privacypolicy.
The short version: we collect what we need to run the gateway, your business data passes through and is not stored, we never sell it, and we never use it to train AI. The long version is below, with a clickable outline.
What this covers, and who we are.
Effective Date: September 7, 2026
This Privacy Policy applies to our stackjack.io website (“Site”) and the Services owned and operated by MSP Automator Labs, LLC doing business as StackJack.io (“Provider,” “we,” or “us”). This Privacy Policy explains how we collect, use, store, and disclose personal information when you access or use our Services.
Capitalized terms not defined in this Privacy Policy have the meanings stated in our Terms of Service, available at https://stackjack.io/terms/#s01.
The Services provide a Model Context Protocol gateway that enables Customers to connect MCP Clients to Connected Platforms through Connectors. Provider acts as an intermediary that routes requests and responses between MCP Clients and Connected Platforms.
Our operations may be subject to applicable privacy and data protection laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), the European Union General Data Protection Regulation (“GDPR”), and other applicable United States and international privacy laws.
Three ways in.
We collect personal information from and about Customers and Users of our Services in the following ways:
What you hand us.
When you create an account, configure or use the Services, or communicate with us, we may collect:
Account and Contact Information
Your name, business email address, company or organization name, account identifiers, telephone number if provided for authentication, and other information you provide during registration.
Customer Team Information
The email address, invitation status, team membership, role, permissions, Subscription association, and other account information relating to Users you invite to your account.
Subscription and Billing Information
Information relating to your Free Tier, Plan, Bundle, Subscription, Order Form, billing address, location, tax information, purchases, renewals, cancellations, refunds, and credits. Third-party service providers process payments and maintain applicable transaction and Subscription records. We receive limited transaction and Subscription information and do not receive or store your complete payment-card number, CVV, or raw payment credentials. For additional information, see Disclosure of Your Personal Information.
Connector Credentials and Configuration Information
Credentials, Client IDs, Client Secrets, access tokens, refresh tokens, API keys, and other authentication information used to connect a Connected Platform, together with Connector configurations, User permissions, and tool-access settings. Provider does not receive or store your Connected Platform password.
Automation Information
Configurations, schedules, triggers, selected Tool Calls, and other information you provide when configuring or using an Automation.
Customer Data
Information submitted by or on behalf of a Customer, User, or Customer client, or originating in a Connected Platform, including personal information transmitted in requests or responses through an MCP Client or Automation.
Communications and Support Information
Records and copies of your correspondence with us, including emails, support requests, feedback, logs, screenshots, files, and information you provide when exercising a privacy right.
Don’t send it unless we’ve agreed.
The Services do not require Customers to submit protected health information, complete payment-card information, biometric information, government-issued identification numbers, or other sensitive personal information. Customers must not submit this information unless Provider has authorized the processing in writing and the parties have entered into any agreement required by applicable law, including a Data Processing Addendum or Business Associate Agreement.
When authorized, Customer Data may contain sensitive personal information maintained in a Connected Platform or transmitted through an MCP Client or Automation. Customers determine what Customer Data is transmitted and are responsible for providing required notices, obtaining required consents, and implementing appropriate safeguards.
Provider processes sensitive personal information only as necessary to provide and secure the Services, authenticate connections, prevent fraud and misuse, comply with applicable law, and perform other legally permitted purposes.
Your call, revocable.
Depending on applicable law, you may have the right to request deletion of sensitive personal information, withdraw consent where processing is based on consent, or, under applicable U.S. state law, limit certain uses or disclosures of sensitive personal information. These rights are subject to applicable exceptions, and withdrawal does not affect processing completed before consent was withdrawn. See How to Exercise Your Rights.
Metadata, not payloads.
When you access or use our Services or Site, we may automatically collect:
Usage Details
Information about your interactions with the Services, including Tool Call counts, tools invoked, the initiating MCP Client, User, or Automation, timestamps, response status, latency, error codes, authentication events, and aggregate Tool Call volume. Usage Data does not include the content of Customer Data.
Device and Technical Information
Information about the device and network used to access the Services or Site, including IP address, device identifiers, operating system, browser type and version, referring URL, application version, and similar technical information.
