PRIVACY POLICY

1. Introduction

Welcome to Stackpad. Stackpad is provided by ByCrux LLC ("we," "us," or "our"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains what information we collect, how we use it, and your rights in relation to it.

By using our website at stackpad.ai and our related services (collectively, the "Service"), you agree to the collection and use of information in accordance with this policy.

This policy applies to two types of users: Business Owners who create accounts and build pages on Stackpad, and Visitors who interact with those pages and the AI agent.

2. Information We Collect

A. Business Owner Information

We collect information you voluntarily provide when you register for and use the Service:

• Account Data: Name, email address, phone number, and username.
• User Content: Photos, videos, text, links, and other materials you upload to build your Stackpad page.
• AI Agent Configuration: Business information, instructions, and context you provide to customize your AI agent's behavior, including agent name, welcome message, and personality settings.
• Connected Account Data: OAuth tokens and identifiers for third-party services you connect, such as Instagram, WhatsApp, or Google Calendar.
• Subscription Payment Data: We collect data necessary to process your Stackpad subscription through Stripe. We do not store full credit card numbers.
• Stripe Connect Data: If you connect a Stripe account to accept payments from your customers, we store your connected Stripe account identifier and onboarding status. We do not store your bank account details or payout information — those remain with Stripe.
• Onboarding Survey Data: Business type and pain point information you provide during onboarding.
• Feedback: Feature requests, feedback, and roadmap votes you submit.

B. Visitor Information

When visitors interact with a Stackpad page or its AI agent, we collect:

• Conversation Data: Messages exchanged between visitors and the AI agent, including any information visitors voluntarily provide during the conversation (such as name, email, or phone number).
• Visitor Identifier: A persistent identifier to maintain conversation continuity across sessions.
• IP Address: Collected for rate limiting, abuse prevention, and security purposes.
• Lead Information: Name, email, phone number, and other details captured through the AI agent's lead capture forms.
• Page Events: Interaction data such as page visits and event metadata.
• Payment and Purchase Data: If you make a purchase through a Stackpad page, your email address, name, and transaction details (amount, currency, product) are collected on behalf of the business owner operating that page. Payment card processing is handled entirely by Stripe — we do not receive or store your card number. Custom fields completed at checkout (such as preferences or booking details) are also stored and made available to the business owner.

C. Information Automatically Collected

Usage Data: IP address, browser type, device information, and operating system.

Cookies and Tracking: We may use cookies or similar technologies to access or store information about your session and authentication status.

3. How We Use Your Information

We use the information we collect or receive:

• To Provide the Service: To create and manage your account, host your landing page, and deliver the content you upload.
• To Power AI Features: To provide AI-powered page building, visitor chat, lead qualification, and appointment booking. Conversation data is processed by our AI provider to generate responses in your business's voice.
• To Capture and Manage Leads: To store visitor information captured through AI agent conversations and make it accessible to you through the Stackpad dashboard.
• To Enforce Usage Limits: To track message and action counts against your subscription tier limits.
• To Process Payments: To manage your Stackpad subscription, process upgrades and renewals, and handle billing issues. If you connect Stripe to accept payments from your customers, we also use payment data to facilitate those transactions, track payment status, and deliver purchased products on your behalf.
• To Communicate with You: To send administrative information such as security alerts, OTP verification codes, lead notifications, usage warnings, and account updates.
• For Safety and Security: To monitor and prevent fraud, abuse, spam, and security incidents, including IP-based rate limiting and blocking.

4. How We Share Your Information

We do not sell your personal information. We only share information with the following categories of third parties:

Service Providers:

• AI Processing: Anthropic (Claude) — conversation messages and business context are sent to Anthropic's API to generate AI responses. Anthropic does not use this data to train their models.
• Web Tools: Jina AI — URLs and search queries submitted through the AI agent's web browsing tools.
• Hosting & Infrastructure: Vercel, Google Cloud Platform (GCP), and Cloudflare.
• Data Storage: Cloudflare R2 — uploaded files, images, and conversation archives.
• Authentication: Google Firebase — for phone and email verification.
• Email Communication: Resend — for OTP delivery, lead notifications, welcome emails, and usage alerts.
• Payments: Stripe — for subscription billing and, when business owners connect their Stripe account, for processing payments from their customers. Buyer payment data (email, transaction details) is shared with the connected business owner's Stripe account and made available to the business owner through their Stackpad dashboard.
• Messaging Channels: Meta (WhatsApp, Instagram) and other messaging platforms — when you connect channel integrations, messages are transmitted through these platforms' APIs.

Business Owners: Visitor conversation data, lead information, and page analytics are made available to the business owner whose page the visitor interacted with.

Legal Obligations: We may disclose your information where we are legally required to do so in order to comply with applicable law, governmental requests, or a judicial proceeding.

5. AI-Processed Data

Our Service uses AI to power several features. When you or your visitors interact with the AI agent:

• Conversation messages are sent to Anthropic's API (Claude) for processing and response generation.
• Business context, instructions, and agent configuration are included in AI requests to personalize responses.
• Token usage (input and output) is tracked for billing and usage limit enforcement.
• Conversation history is stored on our servers to maintain context across sessions.
• The AI agent may use web browsing tools to look up information on behalf of visitors or business owners.

We do not use your conversations or content to train AI models. Our AI provider (Anthropic) does not use API data for model training.

6. Channel Integrations

When you connect third-party messaging platforms (such as WhatsApp or Instagram), messages from those platforms are routed through our servers to your AI agent. This means:

• Messages sent by visitors on connected platforms are stored in the same way as web chat messages.
• OAuth tokens and platform credentials are stored to maintain the connection.
• We comply with each platform's data handling requirements and terms of service.

Disconnecting a channel integration revokes stored tokens. To delete data held by the third-party platform itself, contact the platform directly.

7. International Transfers

Our servers are located in the United States. If you are accessing our Service from outside, please be aware that your information may be transferred to, stored, and processed by us in our facilities and by those third parties with whom we may share your personal information.

8. Data Retention

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy policy, unless a longer retention period is required or permitted by law.

• Account Data: Retained until you delete your account.
• Conversation History: Retained until you delete your account or the specific conversation.
• Lead Data: Retained until you delete your account or the specific lead.
• Usage Data: Monthly usage records are retained for billing and analytics purposes.
• Payment Records: Stackpad subscription transaction records are retained as required by law for tax and accounting purposes. Buyer payment records (email, transaction amount, product, delivery status) collected on behalf of a business owner are retained until the business owner deletes their account.

When you delete your account, we will delete your User Content, conversations, leads, and personal information from our active databases and storage providers.

9. Your Privacy Rights

Depending on your location, you may have the right to:

• Request access to your personal information.
• Request correction of inaccurate data.
• Request deletion of your data (see our Data Deletion page).
• Object to or restrict certain processing of your data.

To exercise these rights, please contact us at hello@stackpad.ai.

For Visitors: If you have interacted with a Stackpad page and wish to have your conversation data or lead information deleted, you may contact us or the business owner directly.

10. Children's Privacy

Our Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13.

11. Contact Us

If you have questions or comments about this policy, you may contact us at: