Privacy Policy

• For this website and our own clients, we decide how data is used. That covers enquiries, chats, and the contact and billing details of the businesses we work with.
• For sites we host for a club or business, that club or business decides what it collects and why, and we process the data on its behalf. If you’re a member or customer of one of those sites, its own privacy notice applies, and it’s the first place to go for requests about your data. We’ll help it respond.

When you contact us. The chat and enquiry forms on /contact and /business/contact collect your name, email, club or business name, your answers about what you need, your messages, and any photos or videos you attach.

When you become a client. Contact and billing details for your business and its representatives, payment references, and our correspondence with you.

On sites we host for clients. Whatever the club or business needs to operate, typically names, emails, and phone numbers of members or customers; bookings, queue, and order history; sales records; uploaded payment receipts; and signed waivers.

Technical data. Our hosting providers keep standard server logs, such as IP address, browser, and pages requested, to keep the service secure and working.

• to reply to you and prepare quotes;
• to build, host, support, and bill for the services clients sign up for;
• to run hosted sites on our clients’ instructions, and for nothing else;
• to keep the service secure, prevent abuse, and meet legal obligations;
• to improve the platform using aggregated, anonymized usage data that identifies no one.

We don’t sell personal data or use it for advertising.

Only the service providers we need to run Stackr, each bound to protect the data at least as well as we do: hosting (Vercel), database (Supabase), email delivery (Resend), sign-in (Clerk), and payment processors when a payment is made. Data from a hosted site is visible to that club’s or business’s own staff and to Stackr staff providing support. We may also disclose data where the law requires it.

We only use cookies the site needs to work: keeping you signed in, keeping your chat with us open between visits, and our sign-in provider’s session cookies. We don’t use advertising or third-party analytics cookies.

• Enquiries and chats are kept while they’re useful for the conversation or a client relationship. Ask us and we’ll delete yours.
• Client billing records are kept as long as tax and accounting rules require.
• Hosted-site data is backed up regularly. When a client’s subscription ends, we keep its data for a limited time so it can be exported, then permanently delete it, including backups.
• Data in the RallyPoint demo may be reset at any time.

We use industry-standard safeguards, limit who can access personal data, and bind everyone with access to confidentiality. No system is perfectly secure. If a breach affects personal data we hold for a client, we notify that client promptly and make any notifications the law requires.

Under the Data Privacy Act you can ask to be informed about, access, correct, or delete your personal data, object to its processing, and get a copy in a portable format. Email us at stackr@xstlo.com. For data on a site we host for a club or business, contact that club or business first. You may also file a complaint with the National Privacy Commission.

We’ll update this page when our practices change and revise the date above. Clients get advance notice of material changes.

Reach out at stackr@xstlo.com for anything about this policy or your data.