Privacy Policy

How we collect, use, and protect your personal information

Last updated: October 11, 2026

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, use our services, or contact us. This may include:

Name, email address, and contact information
Account credentials and authentication data
Business information and preferences
Usage data and interaction with our AI services
Payment information (processed securely through third-party providers)
Communications with our support team

2. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our AI automation services
Process transactions and manage your account
Send you technical notices, security alerts, and administrative messages
Respond to your inquiries and provide customer support
Personalize your experience with our services
Improve permitted AI features and models using data that is eligible for that purpose. Google API data and data from a connected Shopify store are never eligible: neither is used to train AI models.
Comply with legal obligations and enforce our terms

3. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties except in the following circumstances:

With your explicit consent
To trusted service providers who assist us in operating our platform
To comply with legal requirements or respond to lawful requests
To protect our rights, property, or safety, or that of our users
In connection with a business transfer or acquisition

4. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. This includes encryption in transit and at rest, access controls, and records of access to connected-service data.

Shopify access tokens are encrypted and held only by the Stackado Integration Hub; our other apps never receive them. In the event of a data breach affecting personal data we will notify affected users and regulators as required by law and aim to notify users within 72 hours when feasible.

5. Data Retention

We retain your personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. When we no longer need your information, we securely delete or anonymize it.

Data retention and deletion

Account/profile data: retained until account deletion + 30 days.
Payment records: retained for 7 years for tax/audit purposes.
Usage logs and analytics: retained for up to 24 months, then aggregated or deleted.

To request access, export, or deletion of your personal data, email hello@stackado.com with subject "Privacy request". We will verify your identity and complete the request within 30 days.

6. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information, including:

Access to your personal information
Correction of inaccurate or incomplete information
Deletion of your personal information
Portability of your data
Objection to processing of your information
Withdrawal of consent (where processing is based on consent)

Depending on your jurisdiction you may have rights to access, correct, delete, or port your personal data and to object to processing. To exercise these rights, email hello@stackado.com with subject "Privacy request". We will verify your identity and complete the request within 30 days.

7. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience, analyze usage patterns, and improve our services. You can control cookie settings through your browser preferences, though some features may not function properly if cookies are disabled.

Referral links also use a first-party cookie to remember the referring partner for up to 90 days. It contains the referral code, click time and landing path. When you create an account, we use it to attribute your signup and administer rewards, payment checks and fraud prevention. Blocking or deleting this cookie can prevent referral attribution.

8. Third-Party Services

Our service may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of these external services. We encourage you to read their privacy policies before providing any information.

Third-party processors

We use trusted service providers to run Stackado: Stripe for payments, Clerk for sign-in and user management, Supabase for databases, Vercel for hosting, Upstash Redis for caching and rate limits, Pinecone for search indexes, Resend for notification emails, and AI model providers (OpenRouter and the providers it routes to, OpenAI and Anthropic) to produce the answers and drafts you ask for. Where required by law we enter Data Processing Agreements (DPAs) with our processors. The providers that process data from a connected Shopify store are listed in the Shopify section below.

9. Children's Privacy

Our services are not intended for individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

11. AI and Machine Learning

Our AI services may process workspace data to provide the reports, recommendations, summaries, and automation you request. We may use eligible anonymized and aggregated data to improve permitted AI features and models, subject to applicable law and contractual restrictions. Information received from Google APIs, including Google Search Console and Stackado Workspace data, is not used to train general-purpose AI models. Data from a connected Shopify store is not eligible at all, even anonymized or aggregated: see the Shopify section below. You can contact us about available processing choices.

Google account data and OAuth access

If you connect Google Search Console through Klik, Stackado Integration Hub requests only read-only Search Console access. The connection lets you select a verified property and use its queries, pages, clicks, impressions, click-through rate, and average position in visible Klik reports and SEO recommendations. Google OAuth credentials are encrypted and handled only by Stackado Integration Hub.

