Privacy

Privacy Policy

Last updated: 28 August 2026

1. Who we are

Stack & Scale ("we", "us", "our") builds operational software for businesses. This privacy policy explains how we handle personal information when you visit our website, use our contact form, or engage our services.

Data controller: Stack & Scale. Contact: use our contact form.

2. Information we collect

Information you provide directly — when you submit a contact form, request a demo, or email us, we collect the details you send: your name, email address, phone number (if provided), and the content of your message.

Server logs — our hosting infrastructure automatically records the IP address, browser type, pages visited, and timestamps of requests. These logs are used for security, debugging, and operational monitoring.

Analytics — if you consent to analytics, we may collect anonymised page-view and interaction data. Analytics are off by default and only activated with your explicit consent.

3. How we use your information

We use personal information to:

• Respond to your enquiry or demo request.
• Manage our working relationship, including project communication.
• Operate and secure our website and infrastructure.
• Comply with legal obligations.

We do not sell personal information to third parties. We do not use your data for profiling or automated decision-making.

4. Legal basis for processing

We process personal information under the following legal bases:

• Consent — when you submit a form or opt in to analytics.
• Contract — when processing is necessary to fulfil a contract with you or take steps at your request before entering into a contract.
• Legitimate interest — for security monitoring, fraud prevention, and improving our services, where these interests are not overridden by your rights.

5. Data sharing

We share personal information only with service providers who assist in operating our platform:

• Hosting — OVHcloud (server infrastructure).
• CDN and DNS — Cloudflare (content delivery and DDoS protection).
• Email delivery — Resend (transactional email).
• Identity — Keycloak (authentication, staff access only).

Each provider is bound by their own data processing agreements. We ensure they provide adequate safeguards for your information.

6. Data retention

• Contact and demo requests — retained for 2 years after the last communication, then deleted.
• Server logs — retained for 90 days.
• Analytics data — retained for 12 months in anonymised form.
• CRM records — retained for the duration of the business relationship plus 2 years.

7. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your personal information.
• Restrict or object to certain processing activities.
• Request portability of your data in a machine-readable format.
• Withdraw consent at any time (without affecting prior lawful processing).

To exercise any of these rights, use our contact form. We will respond within 30 days.

8. International transfers

Our servers are hosted in the United Kingdom. If you access our website from outside the UK, your information may be transferred to and stored in the UK. We ensure appropriate safeguards are in place for any such transfer.

9. Security

We implement industry-standard measures to protect your information, including encryption in transit (TLS), access controls, and regular security monitoring. No system is completely secure, but we work to protect your data against unauthorised access, loss, or misuse.

10. Changes to this policy

We may update this policy from time to time. The latest version will always be available at stackandscale.org/privacy. Continued use of our website after changes are posted constitutes acceptance of the updated policy.

11. Contact us

For questions about this privacy policy or how we handle your data, use our contact form.