us.
How we use it: To respond to you, troubleshoot problems, and improve the Service.

Technical, usage, and security information

What we collect: Your IP address, browser and device type, the pages and features you request, timestamps, and error details. We also keep an activity log of significant actions in each organization (such as subscription changes, role changes, and records created), noting who took the action, when, and from which IP address.
How we collect it: Our servers and hosting provider record it automatically when you use the Service.
How we use it: To operate and secure the Service, diagnose problems, detect and prevent abuse, and investigate security incidents.

We do not currently use any third-party analytics, advertising, or tracking tools, and we do not collect your precise location. [TODO: update this section and section 5 before enabling product analytics or error monitoring (e.g. PostHog, Sentry).]

3. What we don't do

We don’t sell or rent personal information, and we don’t share it for targeted advertising.
We don’t use the content in your workspace to advertise to you or to anyone else.
We don’t send marketing messages to your contacts, invoice recipients, or booking guests. They receive email from the Service only as part of a feature your organization uses — for example, when you send an invoice, turn on payment reminders, or when they book an appointment.

4. Cookies and browser storage

We use only what the Service needs in order to work:

Sign-in cookies — set by our authentication provider to keep you signed in and protect your session.
Browser storage — to remember your display preference (light or dark theme) on your device.

We don’t use advertising or cross-site tracking cookies. Because the cookies above are strictly necessary, the Service won’t work properly if you block them.

5. How we share information

We don’t sell your personal information. We share it only in the following situations.

Service providers. These companies help us run the Service and may use the information only to provide their services to us:

Clerk — sign-in, accounts, and organization management
Stripe — payment processing and subscription billing
Resend — delivering the emails the Service sends
Render — hosting our application, database, and background processing
Cloudflare (R2) — storing files you upload, such as receipt attachments

[TODO: confirm this list before launch and keep it current.]

Within your organization. Members of your organization can see the information in the tools they have been assigned to. Admins can also manage members, roles, seats, and billing.

People you send things to. When you send an invoice, estimate, or reminder, or when someone books an appointment with you, the recipient receives the relevant details (for example, the invoice contents or the appointment time).

Legal and safety reasons. When required by law or legal process, or when needed to protect the rights, safety, or security of our users, the public, or the Service.

Business transfers. In connection with a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your information.

Our own staff. A small number of authorized staff can view account, membership, and billing records in order to provide support and handle billing. We access the content in your workspace only when you ask us to help with a problem, or when needed for security or to comply with the law.

6. Data retention

Account and workspace data is kept for as long as your organization’s account is active.
When you delete your account or organization, we delete the associated information within [TODO: number] days, except as described below.
The activity log is kept for [TODO: period] for security and compliance, including after an account is deleted. It records actions and IP addresses, not the contents of your records; entries for public bookings do not include a guest’s name or contact details.
Billing records are kept for as long as tax and accounting laws require.
Booking-page abuse counters store only a one-way hash of the IP address and expire automatically after a short time.
Backups are deleted on a rolling schedule of [TODO: period].

7. Security

We use technical and organizational measures designed to protect your information, including:

encryption of all data in transit (HTTPS);
an additional layer of encryption (AES-256) for contact email addresses, phone numbers, and street addresses, and for booking guests’ names, email addresses, and phone numbers;
database-level separation, so each organization can only reach its own data;
private file storage, with uploaded files available only through short-lived links;
role-based access within each organization.

No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

8. Your rights and choices

Update your profile at any time from your account settings.
Manage your workspace content — you and your team can edit or delete records in the tools at any time.
Make a privacy request. Depending on where you live, you may have the right to access, correct, delete, or export your personal information, or to object to or restrict certain processing. To make a request, contact us at support@stacklysuite.com.
If you are a customer or booking guest of a business that uses StacklySuite, please send your request to that business. If you contact us instead, we will refer your request to them and help them respond.

[TODO: confirm applicable regimes (e.g. GDPR, CCPA) and your response process with counsel.]

9. International data transfers

We are based in the United States, and your information is processed and stored in the United States and in other countries where our service providers operate. These countries may have different data-protection laws from your own. Where required, we use appropriate safeguards for such transfers. [TODO: specify transfer mechanisms if applicable.]

10. Children's privacy

The Service is not directed to children, and we do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us so we can delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will provide notice as required by law. The effective date above reflects the latest version.

12. Contact us

Questions about this Privacy Policy or your data? Email us at support@stacklysuite.com.