Privacy policy
Last updated: 21 October 2026
This policy explains how StackTether ("StackTether", "we", "us") handles personal data when you visit stacktether.com, use the StackTether portal at app.stacktether.com, or connect an AI app to StackTether. StackTether is a business service: our customers are businesses (for example managed service providers, "MSPs"), and the people who use it are their staff.
1. Two roles: our own data and our customers' data
- We are the controller for the data we collect to run our website and our accounts: website contact form messages, account and sign-in data, security logs, and billing contacts. This policy covers that data.
- We are a processor (service provider) for the data our customers connect to StackTether: the vendor systems they link (such as their PSA) and the records an AI app reads through us on their behalf. That data belongs to our customer and their own clients. We handle it only on our customer's instructions, under our data processing addendum. If you are a client of one of our customers and have a question about your data, please contact that business first; we will help them answer.
2. What we collect
When you visit our website
- Contact form: what you type in (such as your name, email address, company, topic and message).
- Standard web server data: our hosting provider processes your IP address, browser type and the pages requested to deliver the site and keep it secure.
- No tracking: the website sets no cookies and uses no analytics, advertising or tracking tools. See our cookie notice.
When you use the StackTether portal
- Account data: your email address, your password (stored only as a one-way hash by our authentication provider), your two-factor authentication setup, your role and which business you belong to.
- Sign-in and security data: when you sign in, from which IP address and country, the browser or app used, whether the sign-in succeeded and whether two-factor authentication was used. We use this to protect your account, for example to sign you out if your session moves to a different network.
- Team activity: admin actions such as invites, role changes and access changes, with who made them and when.
- Invites: the email address an invite was sent to and its status. Invite codes are stored only in hashed form.
When an AI app uses StackTether
- Audit metadata: for every tool call, the person, the business, the AI app, the tool name, the time, the IP address, the outcome, and the ID numbers of the records returned (for example ticket numbers). We never store the content of those records in the audit log.
- AI connection data: which AI apps you approved, when, and the networks they connected from, so admins can see and disconnect them.
Customer data we process for our customers
- Vendor credentials: the API keys our customers save for their vendor systems. They are stored encrypted in a secrets vault, tested before saving, never shown again in the portal and never sent to AI apps.
- Vendor records: when an AI app asks a question, StackTether reads the needed records (for example tickets, clients, contacts, assets) from the customer's vendor system and passes a shortened, filtered answer to the AI app. These records pass through and are not stored by us, with one exception: to save repeated logins, our servers keep a short-lived copy of the vendor connection in memory, including lookup lists such as status names and technician names, for at most 15 minutes. Vendor records may contain personal data about our customers' clients, including sensitive data; our data rules hide fields such as passwords, payment details, dates of birth and government ID numbers before anything reaches the AI app.
Billing data (when billing starts)
The billing contact's name and email, the business's address and tax details, and the plan and number of techs. Card and bank details are collected and stored by our payment provider, not by us.
3. Why we use it and our legal bases
Where data protection laws such as the GDPR or UK GDPR apply, we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the service: accounts, sign-in, connections, AI tool calls | Performance of our contract with our customer, and our legitimate interest in providing the service to its staff |
| Security: two-factor sign-in, lockouts, network checks, unusual-activity alerts, audit logs | Legitimate interests (keeping accounts and customer data safe) and legal obligations to secure data |
| Answering contact form messages and sales questions | Legitimate interests (responding to you), or steps you asked for before a contract |
| Service and security emails (invites, password resets, admin notices) | Performance of the contract and legitimate interests |
| Billing, tax and accounting records | Performance of the contract and legal obligations |
| Handling legal claims and requests from authorities | Legal obligations and legitimate interests |
We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use our customers' data or vendor records to train AI models.
4. Who we share it with
- Our subprocessors, who host and run parts of the service for us under written data protection terms. The current list is on our subprocessors page.
- The AI apps our customers choose. When a customer's admin allows an AI app and a user approves it, tool answers go to that AI app. The AI app vendor handles that data under the customer's own agreement with it, not ours.
- Our customer's admins can see their own team's accounts, sign-in history, audit log and connected AI apps.
- Authorities or other parties when the law requires it, to protect our rights or users' safety, or as part of a merger or sale of our business (with the same protections continuing).
5. How long we keep it
| Data | Kept for |
|---|---|
| Audit log, team activity log, platform log, sign-in history, failed sign-in checks | 1 year |
| Accounts that belong to no business and have no open invite | Deleted after 30 days |
| Closed invites (accepted, revoked or expired) | 90 days after closing |
| A closed customer account (its users, connections, credentials and settings) | Deleted 30 days after closing, unless the customer reopens it in that time; a minimal record that it existed stays until its logs expire |
| AI connection network history and rule alerts | 90 days |
| Short-term counters (sign-in attempts, two-factor tries, call limits) | 1 to 2 days |
| Vendor records | Not stored (in-memory lookup lists up to 15 minutes) |
| Contact form messages | As long as needed to answer and follow up, then up to 2 years |
| Billing records | As long as tax and accounting law requires |
Deleted data may remain in encrypted backups for a short time until those backups expire.
6. How we protect it
Two-factor authentication for every user, invite-only accounts, tenant isolation enforced in the database, encrypted storage of vendor credentials, encryption in transit, short-lived AI app tokens, network checks, call limits, an unusual-activity guard and an audit log of every tool call. No system is perfectly secure; if we learn of a breach that affects your personal data we will notify our customers and, where the law requires, you and the authorities. To report a security issue, use our contact form and choose "Security report".
7. International transfers
StackTether is run from the United States, and our main hosting is in the United States (US East). If you use StackTether from outside the US, your data is transferred to the US. Where the GDPR or UK GDPR applies, we rely on the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful transfer mechanism, in our agreements with customers and subprocessors.
8. Your rights
Depending on where you live, you may have the right to:
- know what personal data we hold about you and get a copy;
- correct it;
- have it deleted;
- restrict or object to how we use it;
- receive it in a portable format;
- opt out of sale or sharing for targeted advertising (we do neither);
- not be treated differently for using your rights;
- complain to your data protection authority.
How to make a privacy request: use our contact form and choose the topic "Privacy request". Tell us what you are asking for and which email address your account uses. We will confirm your identity before acting (for example by asking you to confirm from that email address or by asking your business's admin) and answer within the time the law allows, usually within 30 to 45 days. You may use an authorized agent where the law allows it.
If your request is about data in your employer's StackTether account or in a vendor system our customer connected, we may pass it to that customer, because they control that data. Some data must be kept for security or legal reasons (for example the audit log for its 1-year period).
9. Children
StackTether is a business service and is not meant for children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, tell us through the contact form and we will delete it.
10. Changes to this policy
We will post any change on this page and update the date at the top. For important changes we will also tell our customers' admins in advance by email or in the portal.
11. Contact
StackTether. Questions about this policy: our contact form (topic "Privacy request").