Privacy Policy
Last updated: 23 March 2026
1. Who We Are
Stackcess is a software-as-a-service platform for the sports supplement industry, incorporated in New Zealand and serving customers globally. This Privacy Policy explains how we collect, use, and protect personal information when you use our platform.
Because we serve customers across multiple regions, we are committed to meeting the privacy standards of the New Zealand Privacy Act 2020, the EU General Data Protection Regulation (GDPR), and the UK GDPR where applicable. If you are located in the EU or UK, the relevant sections below describe your specific rights.
2. The B2B Context
Stackcess is a business-to-business platform. Most of the personal information we process relates to individuals acting in a professional capacity on behalf of their organisation - for example, a brand's marketing manager or a retailer's buying team. We process this information to provide a service to the organisation, not for personal profiling or consumer-marketing purposes.
3. Information We Collect
We collect the following categories of information:
- Account and identity data - name, work email address, and organisation name when you register or are invited to a workspace. Authentication is handled via Kinde (see section 6).
- Workspace and organisation data - your organisation's workspace settings, team member roles, and partner relationship configurations.
- Product and asset content - product catalog data, digital assets (images, PDFs), regulatory documents (COAs, labels, certifications), and associated metadata that you upload to the platform. This is your data; we process it only to provide the Service.
- Partner sharing data - records of which content has been shared with which partner organisations, including market and locale scoping, access grant history, and revocation records.
- Partner Update analytics - when a Partner Update or Kit is delivered, we record basic engagement data: whether it was viewed, when, and by which partner workspace. This analytics data is visible to both the sending brand and the receiving partner in their respective workspaces.
- Billing data - subscription plan, billing contact details, and payment transaction records. Payment card data is handled entirely by Stripe and never stored on Stackcess servers (see section 6).
- Usage and technical data - IP address, browser and device type, session activity, and feature usage patterns collected automatically when you use the platform. Used for security monitoring, performance improvement, and support.
4. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the Service and your workspace
- Authenticate users and manage workspace access and roles
- Process and deliver partner sharing grants and Partner Updates
- Generate and record Update analytics visible within the platform
- Process subscription payments and send billing communications
- Send transactional emails - workspace invitations, product updates, support responses
- Monitor for security threats and prevent unauthorised access
- Improve platform performance and develop new features
We do not use your product content, regulatory documents, or business data for advertising, profiling, or any purpose outside of providing the Service.
5. AI Translation
When you use the AI translation feature, product content you select for translation is transmitted to DeepL to generate the translated output. DeepL does not use API-submitted content for model training, and content is not retained beyond the translation request.
You are responsible for reviewing AI-generated translations before distributing them to partners or publishing them in any market. Do not send content containing sensitive personal data through the translation feature.
6. Third-Party Service Providers
We use the following third-party providers to operate the Service. Each processes data on our behalf under appropriate data processing agreements:
- Kinde - authentication and identity management. Handles user login, session tokens, and multi-factor authentication. See Kinde's Privacy Policy.
- Stripe - payment processing. All payment card data is collected and stored by Stripe; Stackcess receives only a token reference. See Stripe's Privacy Policy.
- Resend - transactional email delivery for workspace invitations and platform notifications.
- Supabase - database infrastructure and file storage hosting for the platform.
- DeepL - processes product content you submit for AI translation. DeepL does not use API-submitted content for model training. Content is not retained beyond the translation request. See DeepL's Privacy Policy.
- Crowdin - used to manage and deliver localised versions of the Stackcess platform interface. Crowdin processes platform UI strings only - not your product content or business data.
7. Information Sharing
We do not sell your personal information. We share information only in these circumstances:
- With the service providers listed in section 6, as necessary to operate the platform
- With partner organisations you explicitly grant access to - limited to the content and analytics data within the scope of that grant
- When required by applicable law, court order, or regulatory request
- In connection with a merger, acquisition, or asset sale, with appropriate notice to affected users
8. International Data Transfers
Stackcess is incorporated in New Zealand and our infrastructure providers operate globally, including in the United States and European Union. When personal data is transferred outside your home jurisdiction, we rely on appropriate transfer mechanisms - including standard contractual clauses for EU/UK data - to ensure your data is protected to the standard required by applicable law.