Account and Authentication Activity
Login activity, session information, authentication events, account-security events, and information relating to two-factor authentication.
Site Activity
Pages viewed, navigation paths, and WooCommerce storefront, account, checkout, or cart activity.
Cookies, pixels, and what they’re for.
We use cookies and similar technologies to operate and secure the Site and Services and for the purposes described below. These technologies include login and session cookies, WordPress authentication cookies, and WooCommerce cookies used for storefront, account, checkout, and cart functionality.
We also use third-party advertising technologies, including pixels and server-side conversion reporting, to measure the performance of our advertising campaigns. These technologies collect or receive device and browser information, IP addresses, cookie and advertising identifiers, hashed identifiers, and campaign-event information, such as page visits, checkout initiation, sign-ups, and completed purchases, and disclose that information to advertising platforms for campaign attribution, measurement, and optimization. Where required by applicable law, we obtain consent before using advertising cookies, pixels, or similar technologies. We use the information collected by these technologies only to measure and improve our own advertising; we do not use it to build profiles of individuals for unrelated purposes, and we do not sell it.
We also use a third-party session-analytics service to understand how visitors navigate the Site and to identify usability and performance problems. That service collects device and browser information, page interactions, and similar technical information; we configure it to mask text entered into forms. Where required by applicable law, we obtain consent before using site analytics cookies.
For additional information about the cookies and similar technologies used on the Site, including their purposes and duration, see our Cookie Policy at https://stackjack.io/cookie-policy/.
These purposes, no others.
We use personal information for the following purposes:
Provide the Services
Create and administer accounts, enable Connectors, route requests and responses between MCP Clients and Connected Platforms, operate Automations, and provide requested features and functionality.
Manage Subscriptions
Administer Plans, Subscriptions, purchases, renewals, cancellations, refunds, credits, and related transactions through applicable third-party service providers.
Authenticate Users and Protect the Services
Verify identity, manage access permissions, secure accounts and Connector credentials, detect and prevent fraud or misuse, and investigate security incidents.
Monitor and Support the Services
Maintain audit logs, monitor performance and availability, enforce rate limits and Plan requirements, diagnose errors, troubleshoot issues, and provide customer support.
Operate and Improve the Services
Analyze Usage Data and other operational information to maintain, develop, and improve the performance, reliability, and functionality of the Services.
Create and Use Aggregate or Deidentified Information
Create aggregate or deidentified information that does not reasonably identify an individual and use that information for operational, analytical, research, and service-improvement purposes.
Communicate with You
Send transactional and service-related communications, including Subscription confirmations, billing notices, account-status notices, security notices, critical service notifications, policy updates, and support responses.
Comply with Legal Obligations
Comply with applicable laws, regulations, legal processes, and governmental requests, and establish, exercise, or defend legal claims.
Enforce Our Agreements
Enforce our Terms of Service, available at https://stackjack.io/terms/, Order Forms, policies, and other agreements and protect the rights, property, and safety of Provider, our Customers, Users, and others.
Provider may send Customers and Users product, feature, and service announcements, including information about new or updated products, features, and services. Recipients may opt out of promotional communications by using the unsubscribe instructions included in the communication or contacting us as described below. Opting out will not prevent Provider from sending transactional, administrative, security, or other communications necessary to provide the Services.
Provider does not purchase or rent marketing lists or send marketing communications on behalf of third parties. Provider uses personal information to measure the performance of its advertising as described in Tracking Technologies.
Pass-through, not training data.
The Services enable Customers to connect MCP Clients, including third-party artificial intelligence assistants, to Connected Platforms through Connectors. Provider provides the Connector and pass-through functionality but does not provide or control the underlying MCP Clients or their artificial intelligence models.
MCP Clients submit Customer-directed Tool Calls to Provider. Provider routes each Tool Call to the applicable Connected Platform and returns the requested response to the initiating MCP Client. Except as described in this section, Provider does not transmit Customer Data to an MCP Client beyond the response requested through the applicable Tool Call.
MCP Clients and Automations may initiate Tool Calls without contemporaneous human review. Customers determine which MCP Clients, Connected Platforms, Connectors, permissions, and Automations they use. Provider enforces Customer-configured User and tool-access restrictions at the Connector level.
