Privacy Policy

1. Information we handle

• Website requests and security: your IP address, browser request headers, requested route, approximate request time and security or error information may be processed to serve the website, protect access, prevent abuse and investigate failures. Infrastructure providers may process request logs for these purposes.
• Scans and reports: target URLs, ownership-verification information, scan authorization, site and platform information, findings, report history, triage choices, feedback and technical material returned by the target. Findings may contain personal information or sensitive material inadvertently exposed by a target. Scan only systems you own or are authorized to test. Do not intentionally submit other people's personal information or confidential credentials in URLs, feedback or public posts.
• Optional accounts: verified email address, account identifiers, creation and sign-in activity, projects, monitoring settings, report associations, and subscription status. Where password sign-in is offered, we store a salted password hash, not the plaintext password. Where authenticator verification is offered, we store an encrypted authenticator secret and hashed recovery codes.
• Agency client workspaces, where offered: client workspace names, report-branding settings and the projects assigned to each workspace. If a workspace name or branding identifies an individual, that information is handled under this policy as part of your account.
• Connected sign-in, where offered: Google provides a provider account identifier and verified email address using the openid and email scopes. GitHub provides a provider account identifier and verified email address; its read:user and user:email permissions also return profile and email-list information that we use to identify the account and choose a verified email. We retain the verified account email, the provider name, the linked provider identifier, the account association and the link date. Provider access and refresh tokens are used during sign-in and are not stored. We do not request GitHub repository access for sign-in, and connecting a provider does not enroll you in marketing. Provider privacy policies govern their own services.
• Billing: selected plan, billing interval, provider customer and subscription identifiers, invoice references, payment status, renewal and cancellation dates, and purchase-consent evidence. Stripe collects payment details and billing information directly. We do not receive your full card number or card security code. Stripe may share billing, tax and payment-status information needed to administer the service, calculate tax and comply with law.
• Contact and newsletter: information you send to support or feedback, and separate newsletter email, opt-in, confirmation and unsubscribe records. Buying a subscription or creating an account does not subscribe you to marketing. See our newsletter privacy notice.

We collect this information from you, from your browser, from the websites and approved backends you ask us to scan, from Google or GitHub when you use them to sign in, and from Stripe. You do not have to provide personal information to run a free scan. An email address is needed for an account, and account and billing information is needed to buy a plan; without it, we cannot provide a paid plan.

2. How we use information

We use information to deliver scans and private reports; verify ownership and permitted access; provide accounts and monitoring; process payments, invoices, refunds and cancellation; send sign-in, security, monitoring and billing messages, including purchase confirmations, renewal reminders and notices of price or term changes; answer requests; prevent fraud and abuse; maintain service reliability; and meet tax, accounting and other legal obligations. We also use the aggregate statistics described below to improve the service. Scan results have limits and are not a security guarantee.

3. Aggregate statistics, cookies and browser signals

Optional first-party audience statistics contain daily totals for pageviews, scan starts, report activity, fixed page categories, common referral sources, broad device/browser categories and approximate country. IP information may be processed temporarily to determine country; retained audience totals do not contain IP addresses, full referrer URLs, report identifiers, scanned URLs, report contents, cookies that identify a visitor, or individual browsing histories. We do not fingerprint visitors or estimate unique visitors.

You can exclude this browser from audience statistics. We honor Do Not Track and Global Privacy Control signals by excluding optional statistics, including report activity. These choices do not disable necessary security, account, private-report or payment functions and do not remove totals already aggregated.

Necessary cookies maintain browser-owned report access for up to 90 days, member sign-in for up to 30 days, authorized owner access for up to 30 minutes, and your statistics preference for up to 180 days. Temporary sign-in state supports secure authentication. Clearing report-access cookies can remove access to reports created without an account. Stripe or connected sign-in providers may use cookies in their own payment or sign-in flows. The cookie and analytics notice gives the controls and further details.

4. Who receives information

We use service providers for hosting and databases (Render), transactional email (Resend), and payments, invoicing and tax calculation (Stripe). These providers process information on our instructions under their data-processing terms, except where they act independently, as Stripe does for its own fraud-prevention and legal obligations. Google and GitHub process their own sign-in flows when you choose them. Each receives the information needed for its role. Country categorization uses a locally processed IP-country database rather than sending each visitor's IP to a separate geolocation API.

To check detected software for known vulnerabilities and end-of-life status, we send software package or product names and version numbers to public vulnerability databases such as OSV.dev and endoflife.date. We never send your website address, code or personal information to them.

Reports are private and require the owning browser or authorized account. People to whom you send downloaded reports or exports receive the contents you share. We may disclose information when legally required, to investigate misuse or protect rights and security, to professional advisers under appropriate confidentiality, or as part of a business transfer subject to applicable protections. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or use it to train third-party AI models.

