Privacy Notice

Stackless Data, Inc. is a Delaware corporation at 548 Market Street, Ste. 79325, San Francisco, CA 94104, United States. We are responsible for the personal information this notice describes about our website visitors, our business contacts and the people who use our platform. When we process Customer Data for a customer, the customer decides how it is used, so please send requests about that data to them.

For any privacy question or request, email legal@stacklessdata.com.

Stackless distinguishes between three data types:

• Customer Data & Partner Data: Information customers provide for processing
• Service Data: Personal information collected during platform provision, excluding customer/partner data

Service Data includes:

• Platform payments and transactions
• Platform settings and configurations
• Technical usage details and operational metrics
• Direct communications with support teams

When you visit stacklessdata.com, we and our partners use cookies, pixels and similar technologies to understand how the site is used, measure our advertising, and see which businesses visit, and in the United States which professionals visit, so we can follow up with them. These tools may collect your IP address, approximate location, device and browser details, the pages you view, and the site that referred you.

The tools on our website are:

• HubSpot: site analytics, forms, meeting booking, and our cookie consent banner
• Google Analytics and Google Tag Manager: site analytics
• Google Ads: measuring our advertising
• LinkedIn Insight Tag: measuring our LinkedIn advertising
• RB2B: identifying business visitors in the United States
• LiveIntent: an identity service that RB2B loads on our site

The next paragraph applies only to visitors in the United States, because RB2B runs only for visitors whose IP address places them there.

When you visit our website, cookies and similar technologies may be used by our online data partners or vendors, including RB2B, to associate these activities with other personal information they or others have about you, including by association with your email. We, or service providers acting for us, may then send communications and marketing to these email addresses. You may opt out of receiving this advertising at app.retention.com/optout.

Our cookie banner lets you choose which kinds of cookies we use. Visitors in the United States can turn analytics and advertising cookies off in the banner, and they are on until they do. Everywhere else, including the EU, EEA, UK and Switzerland, visitors are asked first, and no analytics or advertising cookies are used unless they accept them. RB2B runs only for visitors whose IP address places them in the United States, and only while advertising cookies are allowed. Google Ads and the LinkedIn Insight Tag do not use advertising cookies without them. If your browser sends a Global Privacy Control signal, we treat it as a choice to turn analytics and advertising cookies off.

You can change your choice at any time with the Cookie Settings link in the footer of our main pages. If your browser sends a Global Privacy Control signal, turn that signal off in your browser to change this choice.

Processing purposes include:

• Delivering requested Platform Services
• Optimizing service use through recommendations
• Maintaining and improving Platform Services
• Providing technical support and professional services
• Detecting and preventing fraud, abuse, and security risks
• Meeting legal obligations
• Marketing our services, including following up with businesses that visit our website
• Other purposes with explicit consent

We may use Service Data together with information we collect from other Stackless products and services.

Service Data may be processed across multiple international data centers. Stackless employs:

• Encryption at rest and in transit
• Regular security audits
• Restricted employee access with confidentiality obligations
• Physical security measures

Stackless shares Service Data only when:

• Users provide explicit consent
• Administrators or authorized resellers require access
• Third-party processors handle data per instructions
• Legal obligations necessitate disclosure
• Business reorganization occurs

Information about visits to our website is shared with the tools described under Website Visitors, Cookies & Tracking, as set out there.

Service Data is deleted or anonymized once it is no longer needed. Retention periods vary by data type and business purpose, with extended retention for tax, fraud prevention, and legal compliance needs.

If you are in the UK, EU, EEA or Switzerland, your rights and how to use them are set out under UK, EU, EEA & Swiss Visitors and Contacts below.

California residents have CCPA rights including data access, deletion requests, and non-discrimination protections.

Anyone can use the RB2B opt-out described above at app.retention.com/optout and change their cookie choices with Cookie Settings.

