Privacy Policy

STACKD respects your privacy and is committed to protecting personal data.

This Privacy Policy explains how STACKD collects, uses, stores and shares personal data.

STACKD processes personal data in accordance with applicable data-protection laws, including the UAE Personal Data Protection Law, UK GDPR and Data Protection Act 2018 where applicable, EU GDPR where applicable, and other local laws where their territorial or mandatory rules apply.

Account information may include name, email, company name, website, industry, subscription information, usage data and limited billing or payment metadata received from STACKD's payment processor, such as card type or brand, last four digits, expiry information, billing details, payment status, transaction identifiers and customer or payment-account identifiers. Complete credit or debit card numbers and card security codes (CVV/CVC) are processed by the payment processor and are not directly stored by STACKD.

Onboarding information may include company information, founding date, business stage, team size, funding status, brand identity, colours, fonts, tone of voice, brand guidelines, target audience, competitor names and social handles, spokesperson information, PR goals, social-media goals and communication preferences.

Platform information may include content, campaign information, journalist data, social-media account data, followers, engagement data, posts, usage information and communications with Dina and Layal.

Technical information may include IP address, device information, browser, operating system, pages visited, usage information, cookies and security logs.

We may use personal data to provide STACKD, operate Dina and Layal, personalise outputs, process payments, provide customer support, send service notifications and reports, maintain security, prevent abuse, detect fraud, improve performance, develop features and comply with legal obligations.

STACKD does not sell customer personal data.

STACKD does not use customer content to train general AI models for unrelated customers, except where expressly disclosed and permitted by applicable law and contractual arrangements.

Where required by applicable law, STACKD will identify an appropriate lawful basis for processing personal data, which may include consent, performance of a contract, compliance with legal obligations, legitimate interests where recognised by applicable law, or another lawful basis.

Where consent is relied upon, you may withdraw consent where permitted by law. Withdrawal does not necessarily affect processing that occurred before withdrawal.

STACKD may share information with service providers necessary to operate the platform.

Current or anticipated providers include Stripe for payment processing, including the secure processing of payment-card credentials, Supabase for database and storage, Anthropic/Claude for AI content generation, SendGrid for email delivery, Ayrshare for social-media publishing, Hunter.io for journalist contact lookup, NewsAPI/Diffbot for news monitoring, and Vercel for hosting.

STACKD may add, replace or remove providers where reasonably necessary.

Where customer prompts, context or other information are sent to an AI provider, that processing may be necessary to provide the relevant STACKD functionality.

STACKD will use appropriate contractual and technical arrangements with service providers as required by applicable law.

Customers should not provide highly sensitive personal data unless the relevant STACKD functionality expressly supports such processing.

STACKD may process journalist information obtained from customers, third-party databases, public professional sources and other legitimate sources.

You are responsible for ensuring that journalist data you provide to STACKD may lawfully be processed. Where STACKD sources journalist contact information from third-party databases, you are responsible for satisfying yourself that those sources are lawful for your use case before using them to send communications. Where applicable law, including UK GDPR or EU GDPR, requires a lawful basis for sending electronic marketing communications to journalist recipients, you as the sender are the relevant controller and are responsible for satisfying yourself that a lawful basis or applicable exemption exists. STACKD acts as processor in respect of journalist personal data processed on your instructions.

Where you determine the purposes and means of processing journalist information, you may be the relevant controller. STACKD may act as processor where applicable.

STACKD currently intends to retain account data during the subscription plus approximately 30 days after cancellation; content and campaign data up to 12 months after creation; billing records up to 7 years where legally required; and chat history up to 12 months.

Different retention periods may apply where required by law, legal claims, security, fraud prevention or regulatory obligations.

You may request deletion of applicable personal data by contacting info@stackd.bot.

STACKD will process valid requests within the timeframe required by applicable law.

Deletion may be subject to lawful retention requirements, including legal compliance, tax, accounting, security, fraud prevention, legal claims and regulatory obligations.

Subject to applicable law, individuals may have rights including access, correction, deletion, restriction of processing, objection, data portability where applicable, withdrawal of consent and other rights provided by applicable law.

Requests may be sent to info@stackd.bot.

STACKD may need to verify identity before responding.

Personal data may be processed outside the UAE, UK or EEA.

STACKD will use appropriate safeguards where required by applicable law, which may include adequacy mechanisms, contractual safeguards, Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another legally recognised mechanism.

