1. Introduction & scope
StackGTM provides custom buying signals and a monitored list of accounts that match each client’s ideal customer profile (“ICP”). Access to the Service is by request only: prospective customers book a call with our team rather than signing up on their own. This policy applies to information we process when you visit our website, request access, communicate with us, and when your organization uses the Service.
This policy does not cover the practices of third parties we do not control, including the websites of companies we monitor or any enrichment provider whose API key you choose to connect. Where we act as a processor on a customer’s behalf (see “Bring-your-own-key & customer contact data” below), the customer’s own privacy notice governs that data, and this policy describes only how we handle it as a service provider.
3. Sources of data
The company-level data that powers signals comes from public and third-party sources, including:
- regulatory and securities filings;
- news and press coverage;
- hiring and job-posting data;
- technographic data providers (the technologies a company uses); and
- financial data providers.
We monitor each customer’s matched accounts on a monthly cadence and refresh the associated signals and confidence scores accordingly. Personal information we hold about you typically comes directly from you (for example, when you request a call), from your use of the Service, or from your workspace administrators.
4. How we use information
We use information to:
- respond to access requests, schedule calls, and communicate with you;
- provide, operate, and maintain the Service — including building custom signals, monitoring matched accounts, and scoring signal confidence;
- set up and administer each customer’s isolated workspace and manage user access;
- secure the Service, prevent abuse, debug issues, and maintain reliability;
- improve our signals, models, and features using aggregated or de-identified usage information;
- send service and administrative messages and, where permitted, relevant updates about StackGTM; and
- comply with legal obligations and enforce our terms.
We do not sell personal information, and we do not pool or resell one customer’s ICP, signal configuration, or monitored accounts to another customer.
5. Legal bases for processing (GDPR)
If you are in the European Economic Area, the United Kingdom, or another region with similar laws, we rely on the following legal bases to process personal information:
- Contract. To take steps at your request before entering into a contract (for example, handling your access request) and to provide the Service to your organization.
- Legitimate interests. To operate, secure, and improve the Service and our website, and to communicate with prospective and existing customers — balanced against your rights and interests.
- Consent. Where required, for non-essential cookies and certain marketing communications. You may withdraw consent at any time.
- Legal obligation. To comply with applicable laws and lawful requests.
For company-level signal data, we process information that is generally drawn from public records and third-party business sources on the basis of our legitimate interest in providing business intelligence to our customers.
6. Bring-your-own-key & customer contact data (our processor role)
Contact enrichment in StackGTM is bring-your-own-key (“BYOK”). The customer supplies their own enrichment-provider API key, and the customer controls the contact data returned through it. When we enrich contacts using your key, we act as a processor (service provider) on your behalf:
- you remain the controller of that contact data and are responsible for having a lawful basis to process it;
- we process it only to provide the Service to you, on your documented instructions;
- we do not resell, share, or use your contact data for our own purposes or to benefit any other customer; and
- that contact data lives within your private, isolated workspace and is not pooled across customers.
Your relationship with your enrichment provider is governed by that provider’s own terms and privacy notice. Where a data processing agreement applies between you and Developer Labs AI, its terms govern our processing of personal data on your behalf.
7. Sharing & sub-processors
We do not sell personal information. We share information only as needed to run the Service:
- Vetted sub-processors. We use vetted sub-processors to host and operate the Service (such as cloud infrastructure and platform providers) and to supply the public and third-party business data that powers signals (such as data providers). These sub-processors are bound by contractual confidentiality and data-protection obligations and may process information only on our instructions.
- Within your workspace. Information you put into the Service is accessible to the authorized users of your own workspace, consistent with your organization’s configuration.
- Legal & safety. We may disclose information to comply with law, enforce our terms, or protect the rights, safety, and security of our users, the public, or Developer Labs AI.
- Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
We do not name specific vendors in this policy; we use a roster of vetted sub-processors and update it as our infrastructure evolves.
8. International data transfers
We operate internationally, and information may be processed in countries other than your own, including the United States. Where we transfer personal information across borders, we use appropriate safeguards — such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism — to ensure a comparable level of protection. You may contact us at privacy@stackgtm.ai for more information about these safeguards.
9. Data retention
We keep personal information for as long as needed to fulfill the purposes described in this policy — for example, to respond to your request, to provide the Service to your organization, and to meet legal, accounting, or security obligations. Retention periods vary by data type and context. When information is no longer needed, we delete or de-identify it. Contact data processed under BYOK is retained according to your instructions and your workspace settings, and we delete or return it on termination as provided in our agreement with you.
10. Security
We use technical and organizational measures designed to protect information — including isolation of each customer’s workspace so that one customer’s ICP, signal configuration, and monitored accounts are not pooled with another’s, access controls, encryption in transit, and least-privilege practices for internal access. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; if a breach materially affects you, we will notify you and the relevant authorities as required by law.
11. Your privacy rights
Depending on where you live, you may have rights over your personal information.
GDPR / UK GDPR (EEA & UK).
- access a copy of the personal information we hold about you;
- request correction of inaccurate or incomplete information;
- request erasure (the “right to be forgotten”);
- restrict or object to certain processing;
- request data portability;
- withdraw consent where processing is based on consent; and
- lodge a complaint with your local supervisory authority.
CCPA / CPRA (California).
- know and access the categories and specific pieces of personal information we collect, use, and disclose;
- request deletion of your personal information;
- request correction of inaccurate personal information;
- opt out of any “sale” or “sharing” of personal information — note that we do not sell or share personal information as those terms are defined; and
- exercise these rights without unlawful discrimination in the level of service you receive.
To exercise any of these rights, email us at privacy@stackgtm.ai. We will verify your request and respond within the timeframes required by applicable law. You may use an authorized agent where permitted. If your data is processed by us as a processor on a customer’s behalf, we will refer your request to the relevant customer (controller) and support them in responding.
12. Cookies & analytics
Our website uses cookies and similar technologies for essential functionality (such as keeping you signed in and remembering your theme preference) and for aggregate analytics that help us understand how the site is used and improve it. You can control cookies through your browser settings; blocking some cookies may affect how parts of the site work. Where required by law, we ask for your consent before setting non-essential cookies.
13. Children’s privacy
StackGTM is a business tool intended for use by organizations and professionals. It is not directed to children and is not intended for anyone under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at privacy@stackgtm.ai and we will delete it.
14. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will revise the “Last updated” date above and, where changes are material, take additional steps to notify you as required by law. Your continued use of the Service after an update takes effect constitutes acceptance of the revised policy.