Privacy Policy

Last updated: September 7, 2026

This Privacy Policy describes how Stacksift ("we") collects, uses, and

protects information when you use stacksift.in.

We are a B2B service that analyzes publicly-accessible business websites.

We are not an ad-tech company. We do not sell user data.

What we collect

From you, when you create an account:

• Your email address (required, for login and receipts)
• Your IP address, user-agent, and session activity (for security)

When you use the API:

• The domains you submit for analysis
• The full request/response of each call (for billing, debugging, abuse

prevention)

• Approximate timing and cost of each call

From Dodo Payments, after a successful payment:

• The Dodo payment ID, checkout session ID, and amount
• Your payment method type (not the card number itself)

What we do NOT collect:

• Your card number, CVV, or expiry (handled entirely by Dodo Payments)
• Personal information about the companies you analyze
• Tracking pixels, advertising cookies, or third-party analytics scripts

Why we collect it

What	Why
Email	Account login, transactional notifications, receipts
API call logs	Billing accuracy, debugging your integration, abuse detection
IP and user-agent	Detecting account compromise and rate-limit abuse
Payment metadata	Issuing receipts, processing refunds, tax compliance

How we use third parties

We use the following processors to operate the Service. Each receives only

the minimum data needed:

• OpenAI — analyzes the contents of websites you submit. The submitted

domains and our pipeline's intermediate findings transit OpenAI's API.

• Serper.dev — receives the search queries we generate for each

analysis.

• Amazon Web Services — hosts our application and database (Oregon, USA).
• Dodo Payments — processes payments as merchant of record. They see your card details, we don't.
• Resend — sends transactional email (magic-link logins, receipts).
• Hostinger — DNS.

We don't use Google Analytics, Facebook Pixel, advertising trackers, or

session replay tools.

Data retention

• API call logs: 90 days
• Account data (email, settings, billing history): kept while your

account is active, plus 30 days after account closure

• Payment records and invoices: 7 years (Indian tax-law requirement)

You may request earlier deletion of account data by emailing

irfan@stacksift.in. We will comply within 30 days. Note that we may

retain payment records and invoices for the legally-required 7 years

regardless.

Your rights

You may:

• Request a copy of all data we hold about you (we'll email a CSV)
• Request correction of incorrect data
• Request deletion (subject to the retention rules above)
• Withdraw consent to processing by closing your account

To exercise any of these, email irfan@stacksift.in with "Privacy

request" in the subject line.

International users

We process data in India (where we are based) and in the United States

(where Render is hosted). By using the Service, you consent to your data

being processed in these jurisdictions.

For EU/UK users: we act as a data controller for your account data and as

a processor for the analysis requests you submit. We rely on Standard

Contractual Clauses for transfers, and our processing of website data

generally constitutes legitimate interest under GDPR Article 6(1)(f).

Children

The Service is not directed at children under 16. We do not knowingly

collect data from children.

Security

We use HTTPS for all traffic, hash API keys and session tokens, and follow

standard security practices. No system is perfect; if we discover a breach

affecting your data, we will notify you within 72 hours.

Changes

Material changes to this Policy will be emailed to registered users 30

days in advance. The current version is always at

stacksift.in/legal/privacy.

Contact

Questions: irfan@stacksift.in

Postal: Stacksift, Bengaluru, Karnataka, India.