Privacy Policy

This Privacy Notice describes how Stacked, LLC ("Stacked", "we", "us", or "our") collects, uses, and shares personal information when you use the Stacked platform (the "Service"). Stacked, LLC acts as the data controller for personal information processed in connection with the Service.

1. Information we collect

We collect the following categories of personal information:

• Account information — name, email address, password (stored as a hash), and store name.
• Profile and team information — role, store membership, and avatar (if provided).
• Operational data — products, inventory, sales transactions, customer-facing receipts, and reports you create or upload while using the Service.
• Support communications — messages you send to us and attachments you provide.
• Usage and device data — IP address, device and browser type, pages viewed, actions taken, timestamps, and approximate location derived from IP.
• Cookies and similar technologies — see "Cookies" below.

Payment card details and billing information are collected directly by our Merchant of Record, Paddle, and are not stored by Stacked.

2. How we use information

We use personal information to:

• create and administer your account and authenticate users;
• provide, maintain, and improve the Service and its features;
• process subscriptions and provide customer support;
• detect, prevent, and address fraud, abuse, security incidents, and other harmful or unlawful activity;
• send service-related communications (e.g. account, billing, security, and product update notices);
• with your consent where required, send marketing communications about features and offerings; and
• comply with legal obligations and enforce our agreements.

3. Legal bases for processing

Where applicable law requires a legal basis, we rely on:

• Performance of a contract — to deliver the Service and meet our obligations to you.
• Legitimate interests — to operate, secure, and improve the Service, prevent fraud, and communicate with users.
• Consent — for optional cookies and marketing messages where required.
• Legal obligation — to comply with tax, accounting, and other legal requirements.

4. How we share information

We share personal information with the following categories of recipients:

• Service providers and subprocessors — including cloud hosting and database providers, email and notification services, error monitoring, and analytics providers, who process data on our behalf under written agreements.
• Paddle.com — our Merchant of Record, which processes payments, manages subscriptions, calculates and remits taxes, and issues invoices for sales of the Service. Paddle's processing of buyer data is governed by Paddle's Privacy Policy.
• Industry chart and reporting partners — where you choose to submit sales data to industry charts (such as Luminate or Billboard), we share the relevant transaction data on your behalf.
• Professional advisers — including legal, accounting, and insurance advisers, where reasonably necessary.
• Authorities and others — where required by law, legal process, or to protect rights, property, and safety.
• Successors — in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality.

We do not sell your personal information.

5. Data retention

We retain personal information for as long as your account is active and as needed to provide the Service. After account termination, we retain data for a reasonable period to comply with legal obligations, resolve disputes, and enforce our agreements, after which it is deleted or anonymised.

6. Security

We use appropriate technical and organisational measures to protect personal information, including encryption in transit, access controls, row-level security on stored data, and regular review of our practices. No system is perfectly secure, and we cannot guarantee absolute security.

7. Your rights

Subject to applicable law, you may have the right to access, correct, delete, or restrict processing of your personal information; to object to processing; to data portability; and to withdraw consent where processing is based on consent. You can exercise many of these rights from inside your account, or by contacting us through the Service.

If you are located in the UK or EEA, you also have the right to lodge a complaint with your local data protection authority. Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as Standard Contractual Clauses or adequacy decisions.

8. Cookies

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and understand usage. Most browsers let you control cookies through their settings. Disabling essential cookies may affect your ability to use parts of the Service.

9. Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from them.

10. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be communicated through the Service or by email. The "Effective" date at the top indicates when the notice was last updated.

11. Contact

For privacy questions or to exercise your rights, contact Stacked, LLC through the Service. For payment and billing privacy matters, please also refer to Paddle's Privacy Policy.