9. Data Security
We implement technical and organisational security measures appropriate to the sensitivity of the data we process, including encrypted data transmission (TLS), access controls, row-level security on the database, and regular security reviews. No method of electronic storage is completely secure; in the event of a data breach affecting your information, we will notify you as required by applicable law.
10. Data Retention
We retain your workspace data for as long as your account is active. If you downgrade your plan, data is retained in full - you are not penalised for reducing your subscription.
On account deletion, we retain your data for 30 days to allow for export requests before permanent deletion. Billing records may be retained for longer where required by tax or financial reporting obligations.
11. Your Rights
Depending on where you are located, you may have the following rights regarding your personal information:
- Access - request a copy of the personal data we hold about you
- Correction - request correction of inaccurate data
- Erasure - request deletion of your personal data in certain circumstances
- Restriction - request that we limit how we process your data
- Portability - receive your data in a portable format
- Objection - object to processing based on legitimate interests
To exercise any of these rights, contact us at hello@stackcess.com. EU and UK residents may also lodge a complaint with their local supervisory authority.
12. Cookies
We use session cookies to keep you logged in and functional cookies required for the platform to operate. We do not use third-party advertising cookies or cross-site tracking. You can control cookies through your browser settings, though disabling functional cookies will prevent you from using the platform.
13. Children's Privacy
The Service is intended for business use by adults. We do not knowingly collect personal information from anyone under 18. If we become aware of such data having been collected, we will delete it promptly.
14. Changes to This Policy
We may update this Privacy Policy to reflect changes in the platform or applicable law. We will notify you of material changes by email or in-app notice at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
15. Contact
Privacy questions or requests: hello@stackcess.com
Privacy Policy
Last updated: 23 March 2026
1. Who We Are
Stackcess is a software-as-a-service platform for the sports supplement industry, incorporated in New Zealand and serving customers globally. This Privacy Policy explains how we collect, use, and protect personal information when you use our platform.
Because we serve customers across multiple regions, we are committed to meeting the privacy standards of the New Zealand Privacy Act 2020, the EU General Data Protection Regulation (GDPR), and the UK GDPR where applicable. If you are located in the EU or UK, the relevant sections below describe your specific rights.
2. The B2B Context
Stackcess is a business-to-business platform. Most of the personal information we process relates to individuals acting in a professional capacity on behalf of their organisation - for example, a brand's marketing manager or a retailer's buying team. We process this information to provide a service to the organisation, not for personal profiling or consumer-marketing purposes.
3. Information We Collect
We collect the following categories of information:
- Account and identity data - name, work email address, and organisation name when you register or are invited to a workspace. Authentication is handled via Kinde (see section 6).
- Workspace and organisation data - your organisation's workspace settings, team member roles, and partner relationship configurations.
- Product and asset content - product catalog data, digital assets (images, PDFs), regulatory documents (COAs, labels, certifications), and associated metadata that you upload to the platform. This is your data; we process it only to provide the Service.
- Partner sharing data - records of which content has been shared with which partner organisations, including market and locale scoping, access grant history, and revocation records.
- Partner Update analytics - when a Partner Update or Kit is delivered, we record basic engagement data: whether it was viewed, when, and by which partner workspace. This analytics data is visible to both the sending brand and the receiving partner in their respective workspaces.
- Billing data - subscription plan, billing contact details, and payment transaction records. Payment card data is handled entirely by Stripe and never stored on Stackcess servers (see section 6).
- Usage and technical data - IP address, browser and device type, session activity, and feature usage patterns collected automatically when you use the platform. Used for security monitoring, performance improvement, and support.
4. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the Service and your workspace
- Authenticate users and manage workspace access and roles
- Process and deliver partner sharing grants and Partner Updates
- Generate and record Update analytics visible within the platform
- Process subscription payments and send billing communications
- Send transactional emails - workspace invitations, product updates, support responses
- Monitor for security threats and prevent unauthorised access
- Improve platform performance and develop new features
We do not use your product content, regulatory documents, or business data for advertising, profiling, or any purpose outside of providing the Service.
5. AI Translation
When you use the AI translation feature, product content you select for translation is transmitted to DeepL to generate the translated output. DeepL does not use API-submitted content for model training, and content is not retained beyond the translation request.
You are responsible for reviewing AI-generated translations before distributing them to partners or publishing them in any market. Do not send content containing sensitive personal data through the translation feature.
6. Third-Party Service Providers
We use the following third-party providers to operate the Service. Each processes data on our behalf under appropriate data processing agreements:
- Kinde - authentication and identity management. Handles user login, session tokens, and multi-factor authentication. See Kinde's Privacy Policy.
- Stripe - payment processing. All payment card data is collected and stored by Stripe; Stackcess receives only a token reference. See Stripe's Privacy Policy.
- Resend - transactional email delivery for workspace invitations and platform notifications.
- Supabase - database infrastructure and file storage hosting for the platform.
- DeepL - processes product content you submit for AI translation. DeepL does not use API-submitted content for model training. Content is not retained beyond the translation request. See DeepL's Privacy Policy.
- Crowdin - used to manage and deliver localised versions of the Stackcess platform interface. Crowdin processes platform UI strings only - not your product content or business data.
7. Information Sharing
We do not sell your personal information. We share information only in these circumstances:
- With the service providers listed in section 6, as necessary to operate the platform
- With partner organisations you explicitly grant access to - limited to the content and analytics data within the scope of that grant
- When required by applicable law, court order, or regulatory request
- In connection with a merger, acquisition, or asset sale, with appropriate notice to affected users
8. International Data Transfers
Stackcess is incorporated in New Zealand and our infrastructure providers operate globally, including in the United States and European Union. When personal data is transferred outside your home jurisdiction, we rely on appropriate transfer mechanisms - including standard contractual clauses for EU/UK data - to ensure your data is protected to the standard required by applicable law.
9. Data Security
We implement technical and organisational security measures appropriate to the sensitivity of the data we process, including encrypted data transmission (TLS), access controls, row-level security on the database, and regular security reviews. No method of electronic storage is completely secure; in the event of a data breach affecting your information, we will notify you as required by applicable law.
10. Data Retention
We retain your workspace data for as long as your account is active. If you downgrade your plan, data is retained in full - you are not penalised for reducing your subscription.
On account deletion, we retain your data for 30 days to allow for export requests before permanent deletion. Billing records may be retained for longer where required by tax or financial reporting obligations.
11. Your Rights
Depending on where you are located, you may have the following rights regarding your personal information:
- Access - request a copy of the personal data we hold about you
- Correction - request correction of inaccurate data
- Erasure - request deletion of your personal data in certain circumstances
- Restriction - request that we limit how we process your data
- Portability - receive your data in a portable format
- Objection - object to processing based on legitimate interests
To exercise any of these rights, contact us at hello@stackcess.com. EU and UK residents may also lodge a complaint with their local supervisory authority.
12. Cookies
We use session cookies to keep you logged in and functional cookies required for the platform to operate. We do not use third-party advertising cookies or cross-site tracking. You can control cookies through your browser settings, though disabling functional cookies will prevent you from using the platform.
13. Children's Privacy
The Service is intended for business use by adults. We do not knowingly collect personal information from anyone under 18. If we become aware of such data having been collected, we will delete it promptly.
14. Changes to This Policy
We may update this Privacy Policy to reflect changes in the platform or applicable law. We will notify you of material changes by email or in-app notice at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
15. Contact
Privacy questions or requests: hello@stackcess.com