Privacy Policy
Last updated: June 13, 2026
1. Overview
StackGaps ("we", "us", "our") provides a software tool that lets organizations upload a software inventory (CSV) and receive a report identifying duplicate tools and compliance evidence gaps. This policy explains what information we collect, how we use it, and the choices you have.
2. Information We Collect
- Account information: name, work email address, organization name, and a hashed password when you register.
- Software inventory data: the contents of CSV files you upload, including software names, vendors, and categories. This data is used solely to generate your scan results and reports.
- Usage and diagnostic data: basic application logs and error reports (via Sentry) used to operate and troubleshoot the service. We do not use third-party advertising trackers.
- Billing information: if you upgrade to a paid plan, payment details are collected and processed directly by Stripe. We do not store full payment card numbers.
3. How We Use Your Information
- To provide, operate, and maintain the StackGaps service.
- To generate redundancy and compliance findings from the inventory data you upload.
- To authenticate your account and enforce plan limits.
- To monitor, debug, and improve the reliability and security of the service.
- To communicate with you about your account, scans, or changes to this policy.
4. Data Storage and Security
Your data is stored in a managed PostgreSQL database (Supabase) with row-level security so that each organization can only access its own data. Passwords are hashed using bcrypt and are never stored in plain text. Access to the application is protected by short-lived authentication tokens.
5. Data Sharing
We do not sell your data. We share information only with the sub-processors listed below, and only to the extent necessary for them to perform their services. We may also disclose information if required to do so by law.
| Sub-processor | Purpose | Location |
|---|---|---|
| Railway | Application hosting and deployment | USA |
| Supabase | Database and authentication | USA (AWS us-west-2) |
| Stripe | Payment processing (paid plans only) | USA |
| Resend | Transactional email delivery | USA |
| Sentry | Error tracking and diagnostics | USA |
6. Data Retention and Deletion
We retain your account and scan data for as long as your account is active. You may request deletion of your organization's account and associated data at any time by contacting us using the details below.
7. Your Rights
Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us using the details below.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date above.
9. Contact Us
If you have questions about this Privacy Policy or your data, contact us at [email protected].