Privacy Policy

Two different roles we play

This distinction matters, so it comes first.

Information we collect

Information you give us

• Identity and contact details, including name, business name, email address, phone number and mailing address
• Account and onboarding information, including which platforms you use, what you need built, your time zone, and who is authorized to approve work
• Billing information processed through Stripe, including the last four digits of your card, card brand, expiry and billing address. We never receive or store your full card number or CVC.
• Support and project communications, including chat messages, tickets, emails and notes from calls
• Any credentials or access you choose to grant us for your platforms

Information collected automatically

When you visit the Site, our hosting provider records standard server log data such as IP address, browser type, device type, referring page, and pages visited, for security and basic operation.

As of the effective date of this policy, the Site does not run analytics, advertising pixels, session recording, or third-party marketing trackers. If we add them, we will update this policy and, where required, obtain consent before they load.

Information from others

We may receive your information from a freelance platform or marketplace if you engage us there, from a colleague who refers you, or from a publicly available business source such as your company website.

We do not knowingly collect sensitive personal information such as government ID numbers, health information, precise geolocation, or biometric data, and we ask you not to send it to us.

How we use information

We use personal information to:

• Deliver the services you purchased, including building, fixing and maintaining your systems
• Create and manage your account, track your hour balance, and provide your hours ledger
• Process payments, renewals, refunds and chargebacks through Stripe
• Respond to chat messages, tickets, calls and emails
• Send service and transactional messages, including receipts, renewal notices, balance alerts and policy updates
• Send marketing emails or SMS where you have opted in, and only until you opt out
• Protect our systems and yours against fraud, abuse and unauthorized access
• Keep business records and meet legal, tax and accounting obligations

For customers in the United Kingdom or European Economic Area, our legal bases are performance of a contract, our legitimate interests in operating and securing the business, your consent for marketing, and compliance with legal obligations.

We do not sell your personal information

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and similar state laws. We have not done so in the preceding 12 months. We do not sell or share the personal information of anyone under 16.

When we disclose information

We disclose personal information only in these situations:

Service providers who help us operate. These vendors are bound by contract to use the information only to provide services to us. Our current categories and providers:

Where a task involves an AI-assisted workflow, data may pass through an AI model provider. We will tell you before AI processing touches your customer records, and we do not enable training on your data where the provider offers a setting to prevent it.

Legal and safety. We may disclose information when required by law, subpoena, or valid government request, or to protect our rights, our customers, or the public.

Business transfer. If Sysora Stack is involved in a merger, acquisition or sale of assets, information may transfer as part of that transaction, subject to this policy.

We do not disclose your information to data brokers, advertisers, or any party for their own marketing.

Where your information is processed

Sysora Stack operates as a United States-facing business and these Terms are governed by US law. Our delivery team works across multiple time zones, including shifts outside the United States, and authorized personnel may access information from those locations in order to provide round-the-clock support and delivery.

All personnel are bound by written confidentiality obligations and access is limited to those who need it to perform the work. Where personal information of UK or EEA residents is transferred outside those regions, we rely on Standard Contractual Clauses or another lawful transfer mechanism.

How we protect information

We use access controls and least-privilege permissions, role-based or delegated platform access instead of shared passwords wherever a platform supports it, encrypted storage for credentials, encrypted connections for data in transit, multi-factor authentication on company accounts, and prompt revocation of access when an engagement ends or a team member leaves.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and any required regulator within the timeframes the law requires.

How long we keep information

Your privacy rights

Depending on where you live, you may have the right to:

• Know what personal information we hold about you and how we use it
• Access a copy of it, or receive it in a portable format
• Correct inaccurate information
• Delete your information, subject to our legal retention obligations
• Opt out of sale, sharing, targeted advertising and certain profiling, none of which we currently do
• Limit the use of sensitive personal information, which we do not knowingly collect
• Not be discriminated against for exercising any of these rights

These rights are available to residents of California, Virginia, Colorado, Connecticut, Texas, Utah, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states as their laws come into effect, and to residents of the United Kingdom and EEA under applicable law.

How to exercise them. Email support@sysorastack.com with the subject line “Privacy Request” and tell us which right you are exercising. We will verify your identity by matching the details you provide against our records, and we may ask for additional confirmation if the request concerns deletion.

Timing. We respond within 45 days, and we may extend by a further 45 days where permitted, with notice to you.

Authorized agents. You may use an authorized agent, with written authorization that we can verify.

Appeals. If we deny your request, you may appeal by replying to our decision with the subject line “Privacy Appeal.” We will respond within 45 days with our decision and the reasons. If we deny the appeal, you may contact your state attorney general. UK and EEA residents may lodge a complaint with their supervisory authority.

Requests about data in a client’s system. If your personal information sits in a system we manage for one of our customers, we will refer your request to that customer, who controls the data, and support them in responding.

Marketing, email and SMS

We send marketing messages only to people who have asked for them. Every marketing email includes an unsubscribe link. Where we send SMS, you opt in separately, message and data rates may apply, you can reply STOP to stop and HELP for help, and we honor opt-outs promptly.

Transactional messages about your account, your hour balance, your renewals and your active work are not marketing, and they continue while your account is active.

Cookies and tracking

The Site uses only the cookies required to make it function and to keep it secure. We do not currently use advertising, analytics or session-recording cookies. Checkout pages hosted by Stripe set their own cookies, governed by Stripe’s privacy policy.

Because we do not conduct targeted advertising or sell personal information, there is currently nothing for a Global Privacy Control or Do Not Track signal to opt you out of. If that changes, we will honor those signals as required by law and update this policy.

Children

Our services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact support@sysorastack.com and we will delete it.

Third-party sites

Our Site and our deliverables may link to third-party services. We are not responsible for their privacy practices, and their policies govern their handling of your information.

Changes to this policy

We may update this policy. The “Last updated” date at the top shows the most recent version. For material changes, we will notify active customers by email at least 30 days before the change takes effect.

Contact us