STACKD will assess the applicable transfer rules based on the jurisdiction and processing activity rather than assuming one transfer mechanism applies globally.

STACKD may use essential cookies for authentication, security, sessions and essential functionality.

STACKD may use analytics services such as PostHog or Google Analytics to understand platform usage and improve the service.

STACKD does not currently use advertising cookies or sell cookie information to advertising networks.

Where applicable law requires consent for non-essential cookies or similar technologies, STACKD will use an appropriate consent mechanism.

Where such consent is required, STACKD may present a separate cookie banner or preference interface so that users can make the choices required by applicable law. Acceptance of these Terms alone will not be treated as consent to non-essential cookies where separate consent is required.

STACKD uses reasonable technical and organisational measures designed to protect personal data, including encryption in transit, access controls, authentication, database controls, monitoring and logging.

No system can be guaranteed completely secure.

Where a qualifying personal-data breach occurs, STACKD will comply with applicable notification obligations.

Where STACKD offers goods or services to individuals in the UK or monitors individuals in the UK, UK data-protection law may apply to the relevant processing.

Where STACKD offers goods or services to individuals in the EU or monitors individuals in the EU, the EU GDPR may apply to the relevant processing.

Where legally required and subject to applicable exemptions, STACKD will appoint an appropriate UK representative and/or EU representative. No representative is identified in this Privacy Policy until one has actually been appointed.

STACKD will not represent that UK or EU data-protection law applies to every customer or processing activity. Applicability depends on the relevant facts and territorial rules.

STACKD operates from SHAMS in Sharjah and will comply with applicable UAE federal and Sharjah requirements relevant to its operations, including applicable personal-data, cybercrime, media, advertising and electronic-communications laws.

Nothing in this Privacy Policy is intended to exclude or limit rights or obligations that cannot lawfully be excluded or limited.

STACKD is a business service. Users must be at least 18 years old. STACKD does not knowingly provide its services to children.

STACKD may update this Privacy Policy from time to time. Material changes may be communicated through email, the platform or other reasonable methods.

For privacy questions, data requests, legal questions or general enquiries, contact info@stackd.bot.

Where applicable, individuals may also have the right to complain to the relevant data-protection authority or other competent supervisory authority.

Where STACKD acts as a processor of personal data on behalf of a customer, the parties will enter into an appropriate Data Processing Agreement where required by applicable law.

A DPA is not required to be separately accepted by every user at account registration. Where a DPA is legally required or applicable to the customer's use of STACKD, it may be incorporated by reference, accepted electronically or executed separately between STACKD and the relevant customer.

The DPA should address subject matter and duration, nature and purpose of processing, categories of personal data, categories of data subjects, customer instructions, confidentiality, security, subprocessors, international transfers, data-subject requests, security incidents, regulatory cooperation, deletion and return, and audits where required.

Where the customer is the controller, the customer is responsible for establishing a lawful basis for processing, providing required privacy notices, obtaining required consent, giving lawful processing instructions, ensuring data can lawfully be provided to STACKD, responding to data-subject requests where required, complying with applicable marketing and communications laws, and complying with applicable local requirements.

Where STACKD acts as processor, STACKD will process personal data in accordance with documented instructions, maintain appropriate security measures, maintain confidentiality, use appropriate subprocessors, provide reasonable assistance where required by law, notify customers of qualifying data incidents as required, and delete or return data as required by the applicable DPA subject to lawful retention.

STACKD may use subprocessors necessary to provide the service, including AI providers, hosting providers, databases, payment processors, email providers, social-media integration providers, journalist-data providers and analytics providers.

STACKD may update its subprocessors from time to time. Where applicable law requires notification or an objection mechanism, STACKD will comply with those requirements.

At termination, STACKD will delete or return personal data in accordance with the applicable DPA, subject to legal retention, regulatory obligations, security requirements, backup retention, legal claims and fraud prevention.

STACKD may maintain electronic records of customer acceptance, acknowledgement, consent and feature authorisations where reasonably necessary for contractual, security, compliance and evidentiary purposes.

Feature-specific permissions, including connected-account access and auto-publish authorisation, may be requested at the point the relevant feature is enabled rather than during initial account registration.

Optional marketing consent and consent for non-essential cookies or similar technologies will be requested separately where required by applicable law and will not be a condition of using STACKD unless the relevant processing is necessary to provide the requested service.