Privacy Policy

The operator is Stacklinx, a company registered in Montenegro, at Bulevar Sv. Petra Cetinjskog br 96, Montenegro. This policy covers the service at https://stacklinx.com and the Stacklinx mobile apps.

It is written to meet the personal data protection law of Montenegro. Where Stacklinx serves people in the European Economic Area, the EU General Data Protection Regulation (GDPR) also applies to that processing.

When you register or accept an invite, we store the name and email address you give us, a hash of your password (we do not store the password itself), your workspace membership, and profile settings.

Signing in on the web creates a JSON Web Token. The browser keeps it in localStorage under the key token and sends it as an Authorization Bearer header. The mobile app keeps the session in the platform keychain. We use the token to recognize the request as yours.

If you connect Google, Google’s own terms still apply to that account. Stacklinx does not ask you to type a Google password into our forms. We store the OAuth tokens on our servers, sealed at rest, and use them only to perform the Gmail, Calendar, or Drive actions you or a workspace agent you have allowed actually start.

Gmail. Connecting Gmail uses the gmail.modify scope. That lets Stacklinx read mail in the connected mailbox, change labels, and create or send messages when you, or an agent you have allowed, ask it to. Message content is processed so the inbox can be shown and so drafts you request can be written and sent.

Google Calendar. Connecting Calendar uses the Google Calendar scopes calendar and calendar.events. Stacklinx reads and updates events on the calendars you connect.

Google Drive. Connecting Drive uses drive.readonly and drive.file, plus Google profile and email scopes so we can tell which account you connected. Stacklinx reads files and folders you grant, and files you pick, so they can be attached to a project or read by an agent you allow. We do not use Drive access to sell your files.

You can disconnect Gmail, Calendar, or Drive in the product. Disconnecting stops new access. Copies already saved into a project or a message stay until you delete them or your account is deleted.

If you connect Spotify, Spotify’s terms still apply. Stacklinx requests access for streaming playback, your Spotify email and subscription profile, playback state and the ability to change it, the track that is playing, your library, private playlists, creating and editing public and private playlists, playlist cover images, your top items, and recently played tracks. We use that data to run the in-product player and the listening features you start. Spotify tokens are stored on our servers, sealed at rest, the same way as other connected-account tokens.

Voice and video calls use LiveKit. When you join a call, LiveKit processes the audio and video of that call so the other participants can hear and see you. Stacklinx keeps the call signaling — who joined, and when — so the call can be placed from a conversation.

Some agent features open a remote browser session through Browserbase, shown in the product as a live portal. Pages opened in that session, and cookies inside that remote browser, are processed by Browserbase so the portal can run. A live portal is not a recording of the browser on your own device.

We store the workspace content you and your team create: messages, projects, tasks, notes, quotes, proposals, and uploaded files. Chat attachments are stored in Cloudflare R2 when that storage is configured, and are opened through short-lived links that require a signed-in session. If R2 is not configured, files use the S3-compatible object store configured for that deployment. File metadata and the rest of the workspace record are stored in MongoDB.

Agents in a workspace can read the content their permissions allow, so they can draft, summarize, and follow up. When an agent or a document feature runs, the relevant content may be sent to a model provider, including OpenAI, and Anthropic where a vision or document feature uses it.

Our servers record technical logs needed to run and protect the service: IP address, user agent, time, and the request path. When product analytics is turned on for a deployment, we also collect the usage events described in the Cookie Policy.

The web session is the token in localStorage, not an authentication cookie. An analytics cookie is set only when PostHog is enabled for that deployment. Details are in the Cookie Policy.

These providers process data so we can run Stacklinx:

• Vercel hosts the website.
• Railway hosts the API.
• MongoDB stores the application database.
• Google provides the OAuth connection and, when you connect them, Gmail, Calendar, and Drive.
• Spotify provides playback and account data when you connect Spotify.
• LiveKit carries call audio and video.
• Cloudflare R2 stores uploaded files when that storage is configured.
• Browserbase runs live browser portals when that feature is used.
• PostHog provides product analytics when the analytics key is configured.
• OpenAI and Anthropic process content when an agent or document feature calls those models.

We do not sell personal data.

We keep account and workspace data while the account or workspace is in use. If you ask us to delete your account, we complete that deletion within 30 days, as described on the account deletion page.

After that we may still keep security logs, records needed to resolve a dispute or prevent fraud, and records the law requires us to keep. Backup copies remain until the normal backup cycle overwrites them. We do not keep your password or connected-account tokens after the account is deleted.

Stacklinx is established in Montenegro. The providers above may process data in the United States and in other countries. If you use Stacklinx from the European Economic Area, that is an international transfer of personal data. Those providers process the data under their data-processing terms. You can email us and ask which provider holds a particular category of your data.

You can ask us for the following.

• Access and export. Signed-in users can download a JSON archive from Settings, then Your data. That download uses the existing export at /api/data-export/me. It includes your profile, projects you created, notes, assigned tasks, messages you sent, document metadata, notifications, and agents you created. It leaves out your password hash, OAuth tokens, webhook secrets, and KYC document images. You can also email privacy@stacklinx.com and ask for a copy.
• Correction. Edit your profile in the product, or email us the correction.
• Deletion. The signed-in product does not have an account-deletion control. Use the account deletion page. We finish a request we can match to an account within 30 days.
• Withdrawing a connection. Disconnect Gmail, Calendar, Drive, or Spotify in the product. Connecting them is optional. We process account and workspace data in order to provide Stacklinx to you and your organization.

If you are in the European Economic Area, you may lodge a complaint with a supervisory authority. In Montenegro, you may contact the Agency for Personal Data Protection and Free Access to Information.

Stacklinx is a workplace product. It is not directed at anyone under 16, and we do not knowingly open accounts for children under 16. If you believe a child under 16 has an account, email privacy@stacklinx.com and we will delete it.

Privacy requests: privacy@stacklinx.com
Support: support@stacklinx.com
Post: Stacklinx, Bulevar Sv. Petra Cetinjskog br 96, Montenegro