Certain features of the Services, including Automations, use third-party artificial intelligence service providers. When a Customer configures or runs an Automation, Provider may transmit agent instructions and knowledge text, run context, tool arguments, tool results that may include Customer Data returned by Connected Platforms, model responses, session transcripts, and Customer-enabled agent memory to an artificial intelligence service provider for processing and retention in accordance with Provider’s agreement with that service provider. Where the Customer elects to use its own artificial intelligence provider account and key, this information is transmitted to the provider selected by the Customer and processed under the Customer’s agreement with that provider. Provider retains summarized Automation session records in accordance with its applicable retention practices. Provider personnel may also use an artificial intelligence service provider to assist with support-ticket research and drafting, which may include the processing of ticket content and related diagnostic information. For a service-by-service description of this processing, see our External Data Processing documentation at docs.stackjack.io.
Provider logs Tool Call metadata for audit, security, rate-limiting, operational, and troubleshooting purposes. These logs do not include the substantive content of Customer Data contained in requests or responses.
No AI training on Customer Data
Provider does not use Customer Data to train, develop, fine-tune, or improve artificial intelligence or machine-learning models and does not authorize its service providers to use Customer Data for their independent AI-training purposes. The applicable MCP Client provider’s independent handling and use of information is governed by that provider’s privacy policy and terms.
No significant automated decisions
Provider does not use personal information to make decisions that produce legal or similarly significant effects concerning individuals.
Who sees what.
We disclose personal information as described below.
Third-Party Service Providers
We engage third-party service providers to perform services on our behalf or support the operation of the Services. These providers process personal information for the services they provide, subject to applicable contractual and legal requirements. These service providers include providers of hosting and infrastructure, identity and authentication, payment processing and commerce functionality, communications, customer support, artificial intelligence, application monitoring, security, professional services, and other business operations. These providers may process personal information as necessary to provide their services. A current list of Provider’s subprocessors is available through our Trust Center at trust.stackjack.io.
Legacy Subscriptions
Provider may continue to use third-party payment processors and commerce providers to administer legacy Subscriptions until those Subscriptions are migrated or terminated. These providers may process payment, billing, transaction, order, and Subscription information in accordance with their applicable privacy notices and terms.
Payment Reseller and Merchant of Record · Paddle
Paddle acts as the authorized reseller and merchant of record for new purchases. In that capacity, Paddle is an independent controller of the payment, billing, location, and tax information it collects directly from Customers and administers payment processing, recurring billing, invoicing, refunds, chargebacks, and cancellation requests for the Subscriptions it processes. Paddle’s independent processing of personal information is governed by the Paddle Privacy Notice at https://www.paddle.com/legal/privacy and Paddle Buyer Terms at https://www.paddle.com/legal/buyer-terms.
The Services also interact with third-party services selected by Customers. These third parties do not act as service providers to Provider, and their independent processing is governed by their respective privacy policies and terms:
Connected Platforms
Connected Platforms provide information in response to Tool Calls initiated by a Customer, User, MCP Client, or Automation. The information received depends on the Connected Platform, the applicable Connector, and the request submitted through the Services.
MCP Clients and AI Providers
MCP Clients submit Tool Call requests to the Services and receive the requested responses. The applicable MCP Client provider’s privacy policy and terms govern its collection and processing of conversation content, Tool Call requests, responses, and other information.
We may also disclose personal information to professional advisers; legal and regulatory authorities; in connection with an actual or proposed business transaction; or when directed or authorized by a Customer or User.
As described in Tracking Technologies, we disclose limited device and browser information, IP addresses, cookie and advertising identifiers, hashed identifiers, and campaign-event information to advertising platforms for campaign attribution, measurement, and optimization. We do not disclose personal information to data brokers or third parties for their independent advertising, marketing, or promotional purposes.
Knobs you control.
You may update account information, manage Connector and Automation settings, disconnect Connected Platforms or MCP Clients, manage cookies through available browser settings, withdraw consent where applicable, or request deletion of your account. Certain choices may limit the availability or functionality of the Services. Transactional and service-related communications are necessary to administer accounts, Subscriptions, security, and the Services.
