Privacy Policy

StackTrackr (“StackTrackr”, “we”, “us”) operates the software-management service at stacktrackr.co.uk. We are the data controller for the account and billing information described below, and a data processor for the content you store in the service (see “Your content”).

For any privacy question, or to exercise your rights, contact us at hello@stacktrackr.co.uk.

• Account data: your name, email address and a securely hashed password. We never store your password in readable form.
• Company profile: optional business details you add, such as legal name, address, VAT number, billing email and a company logo.
• Billing data: your plan, seat count and subscription status. Card payments are handled entirely by Stripe; we never see or store full card numbers.
• Your content: the software, vendor, cost, renewal and contract information you enter, and any documents you upload to the vault.
• Technical data: limited server logs and your IP address, used for security, rate limiting and diagnosing faults.
• Cookies: strictly necessary cookies only (see “Cookies”).

Under the UK GDPR we rely on the following legal bases:

• Performance of a contract: to create and run your account, deliver the service, send renewal alerts and digests, and process your subscription.
• Legitimate interests: to keep the service secure, prevent abuse, understand faults, and communicate about material changes. We balance these against your rights.
• Legal obligation: to keep records we are required to keep, such as tax and accounting records for payments.
• Consent: where we ever ask for it (for example, optional communications). You can withdraw consent at any time.

We do not sell your personal data, and we do not use it for advertising.

For the content you put into StackTrackr - your software estate, costs, contracts and uploaded documents - you (or your organisation) are the data controller and we act as your processor. We process that content only to provide the service to you, on your instructions, and we do not access it except as needed to operate, support or secure the service. You are responsible for having a lawful basis for any personal data you choose to store in the service.

We use a small number of trusted providers to run the service:

• Microsoft Azure - cloud hosting, database and transactional email (account, alert and password-reset messages). Data is hosted in the UK/EU.
• Stripe - subscription billing and card payment processing.

Each sub-processor is bound by a data-processing agreement. Where a provider processes data outside the UK, that transfer is covered by an adequacy decision or standard contractual clauses.

StackTrackr uses strictly necessary cookies only: a session cookie to keep you signed in, a short-lived cookie to preserve a sign-in redirect, and a preference cookie (NEXT_LOCALE) that remembers your chosen language. We do not use advertising or third-party tracking cookies, so no cookie banner is required. If we ever add optional analytics, we will ask for your consent first and update this policy.

We keep your account and content for as long as your account is active. If you close your account, we delete your content within 30 days, except where we must retain limited records (such as payment records) to meet legal obligations. Routine backups are rotated and expire on a rolling basis.

We encrypt data in transit (HTTPS/TLS with HSTS), store passwords using bcrypt, isolate each customer’s data by tenant, and serve uploaded files as non-executable attachments. Access to production systems is limited and logged. No system is perfectly secure, but we work to protect your data using appropriate technical and organisational measures.

Under UK data protection law you have the right to:

• access a copy of the personal data we hold about you
• ask us to correct inaccurate or incomplete data
• ask us to delete your data (the right to erasure)
• restrict or object to certain processing
• receive your data in a portable format
• withdraw consent where processing is based on consent

To exercise any of these, email hello@stacktrackr.co.uk. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk, though we would welcome the chance to resolve any concern first.

We may update this policy from time to time. When we make a material change we will update the date above and, where appropriate, notify you. Continuing to use StackTrackr after a change means you accept the updated policy.