This section applies if you are in the United Kingdom, the European Union, the rest of the European Economic Area or Switzerland. It adds to the rest of this notice and explains how we handle your information under the EU and UK General Data Protection Regulations and the Swiss Federal Act on Data Protection. Stackless Data, Inc., named under Who We Are, is the controller of the personal information described here.

What we collect and where it comes from

• Your visits to our website. HubSpot's scripts load for every visitor so they can show our cookie banner and, on our contact page, our meeting scheduler. Before you choose, or if you decline, HubSpot uses your IP address to pick which banner to show and counts your visit as a page view without cookies, not linked to you or your company. If you accept analytics or advertising cookies, we collect your IP address, approximate location, device and browser details, the pages you view and the site that referred you.
• What you give us. Your name, work email, phone number, job title, company and anything else you tell us when you fill in a form, book a meeting, email us or meet us at an event. When you submit a form, we also record your IP address and the page you sent it from.
• Other sources. Business contact details, such as your name, job title, company, work email and work phone number, from public professional sources like company websites and LinkedIn, from business contact data providers, and from attendee lists of events we take part in. If we got your details from an event's attendee list, we tell you within a month, naming the event, and before using them for anything else. Ask us and we will tell you which providers we use and where your details came from.
• Our emails and calls. We turn off open and click tracking in our sales emails to contacts we know are in these countries. With your agreement, we may record and transcribe calls with you.
• Our platform. If you use the Stackless platform, the Service Data described under Information We Collect.

For visitors whose IP address places them outside the United States, we do not use RB2B or any other tool that names visitors we do not already know. If you accept analytics cookies, HubSpot uses your IP address to work out which company you are visiting from. We may compare that company with people we have met, for example at an event, so we can follow up, and at a small company that can tell us who visited. If you have already given us your details, for example through a form, and you accept cookies, HubSpot may link your visits to that record.

HubSpot also uses the IP address and identifiers its tracking code collects from visitors who accept analytics cookies for its own purposes, as a separate controller, including improving its products and its commercial dataset. We are jointly responsible with HubSpot, which is HubSpot Ireland Limited in the EU, EEA and UK and HubSpot, Inc. elsewhere, for collecting that information on our site and sending it to HubSpot. HubSpot alone is responsible for what it does after that, under HubSpot's privacy policy.

If you accept advertising cookies, the LinkedIn Insight Tag and Google's advertising tags collect information about your visit for LinkedIn and Google. We are jointly responsible with LinkedIn and with Google for collecting that information on our site and sending it to them. In the EU, EEA and Switzerland that is LinkedIn Ireland Unlimited Company and Google Ireland Limited, and in the UK it is LinkedIn Corporation and Google LLC. Each of them alone is responsible for what it does with it after that, under LinkedIn's privacy policy and Google's privacy policy. You can use your rights about that collection with us, with LinkedIn or with Google.

Why we use it and our legal basis

• Showing our cookie banner and counting visits without cookies, before you choose or if you decline. We rely on our legitimate interest in running our website and asking for your choice.
• Analytics and advertising cookies, and what we learn from them, including the company you visit from, matching it with people we have met, and how our ads perform. We rely on your consent, given in our cookie banner. You can withdraw it at any time with Cookie Settings. Withdrawing does not affect what we did before.
• Contacting businesses and professionals about Stackless, including emailing you at work about services relevant to your role, and keeping a record of our conversations. We rely on our legitimate interest in promoting and selling our services to businesses. We follow the email marketing rules of the country you are in, and in some countries that means we only email you if you have agreed.
• Recording and transcribing calls. We rely on your consent, which we ask for before we record.
• Answering you when you contact us, and setting up a pilot or contract you ask for. We rely on our legitimate interest in responding to people who contact us and in doing business with your company.
• Providing, supporting and improving the Stackless platform for people at our customers, including technical support, professional services and recommendations on how to use it, and using Service Data together with information from our other products and services. We rely on our legitimate interest in providing, securing and improving the service your company has signed up for.
• Meeting our legal obligations, such as keeping tax and accounting records and answering lawful requests from authorities. Where EU, UK or Swiss law requires it, we rely on that legal obligation. For US and other laws, we rely on our legitimate interest in complying with them.
• Keeping our website and platform secure, and preventing fraud and abuse. We rely on our legitimate interest in protecting our business, our customers and the people who use our services.
• Selling or reorganizing our business, including sharing information with a buyer or successor. We rely on our legitimate interest in being able to sell or restructure our business.
• Anything else we ask your permission for. We rely on your consent.