Ask, and we verify.
To exercise an applicable privacy right, submit a request through https://support.stackjack.io or contact us at security@stackjack.io. Please describe your request and provide sufficient information for us to identify the personal information to which the request relates. You can also use the privacy request form below.
We may take reasonable steps to verify your identity and authority before processing a request. If we cannot verify your identity or authority, we may be unable to fulfill the request. We will respond within the period required by applicable law.
Where permitted by law, you may use an authorized agent to submit a request on your behalf. We may require evidence of the agent’s authority and may ask you to verify your identity directly with us.
If we deny your request, you may have the right to appeal our decision by contacting us at security@stackjack.io and stating that you are submitting a privacy appeal.
We will not discriminate against you for exercising an applicable privacy right.
If Provider processes personal information on behalf of a Customer as part of Customer Data, the Customer controls that information. You should submit your request directly to the applicable Customer. We will reasonably assist the Customer in responding to the request as required by applicable law and our agreements.
Third-party payment providers may independently control certain payment and transaction information. We may direct you to the applicable provider when a request relates to information controlled by that provider.
Delete it — on the record.
Use this form to request deletion, export, correction, or a copy of your personal data. Requests go to security@stackjack.io — our privacy contact — and are logged and tracked to closure. You can also open a ticket at support.stackjack.io.
Payment and billing records for new purchases are held by Paddle as merchant of record. If your request covers payment data, note it above and we will direct you to, or coordinate with, the applicable provider.
Kept only as needed.
We retain personal information only for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Privacy Policy, comply with applicable legal and regulatory obligations, resolve disputes, and enforce our agreements.
Retention periods vary depending on the type of information and the purposes for which it is processed. The following table summarizes our retention practices:
| Data Category | Retention Period |
|---|---|
| Account and Contact Information | Retained for the duration of the account or active Subscription and for a reasonable period afterward to facilitate reactivation and comply with legal, financial, and recordkeeping obligations. |
| Subscription and Transaction Information | Retained for as long as necessary to administer the Subscription and comply with applicable tax, accounting, payment, dispute-resolution, and legal obligations. Third-party payment providers retain payment information according to their respective privacy policies and legal obligations. |
| Connector Credentials | Deleted when the applicable Connector is disconnected or the applicable Subscription is cancelled. Encrypted Connector credentials are purged from our systems, and we do not retain copies. |
| Connector and Automation Configurations | Retained while the applicable Connector, Automation, or account remains active and deleted when it is removed or the account is deleted, except where limited retention is required for security, legal, or operational purposes. |
| Usage Data and Logs | Retained while the applicable organization remains active for security, audit, operational, and troubleshooting purposes and deleted when the organization is deleted, except where limited retention is reasonably necessary for security, legal, compliance, or dispute-resolution purposes. Provider may apply shorter retention periods to particular log types. |
| Customer Data and API Payloads | Not persistently retained after the applicable request is completed. Customer Data exists in memory only for the duration of the request and is not written to persistent storage, except where temporary processing or retention is reasonably necessary to provide, secure, support, or troubleshoot the Services, comply with applicable law, or enforce our agreements. Automation session content is processed and retained by the applicable AI provider, and Provider retains summarized Automation session records, as described in Artificial Intelligence and Automated Processing. |
| Communications and Support Information | Retained for as long as reasonably necessary to respond to the communication, provide support, document the matter, resolve disputes, and comply with applicable legal obligations. |
| Privacy Requests | Retained for as long as reasonably necessary to process the request and demonstrate compliance with applicable privacy laws. |
| Website and Cookie Information | Retained for the applicable session or for the period stated in our Cookie Policy at https://stackjack.io/cookie-policy/. |
| Aggregate or Deidentified Information | May be retained for longer periods because it does not reasonably identify an individual. |
Residual copies of personal information may remain in encrypted backups for a limited period in accordance with Provider’s backup and disaster-recovery practices. Backup copies are accessed only as necessary for backup restoration, disaster recovery, security, or legal compliance and are protected with the safeguards described in Data Security.
You may request deletion of your account and associated personal information through https://support.stackjack.io or by contacting security@stackjack.io. We will process verified deletion requests within 30 days, subject to applicable legal exceptions and any longer period permitted by law.