5. Retention

• Manual reports: scheduled cleanup removes reports created without an account after 90 days from the latest scan update, unless an active project or monitor still needs them. Cleanup is periodic, so deletion is not instantaneous at the cutoff.
• Account monitoring history: Free includes 30 days, Builder 90 days, and Pro and Agency 365 days of monitoring history. Client workspace names, report-branding settings and project associations are also kept with the account. After a paid downgrade, a 30-day export grace period can preserve history from the previous plan before it expires. These windows apply to monitoring reports, not tax or consent evidence.
• Inactive accounts: scheduled cleanup may remove accounts without an active paid plan after 12 months without sign-in or a recent subscription update, together with associated projects and reports.
• Authentication: email links and temporary social sign-in state expire quickly and are single-use. Member sessions expire or end on sign-out. Account authentication records are kept while needed for the account, then removed with account data, subject to legal obligations.
• Purchase-consent evidence: we retain the exact renewal and agreement wording, price, plan, billing interval, Terms version, account/email association and acceptance time for at least three years after acceptance or one year after the subscription ends, whichever is later, even if the account is deleted, to demonstrate authorization and handle disputes. Further retention may be required by law or an unresolved claim.
• Invoices, payment and tax records: kept for seven years after the end of the tax year in which the transaction occurred, to meet U.S. federal and Texas tax, accounting and audit requirements. Records of sales reported under the European Union VAT One-Stop Shop scheme are kept for ten years after the end of the year of the transaction, as that scheme requires.
• Other records: aggregate audience totals use up to 35 daily buckets. Newsletter retention is described in its separate notice. Support and security records are retained for the purpose for which they were collected and any applicable legal or dispute period. Payment providers may retain their own records independently. Restricted backups may persist through the provider's backup cycle and are not used as active customer records.

6. Your choices and requests

You may review your account, manage monitoring, update payment details and stop automatic renewal in Plan and billing. To request account closure or access, correction, deletion or a copy of personal information, email support@stacksnack.io. If you ask us to close an account that has an active subscription, we will cancel its renewal unless you tell us otherwise. We verify identity and authority before disclosing or deleting information. Deleting account information does not erase payment-provider records or evidence we must retain for legal obligations or claims.

Depending on your location, you may also have rights to object to processing, restrict processing, portability, withdraw consent, opt out of certain processing, appeal a refusal, and complain to your privacy regulator. We do not discriminate for exercising applicable privacy rights. An authorized agent may contact us; we may require proof of authorization and identity. If a request is refused, you may reply to the refusal asking for an appeal, and we will respond to the appeal within the period required by applicable law.

We respond to requests under EEA or UK law within one month, which we may extend by up to two further months for complex or numerous requests, and to requests under U.S. state law within 45 days, which we may extend once by a further 45 days where the law allows. If we extend, we will tell you why within the original period.

7. EEA and UK information

Where EEA or UK data-protection law applies, we act as controller for account, billing, website and service-administration information. Our bases are performing a contract or taking requested pre-contract steps, compliance with legal obligations, consent for processing that relies on consent, and legitimate interests in operating and securing the service, preventing abuse, responding to requests and handling claims, balanced against your rights. Optional newsletter consent can be withdrawn using its unsubscribe link. You may object to processing based on legitimate interests and contact your local supervisory authority.

Paid plans are currently offered only to customers with a United States billing address, and StackSnack does not direct its service or marketing to people in the EEA or the United Kingdom. If we begin to do so, we will appoint representatives in the European Union and the United Kingdom where Article 27 of the GDPR and of the UK GDPR requires it, and we will list their contact details here. In the meantime, contact us at support@stacksnack.io or at the address in section 11 about any matter covered by this policy.

Customers must have authority and any required legal basis to submit target information. When a scan returns personal information held on a customer’s website, we process it only to produce the requested report. If your use requires a data-processing agreement or specific handling of other people's personal information, contact us before submitting it so the required arrangements can be assessed.

8. International processing

StackSnack operates from the United States. Information may be processed in the United States and in countries where our providers operate, whose privacy laws can differ from those in your country. Where EEA or UK law requires safeguards for a transfer to a provider, we rely on the provider’s standard contractual clauses (with the UK addendum where relevant) or another lawful transfer mechanism. Contact us for a copy of the relevant safeguards. Paid plans are currently available only to customers with a United States billing address. Availability in other countries depends on completion of applicable legal and tax requirements; this policy does not mean every market is open for payment.

9. Security

We use access controls and technical safeguards appropriate to the service, including protected report access and encrypted connections. No system or transmission is completely secure. Protect your sign-in credentials, browser report access and exported reports, and contact support if you suspect unauthorized access. Do not post credentials or private report contents publicly. If a security incident affects your personal information, we will notify you and the relevant authorities where the law requires.

10. Age and automated decisions

StackSnack is intended for adults aged 18 and over and is not directed at children. Contact us if you believe a child supplied personal information so we can investigate and take appropriate action. Scanner findings are automated technical observations for human review; they do not guarantee security or replace professional judgment. We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

11. Changes and contact

We publish the effective date and version of this policy and provide additional notice or seek consent for changes where required by law. If we make a material change, we will email account holders before it takes effect.

GHOST TECHNICAL WORKS LLC
200 N Kimball Ave Suite 221
Southlake, TX 76092
United States
support@stacksnack.io