Privacy Policy
Stacksushi is a spreadsheet for cleaning and enriching lead lists. This policy explains what information we handle, why, who else touches it, and the choices you have. Questions go to support@stacksushi.com.
1. Who is responsible for your data
For your account (your email and sign-in), Stacksushi is the controller. For the lists you upload or send to Stacksushi, which usually contain personal data about other people such as names, work emails and job titles, you decide why and how that data is used. In that case you are the controller and Stacksushi acts as your processor, handling the data only to run the service for you. A data processing agreement is available on request.
2. What we collect
| Information | Examples | Why |
|---|---|---|
| Account | Email address and a password (stored only as a protected hash by our sign-in provider) | To create and secure your account |
| Your content | Tables, rows, columns, sheets, saved enrichments, views, webhook URLs and the events sent to them | To store and show your work |
| API keys you save | The AI and API keys you enter in Settings or in an integration | So your keys follow you to other devices (see section 3) |
| Plan and usage | Your plan, subscription status and renewal date, the payment provider's customer and subscription IDs, and how many API credits you have used in the current billing period | To give you the right plan and limits, and to show your credit counter |
| Background run activity | For tables that receive data by webhook: when background runs happened, how many cells ran, how many API credits they used, and why they paused. Never the contents of your leads | To show you what ran, apply your plan's daily limits and warn you when something stops |
| Technical data | IP address, browser type and request logs kept by our hosting provider | To run, secure and troubleshoot the service |
| Support messages | What you write to support@stacksushi.com | To help you |
We do not collect or store payment card details. Payments are handled by our payment provider, Dodo Payments, which tells us whether your subscription is active and which plan you bought. If you buy through a marketplace such as AppSumo, that marketplace handles the payment and shares your email and plan with us.
3. Your API keys and settings
AI and API keys that you enter in Settings or in an integration are saved in your browser (local storage). When you are signed in, they are also saved in your account so they follow you to your other devices. Keys saved in your account are encrypted before they are stored; the encryption key is kept separately from the database, in our hosting provider's secret storage, and is used only by our server to save and return your own keys to you. We do not read or use your keys for anything else. If you use Stacksushi without an account, keys stay in your browser only. A key is never saved inside your tables, exports or saved enrichments. You can change or remove a key at any time in Settings.
Background runs. If a table receives data by webhook and has columns with Auto-update switched on, our server can run those columns when new rows arrive, even while you are not signed in. To do that it uses the keys saved in your account: it decrypts them only for your own jobs, only in the server's memory while the job runs, and never writes them to a log. This happens only for columns you have set to Auto-update, you can pause it per table at any time, and your plan's daily limits apply. If you do not want this, do not turn on Auto-update for those columns, or remove the keys from Settings.
When you send an API call through the Stacksushi proxy, the request, including any key in its headers, passes through our server once to reach the service you called. We do not store or log request contents or keys; our hosting provider keeps standard request logs that do not include request contents. Anyone with access to your browser profile can see keys saved there, so use spend limits at your providers.
4. How we use information
- To provide Stacksushi: store your tables, run your cleaning, formula, lookup and webhook features, and send the requests you configure.
- To run your own enrichments in the background, when you have set up a webhook and Auto-update, and to tell you by email when background runs pause (for example you are out of credits, or a lot of rows arrived at once). These emails contain no lead data and are sent at most once a day per table.
- To manage your plan and billing: count the API credits you use, apply your plan's limits and keep your subscription status up to date.
- To keep the service secure and prevent abuse, such as blocking requests to private network addresses and checking that sign-ups and sign-ins come from people, not bots.
- To send service emails: sign-in links, confirmations and important notices.
- To answer support requests and improve the product based on that feedback.
- To understand how the website and documentation are used, through Google Analytics (see section 6).
We do not sell your information. We do not show advertising. We do not use your lists to train AI models, and we do not look at their contents except where you ask for support or where needed to keep the service safe or to comply with the law.
5. Who else handles your data
We use these providers to run the service:
| Provider | Role |
|---|---|
| Supabase | Database and sign-in for your account and tables |
| Vercel | Website hosting and the serverless functions for the API proxy and webhooks |
| Resend | Delivery of sign-in and confirmation emails, and notices that background runs paused |
| Dodo Payments | Payment processing and subscription management. It receives your email and payment details directly, not through us |
| Google Analytics | Counting visits and page views on our website (not in the app). Only after you accept, for visitors in the EU, UK and Switzerland |
| Cloudflare Turnstile | A human check on sign-in and sign-up. It receives your IP address and browser signals to tell people from bots |
| AppSumo (if you buy there) | Sales and refunds for purchases made on its marketplace |
When you add an AI column or an API column, the cell values you reference are sent to the provider you chose, either from your browser or, for background runs, from our server, (for example Anthropic, OpenAI or another API), using your own key and account. That provider's terms and privacy policy apply to what it receives. Choose providers whose terms fit your data and your obligations to the people in your lists.
We may also disclose information if the law requires it, or to protect the rights, safety and security of our users and the service.
6. Cookies and local storage
Inside the app, Stacksushi uses your browser's storage only for things the service needs: keeping you signed in, the human check that protects sign-in, remembering your settings (theme, page size, saved filters and views, minimized sidebar) and, if you choose to use it without an account, holding your tables on your device. We do not use advertising cookies. On our website (stacksushi.com and its documentation, not inside the app) we use Google Analytics to count visits and see which pages are read. It sets cookies and sends your IP address, browser details and the pages you view to Google. We do not use it for advertising and the app itself does not use it. If you are in the EU, the UK or Switzerland (or we cannot tell where you are), we ask first: Google's code is not loaded, and no analytics cookie is set, unless you press Accept in the banner. You can change your mind at any time with "Cookie settings" in the footer; choosing Decline removes the cookies. Your choice is remembered in your browser. Everywhere else the analytics are on from your first visit. If this changes we will update this policy and ask for consent where the law requires it.
7. How long we keep data
We keep your account and content while your account is active. You can delete rows, columns, sheets and tables yourself at any time. To delete your account and all its content, email support@stacksushi.com from your account address; we will complete it within 30 days. Copies in provider backups are removed as those backups expire. Background run activity is kept for 30 days. We may keep limited records where the law requires, such as proof of a purchase. Your payment provider keeps its own records of your payments under its own policy.
8. Security
Traffic is encrypted in transit. Each account's data is separated by database access rules so that one account cannot read another's tables. Saved API keys are encrypted (see section 3). Webhook URLs contain a long secret, which you can replace or switch off at any time; anyone who has the URL can add rows to that table, so keep it private. No system is perfectly secure, so please tell us at once if you think your account has been affected.
9. Your rights
Depending on where you live (for example under the GDPR, the UK GDPR or the California Consumer Privacy Act), you may have the right to access, correct, delete or export your personal data, to object to or restrict certain handling, and to withdraw consent. Email us and we will respond within 30 days. If you are in the EU or UK you can also complain to your local data protection authority. If you are a person listed in a customer's lead list, please contact that customer first; we will help them honor your request.
10. International transfers
Our providers may process data in the United States and other countries. Where required, transfers rely on safeguards such as standard contractual clauses.
11. Children
Stacksushi is a business tool and is not meant for anyone under 18. We do not knowingly collect information from children.
12. Changes
We may update this policy. When the changes matter, we will tell you by email or in the app before they take effect. The date at the top shows the latest version.
13. Contact
Email support@stacksushi.com.