No law requires you to give us personal information, and the website works if you decline cookies. If you do not give us your details, we cannot reply to you, set up a pilot or contract, or give you a login to our platform. We do not make decisions about you that have legal or similarly significant effects based only on automated processing.

Your right to object

Where we rely on our legitimate interests, you can object at any time to how we use your information. If you object to direct marketing, including our sales emails, we will stop using your information for it. To object, reply to any of our emails or write to legal@stacklessdata.com.

Who we share it with

• The providers that run our website, including our hosting provider and the cookie banner, analytics and advertising tools named under Website Visitors, Cookies & Tracking, except RB2B and LiveIntent, which only run for visitors whose IP address places them in the United States. HubSpot also uses what it collects from visitors who accept analytics cookies for its own purposes, as described above.
• The providers we use for our contact records, email, calendar, video calls, call notes and business contact data. Ask us for the current list.
• For people who use our platform, administrators at your company and our authorized resellers.
• Our professional advisers, and authorities where the law requires it.
• A buyer or successor if our business is reorganized or sold.

How long we keep it

• Cookies last as long as each tool sets them, up to two years. HubSpot's main tracking cookies last six months.
• Website visit data stays with the company or contact record it belongs to, and is deleted with that record. Google Analytics keeps our analytics data for up to 14 months. Google Ads and LinkedIn keep what their tags collect under their own policies.
• Company records, and the visit data on them, are kept for three years after the company's last visit or contact with us, then deleted.
• Business contact details of people who are not customers are kept for three years from when we collected them or from your last reply or other contact from you, whichever is later, then deleted.
• Call recordings and transcripts are kept for 12 months, then deleted.
• Customer and contract records are kept while we work together and afterwards for as long as tax and other laws require. Service Data is kept as described under Retention & Deletion.

Where we keep your information

Stackless is a US company. We collect your information directly from you or from the sources above, and we and the tools we use for our website and contact records keep it in the United States. LinkedIn and Google may also process what their tags collect in Ireland and other countries where they operate. Service Data from our platform may also be processed in data centers in other countries, as described under Data Storage & Security. US law may not protect your information as strongly as the law where you live, and the safeguards described here are the ones we rely on. The main providers we use, HubSpot, Inc., Google LLC and LinkedIn Corporation, are each certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. That certification covers personal data those companies receive from Europe, not information once we hold it.

Your rights

You can ask us to give you a copy of your personal information, correct it, delete it, restrict how we use it, or give it to you in a portable format where the law gives you that right. You can also object to how we use it, as described above, and withdraw your consent at any time without affecting what we did before you withdrew it. For cookies, you can do that with Cookie Settings.

To use any of these rights, email legal@stacklessdata.com. We will reply within one month. If a request is complex or we receive many, we may take up to two more months, and we will tell you why within the first month. Under Swiss law we answer access requests within 30 days, or tell you within 30 days when we will. We may need to confirm who you are first.

Complaints

To complain to us, email legal@stacklessdata.com. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay.

You can also complain to the data protection authority where you live, where you work, or where you think the problem happened. For example, that is the CNIL in France (cnil.fr) and the Information Commissioner's Office in the UK (ico.org.uk). In Switzerland you can report a concern to the Federal Data Protection and Information Commissioner (edoeb.admin.ch). The European Data Protection Board lists the authority for each EU and EEA country at edpb.europa.eu.