Privacy Policy

1. The information we collect

Information you give us directly. Your name, work email address and mobile number when you sign up for stack or contact us, and your email address if you subscribe to our newsletter. Any details you include in an email or enquiry — for example, your role, the size of your firm, or what you are hoping stack can help with.

Workspace content you create or import. When you use stack to manage email, calendar, tasks, contacts, documents or notes, the content of those records is stored in your workspace. If you connect a third-party account (Gmail, Google Calendar, Microsoft 365, Twilio, Stripe, Xero, and similar), we retrieve and store the data needed to provide the connected features. You stay in control of which accounts are connected and can disconnect them at any time in Settings → Integrations.

Information collected automatically. Basic request metadata when you visit stackworkspace.com.au or use the stack web or mobile app — IP address, user agent, referring page, and the pages or screens you viewed. We use this to keep the service running and to diagnose problems.

Mobile applications. The stack iOS and Android apps load the same hosted service at app.stackos.com.au and collect no personal information beyond what the web app collects. The native shell uses standard device identifiers for session management, crash diagnostics and push-notification routing (when push is enabled in a future release).

We do not knowingly collect personal information from anyone under the age of 16. stack is a business product intended for use by adults.

2. How we use your information

We use the information we collect to:

• create and operate your stack account,
• respond to enquiries and support requests,
• send you our newsletter if you subscribed to it — every issue has an unsubscribe link,
• improve our website and product,
• meet our legal, tax, and accounting obligations.

We will not send you marketing you have not asked for, and we will never sell your personal information.

3. How we share your information

We only share personal information with:

• Service providers that help us operate stack. Each is bound by its own data protection terms:
  • Vercel — application hosting and content delivery.
  • Supabase — primary database, authentication and file storage.
  • Resend — transactional email delivery.
  • Stripe — payment processing and subscription billing. Card details are entered directly into Stripe's systems and never touch our servers.
  • Anthropic and Google (Vertex AI / Gemini) — large-language-model providers that power Penny, stack's AI assistant. Workspace content is sent only as needed to answer the request you initiated.
  • ElevenLabs — voice synthesis for Penny's spoken responses.
  • DeepInfra — embedding generation for in-workspace semantic search.
  • Twilio — SMS delivery for two-factor authentication and workspace telephony features.
  • Google Workspace and Microsoft 365 — when you connect your Gmail, Google Calendar, or Microsoft 365 account, we exchange data with those services under the scopes you authorise. You can disconnect at any time.
• Advisors and auditors, where engaged to help us run the business.
• Law enforcement or regulators, where we are required to disclose information by Australian law.

Some of our service providers are located outside Australia, including in the United States and the European Union. Where that is the case, we take reasonable steps to ensure they handle your information in a way that is consistent with the Australian Privacy Principles.

We do not share your information with advertisers.

4. Storage and security

We store personal information on infrastructure operated by Vercel and Supabase. We apply reasonable technical and organisational measures to protect it — encryption in transit, role-based access controls, and audited production access.

No system is perfectly secure. If we become aware of a data breach that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

5. Cookies

The stack marketing site uses Meta Pixel to measure the performance of our advertising campaigns and to help us reach people who might be interested in stack. Meta Pixel sets a first-party _fbp cookie and may read Meta's own fr cookie if you are signed in to Facebook or Instagram in the same browser. You can opt out of personalised advertising in your Meta ad preferences or block third-party cookies in your browser.

We also run the TikTok Pixel and Google Analytics 4 on the marketing site for the same reason — to see which campaigns bring people to stack. Both set their own cookies and can be blocked in your browser settings.

The marketing site uses Microsoft Clarity to understand how people move through our pages. Clarity records anonymised page interactions — clicks, scrolling and mouse movement — and replays them as a session recording, which shows us where a page is confusing. It masks the contents of form fields, so anything you type is not captured. Clarity sets first-party _clck and _clsk cookies and Microsoft may set its own identifier cookies. You can read Microsoft's privacy statement for how it handles that data.

The same Meta, TikTok and Google Analytics measurement also runs on the sign-up, email-verification and checkout pages of the stack app, so we can tell which campaigns produce real accounts rather than just clicks. It is limited to those pages. Once you are inside your workspace no advertising or analytics tag runs at all — your inbox, calendar, contacts and client data are never recorded or sent to any advertising or analytics platform, and the addresses of the pages you visit inside the app are never shared.

When you verify your email address or start a subscription, we also report that conversion to Meta, TikTok and Google from our own servers, so the measurement still works when a browser blocks the tags. That report contains your email address and mobile number as a one-way cryptographic hash (never the plain values), the identifiers the ad platforms already set in your browser, and the amount of the subscription. It is used to match you to the ad you clicked and to measure the campaign — nothing from inside your workspace is ever included.

These tags are loaded through Google Tag Manager, which sets no cookies of its own; it only loads the tools listed here.

We also use a small amount of browser storage to remember your theme preference (light or dark) and, if you arrived from an advertisement or a tagged link, which campaign that was, so that a later sign-up can be credited to it. That record holds the campaign labels and the click identifier from the ad platform, nothing about you.

If we add further analytics or session cookies in future, we will update this policy and give you the option to decline any cookie that is not strictly necessary.

6. Your rights

Under the Australian Privacy Principles, you have the right to:

• access the personal information we hold about you,
• correct information that is inaccurate, out of date, or incomplete,
• delete your account yourself at any time from Settings → Profile → Danger zone inside the app, or ask us to delete your personal information by email — subject to any legal obligation we have to keep it. See how account deletion works for the full procedure and what is retained,
• opt out of any non-essential email communication at any time,
• make a complaint about how we have handled your information.

To exercise any of these rights, email us at hello@thinkswift.au. We will respond within 30 days.

If you are not satisfied with our response, you can contact the OAIC at oaic.gov.au.

7. How long we keep your information

We keep personal information only for as long as we need it for the purpose it was collected, or for as long as Australian law requires.

While your account is active. Your account data is retained for the life of your subscription so stack can function. You can export it at any time and you can delete your account at any time from inside the app.

When you delete your account. Your sign-in credentials, personal profile (name, avatar, phone, timezone), and active subscription are removed immediately. Your workspace content (emails, calendar events, tasks, contacts, files, AI conversation history) is soft-archived and retained for approximately seven years to satisfy Australian business-record retention obligations under the Corporations Act 2001 (Cth) and the Income Tax Assessment Act 1997 (Cth), then permanently destroyed. During the retention period the data is encrypted at rest and not accessible to any stack user. A short audit record of the deletion itself (timestamp, email at time of deletion, workspace identifier) is kept indefinitely to satisfy App Store and Google Play compliance requirements.

Billing records. Invoices and payment receipts held by our payment processor (Stripe) are retained for the period required by Australian tax law, independent of account status.

Full procedure and recovery options: Delete your stack account.

8. Changes to this policy

We may update this policy from time to time. If we make a material change, we will post a notice on the website and, where appropriate, contact you directly. The effective date at the top of this page will always reflect the most recent version.

9. Contact us

If you have any questions about this policy or about how we handle your personal information, please get in touch.