Privacy Policy

1. Information we collect

• Account information: your name, email address, company name, role and team size when you create an account or contact us.
• Workspace data: the software tools, costs, contracts, renewal dates, seat counts and notes you add or import into your workspace.
• Connected-app data: when you choose to connect a tool (for example Google Workspace, Gmail, Slack, GitHub or Notion), we read only the information needed to show licenses, seats, sign-in activity and billing evidence. We request read-only access wherever the provider allows it.
• Gmail evidence: if you choose to scan Gmail, we look at sender addresses, links and invoice details in recent emails to identify software vendors and charges. We do not send email from your account or change your mailbox.
• Uploaded files: invoices, contracts, spreadsheets and usage reports you upload are stored privately and processed only to extract software and billing details.
• Billing information: payments are handled by Stripe. We receive your subscription status and limited payment details (such as card brand and last four digits), never your full card number.
• Usage and device information: pages viewed, features used, browser type, device and approximate location, collected to keep the Service secure and to improve it.

2. How we use information

• To provide the Service: build your software inventory, show usage and spend, flag unused licenses, track renewals and generate savings recommendations.
• To keep each workspace separate and secure, and to prevent fraud or misuse.
• To process payments, manage subscriptions and send service messages such as renewal reminders, alerts and receipts.
• To respond to support requests and communicate with you about your account.
• To improve the Service using aggregated, de-identified information. Aggregated benchmarks never identify you or your company.

3. AI processing

Some features use AI models to read documents and suggest recommendations. Your workspace data is sent to these models only to perform the feature you requested. We do not allow your data to be used to train third-party AI models.

4. How we share information

• With service providers who help us run the Service, such as hosting, payments (Stripe), email delivery and AI processing, under contracts that require them to protect your data.
• With members of your own workspace, according to the roles your workspace owners assign.
• When required by law, or to protect the rights, safety and security of our users and the Service.
• As part of a merger, acquisition or sale of assets, with notice to you.
• We do not sell your personal information.

5. Google user data

Stack Sixth's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to provide the features you turn on, do not use it for advertising, and do not let humans read it except with your permission, for security, or as required by law.

6. Data retention

We keep workspace data for as long as your account is active. You can disconnect a tool at any time, and you can ask us to delete your workspace. We delete or anonymize your data within 30 days of a verified deletion request, except where we must keep records for legal, tax or security reasons.

7. Security

Data is encrypted in transit using TLS 1.2 or later and at rest using AES-256. Connection credentials are stored encrypted and separately for each workspace. Stack Sixth is hosted on the Base44 platform, which reports SOC 2 Type II and ISO 27001 certification. No system is perfectly secure, but we work to protect your information and will notify you of a breach as required by law.

8. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to or limit certain processing. To make a request, email hello@stacksixth.com. We will respond within 30 days.

9. International transfers

We may process information in the United States and other countries. Where required, we use appropriate safeguards, such as standard contractual clauses, for transfers of personal data.

10. Children

The Service is built for businesses and is not directed to children under 16. We do not knowingly collect information from children.

11. Changes to this policy

We may update this policy from time to time. If we make significant changes, we will notify account owners by email or in the app before they take effect.