eu, uk & swissprivacy notice.
effective date // September 7, 2026
For the EEA, United Kingdom, and Switzerland: every data type, its purpose, its source, the GDPR article we rely on, and how long we keep it.
Supplements the Privacy Policy · EU instance hosted in Azure Sweden Central
↓
[ 00 // scope ]
What these tables cover.
Effective Date: September 7, 2026
These tables provide a detailed overview of how we process personal data, including legal bases, data categories, and retention periods.
Your rights (access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and complaint to a supervisory authority), our controller and processor roles, and our international transfer safeguards are described in the European, UK, and Swiss Privacy Notice, Our Role in Processing, Legal Basis, and International Data Transfers sections of our Privacy Policy.
[ 01 // table 1 // what information we collect ]
Data type by data type.
| Data Type | Purpose | Source | Legal Basis (GDPR) | Retention |
|---|---|---|---|---|
| Personal Information | Account creation, administration, authentication, and support | Directly from Customers and Users | Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)) | Life of the Account or Subscription, plus applicable legal retention periods, including up to 7 years where required for tax or accounting purposes |
| Customer Team Information | Team invitations, membership, roles, permissions, and access | Customers, administrators, and invited Users | Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)) | Until removed or Account deletion, subject to limited retention for security, legal, or compliance purposes |
| Subscription and Transaction Information | Subscription, billing, tax, cancellation, refund, and transaction administration | Customers; Paddle; legacy payment providers | Contract (Art. 6(1)(b)); Legal Obligation (Art. 6(1)(c)); Legitimate Interests (Art. 6(1)(f)) | For the Subscription duration and thereafter as required by applicable tax, accounting, payment, and legal obligations |
| Connector Credentials and Configuration Information | Authenticate connections and apply Connector permissions and settings | Customers, Users, and Connected Platforms | Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)) | Credentials until disconnection or cancellation; configurations while active |
| Automation Information | Configure, schedule, and operate Automations and Tool Calls | Customers and Users | Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)) | Until Automation removal or account deletion |
| Customer Data | Route requests and responses between MCP Clients and Connected Platforms | Customers, Users, MCP Clients, Automations, and Connected Platforms | Customer-determined Art. 6 basis; Provider acts as processor (Art. 28) | Request duration; not persistently retained; Automation session records and AI-provider processing as described in the Privacy Policy |
| Communications and Support Information | Support, inquiries, troubleshooting, and dispute resolution | Directly from Customers, Users, and other requestors | Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)); Legal Obligation (Art. 6(1)(c)) | Up to 24 months after ticket closure or longer as necessary for disputes or legal obligations; support diagnostic bundles are deleted when the ticket closes |
| Usage Data and Tool Call Metadata | Audit logging, monitoring, rate limiting, security, and troubleshooting | Automatically collected through the Services | Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)) | While the account remains active; longer if required for an incident |
| Device and Technical Information | Operate and secure the Site and Services; diagnose technical issues | Automatically from devices, browsers, applications, and networks | Legitimate Interests (Art. 6(1)(f)); Consent where required (Art. 6(1)(a)) | Session or, for server logs, while the account remains active (Provider may apply shorter retention periods to particular log types) |
| Account and Authentication Information | Authentication, session management, account security, and access control | Customers, Users, and automatically generated records | Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)) | While the account remains active; longer if required for an incident |
| Site and Cookie Information | Site operation, login, sessions, storefront, checkout, and cart functionality | Automatically through cookies and similar technologies | Legitimate Interests (Art. 6(1)(f)); Consent where required (Art. 6(1)(a)) | Session or period stated in Cookie Policy |
| Advertising Measurement Information | Measure, attribute, and optimize Provider’s own advertising campaigns | Automatically through advertising cookies and pixels on the Site | Consent (Art. 6(1)(a)); Legitimate Interests (Art. 6(1)(f)) where permitted | Per the Cookie Policy and the advertising platform’s terms |
| Site Analytics Information | Understand Site navigation and identify usability and performance problems | Automatically through site analytics cookies and scripts on the Site | Consent (Art. 6(1)(a)); Legitimate Interests (Art. 6(1)(f)) where permitted | Per the Cookie Policy and the analytics provider’s terms |
| Fraud and Security Information | Prevent fraud, misuse, unauthorized access, and security incidents | Automatically collected; Customers, Users, and security providers | Legitimate Interests (Art. 6(1)(f)); Legal Obligation (Art. 6(1)(c)) | While the account remains active and thereafter as reasonably necessary for security incidents, applicable limitations periods, and legal compliance |
| Privacy Request Information | Verify, process, and document privacy requests and appeals | Requestors, authorized agents, and Customers | Legal Obligation (Art. 6(1)(c)); Legitimate Interests (Art. 6(1)(f)) | At least 24 months or longer as necessary to process requests and demonstrate compliance with applicable law |
| Sensitive or Restricted Information | Authorized Customer Data processing, security, support, and legal compliance | Customers, Users, MCP Clients, Automations, and Connected Platforms | Customer-determined Art. 6 basis and applicable Art. 9 condition | Same as underlying Customer Data |
[ 02 // table 2 // how we use your information – compliance overview ]
Purpose by purpose.
| Purpose | Legal Basis (GDPR) | Data Categories | Retention |
|---|---|---|---|
| Provide and Improve Services | Performance of a Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)) | Account details, limited Subscription and transaction information, technical data, Connector and Automation configuration data, service usage logs | Account or Subscription duration plus applicable legal retention periods; service usage logs while the account remains active |
| Manage Subscriptions | Performance of a Contract (Art. 6(1)(b)); Legal Obligation (Art. 6(1)(c)); Legitimate Interests (Art. 6(1)(f)) | Plan, Subscription, billing, tax, purchase, renewal, cancellation, refund, credit, and limited transaction information received by Provider. Paddle independently controls information it collects directly. | As necessary to administer the Subscription and comply with applicable tax, accounting, payment, and legal obligations |
| Comply With Legal Obligations | Legal Obligation (Art. 6(1)(c)) | Billing information, transaction records, and regulatory records | As required by applicable tax, accounting, recordkeeping, and regulatory laws |
| Communicate With You | Performance of a Contract (Art. 6(1)(b)); Legitimate Interests (Art. 6(1)(f)) | Contact details, communications history, support messages, and service notifications | As reasonably necessary to provide support, document communications, resolve disputes, and comply with legal obligations |
| Process Customer Data and Route Tool Calls | Customer-determined lawful basis; Provider acts as processor under the Data Processing Addendum (Art. 28) | Customer Data contained in requests and responses transmitted among MCP Clients, Automations, and Connected Platforms | Request duration; not persistently retained; Automation session records and AI-provider processing as described in the Privacy Policy |
| Safety, Security, and Fraud Prevention | Legitimate Interests (Art. 6(1)(f)); Legal Obligation (Art. 6(1)(c)) | Technical and security logs, authentication data, and fraud indicators | Usage Data and logs while the account remains active; other information as reasonably necessary for security incidents and legal compliance |
[ 03 // exercise your rights ]
Access, rectify, erase, object.
Submit a request through support.stackjack.io, the privacy request form, or security@stackjack.io. You may also lodge a complaint with your supervisory authority. For transfer safeguards (SCCs, UK Addendum, Swiss safeguards), write to the same address.