If you connect Stackado Workspace, the Integration Hub may request access to Google Drive files (including Docs, Sheets, and Slides), Drive activity, Calendar events and calendar lists, Meet spaces, Google Contacts, and other contacts. Stackado uses that access only to provide the specific search, reading, creation, update, scheduling, contact, and automation actions you request in Stackado or an app you explicitly bind to the connection. OAuth access and refresh tokens are encrypted and are not exposed to connected satellite apps.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not sell Google user data, use it for advertising or credit decisions, or use it to train general-purpose AI models. We transfer it only as needed to provide the user-requested service, maintain security, comply with law, or complete a business transaction with appropriate safeguards.

You can disconnect Search Console or Stackado Workspace in the relevant Stackado integration screen. This stops future access, disables dependent integrations, cryptographically discards the stored credential, and requests Google token revocation. You can also revoke access from your Google Account security settings or contact hello@stackado.com. The Klik privacy policy provides further details about stored Search Console reports and retention.

Shopify stores

When a merchant installs the Stackado app in Shopify, Stackado processes data from that store on the merchant's behalf. For the store's customers (shoppers), the merchant decides why their data is used and Stackado acts as the merchant's processor. Shoppers should send privacy requests to the store; you can also email hello@stackado.com and we will help the merchant answer.

What we read. The store's products, prices and stock; its published policies and pages, when the merchant allows it; orders from the last 60 days onward (order number, dates, payment and delivery status, items and totals); and the customer's Shopify ID, name and email address. We read a customer's email marketing choice live, at the moment it matters, and do not keep a copy. We do not request customers' postal addresses or phone numbers, or orders older than 60 days.

How we use it.

To answer a shopper's question about their own order in the store chat. Signed-in shoppers are matched by Shopify's verified customer ID; a guest must give the exact email and order number before that one order is shown.
To give the merchant sales and customer summaries when they ask Zuzu, our assistant. Zuzu sees customers' names and masked email addresses only; the full address stays in the Stackado Integration Hub.
To send review requests and order follow-ups the merchant approves, from the merchant's own mailbox. The address is looked up only when the message is sent, and nobody who has unsubscribed from the store's emails is contacted. Marketing messages go only to customers who have agreed to them.
To show orders on the merchant's customer timeline and daily sales summary, when the merchant turns those on.

AI. Shopify data is never used to train AI models. Stackado does not use data from a connected Shopify store — products, orders, customers, conversations, or anything derived or aggregated from them — to develop, train or improve any AI or machine-learning model. We send it to AI model providers only to produce the answer, summary or draft you asked for, under provider terms and settings that do not allow them to train on it.

Storage and deletion. Shopify access tokens are encrypted and never leave the Integration Hub. The order list behind sales summaries keeps customers' names and emails encrypted, is kept while the store is connected, and is deleted for a customer when Shopify sends their erasure request and for the whole store when Shopify sends the store erasure request (normally 48 hours after uninstalling). Raw Shopify messages and customer data reports are encrypted and deleted after 30 days. Review requests keep only a scrambled customer key and the label "Shopify customer", and those are erased with the customer. After a store is erased we keep only the minimum needed to reconnect it for 90 days.

Who processes it for us.

Supabase: databases that store connection records, the encrypted order list and support conversations
Vercel: hosting for Stackado and its apps
Upstash: short-lived caches and rate limits
Pinecone: the search index behind the store chat's product knowledge
Clerk: sign-in and team accounts
Resend: notification emails to the merchant
OpenRouter and the AI model providers it routes to, OpenAI and Anthropic: AI models that write the answers and summaries you ask for

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our services after such changes constitutes acceptance of the updated policy.

13. Contact Us

Stackado is a brand operated by Micki Kristensen, Allegade 1 E, 1. th, 8700 Horsens, Denmark. This is the person you contract with when you use Stackado. If you have questions about this privacy policy or our privacy practices, please contact us at:

Email: hello@stackado.com
Subject: Privacy Policy Inquiry
Response Time: We reply within one business day. Privacy requests are completed within 30 days.