How it’s protected.
We maintain reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, acquisition, use, alteration, disclosure, or destruction. These safeguards include:
No method of transmission or storage is completely secure. Accordingly, we cannot guarantee the absolute security of personal information.
Customers and Users are responsible for maintaining the confidentiality of their account credentials, Connector credentials, API keys, access tokens, and authentication information and for promptly notifying us of any suspected unauthorized access or security incident.
Additional information about our security practices may be requested by contacting us at security@stackjack.io. See also the security brief.
State by state.
Depending on where you reside and subject to applicable exceptions, you may have rights to access, correct, delete, or obtain a copy of your personal information and to appeal our response to a privacy request. You may also have rights relating to sensitive personal information, targeted advertising, and the sale or sharing of personal information.
We do not sell personal information. As described in Tracking Technologies, we disclose limited device, identifier, and campaign-event information to advertising platforms to measure and optimize our advertising campaigns. To the extent applicable law treats those disclosures as “sharing” or processing for targeted advertising, you may opt out as described in How to Exercise Your Rights or through a browser or device setting that communicates your opt-out choice, such as Global Privacy Control (GPC). Some browsers also offer a “Do Not Track” (DNT) signal; because there is no accepted industry standard for how to respond to DNT signals, our services do not currently respond to them, but we do honor GPC as described above.
For additional information about applicable state privacy rights and how to exercise them, see the California and Other U.S. State Privacy Notice at https://stackjack.io/us-privacy-notice/.
Across the pond.
If you are located in the European Economic Area, United Kingdom, or Switzerland, you may have rights to access, correct, delete, restrict, or object to the processing of your personal information; receive a portable copy of your personal information; withdraw consent; and submit a complaint to an applicable supervisory authority.
For information about our legal bases for processing, international data transfers, and how to exercise these rights, see our European, UK, and Swiss Privacy Notice at https://stackjack.io/eu-privacy-notice/.
Controller here, processor there.
As controller
Provider acts as a controller of personal information it processes for its own business purposes, including account administration, Subscription management, security, support, and operation of the Site.
As processor / service provider
Provider acts as a processor or service provider when it processes Customer Data on behalf of a Customer through the Services. In that context, the Customer determines the purposes and means of processing, and Provider processes Customer Data according to the Customer’s instructions and our applicable agreements.
Customers are responsible for providing required notices, obtaining required rights and consents, establishing a lawful basis for processing Customer Data, and complying with laws applicable to their collection and use of Customer Data.
Our Data Processing Addendum is available through our Trust Center at trust.stackjack.io.
Why we’re allowed.
Depending on your location and the purpose for which we process your personal data, we rely on one or more of the following legal bases:
Necessity to Perform a Contract
We process personal data when necessary to provide the Services, fulfill our contractual obligations, administer accounts and Subscriptions, and provide support.
Consent
We process personal data based on consent where consent is required by applicable law. You may withdraw consent at any time without affecting processing completed before consent was withdrawn.
Legitimate Interests
We process personal data as necessary to operate, secure, support, and improve the Services, provided those interests are not overridden by your rights and freedoms. These interests include authentication, fraud and misuse prevention, audit logging, Plan enforcement, monitoring, troubleshooting, security, internal administration, and legal claims.
Legal Obligations
We process personal data as necessary to comply with applicable tax, accounting, recordkeeping, privacy, security, and other legal obligations and lawful governmental or regulatory requests.
Where Provider processes Customer Data on behalf of a Customer, including by enabling Connectors and Automations and routing Tool Calls, Provider acts as a processor and processes that data on the Customer’s documented instructions under our Data Processing Addendum. The Customer is responsible for establishing the applicable lawful basis.
Detailed information concerning processing purposes, legal bases, and retention periods is provided in the European, UK, and Swiss Privacy Notice at https://stackjack.io/eu-privacy-notice/.
Where it lives.
Provider is based in the United States, and the Platform is hosted on Microsoft Azure. Customers may select a United States or European Union hosting region for certain operational data and may migrate an organization between hosting regions as described in our documentation. The selected hosting region determines where certain regional application stores are located but does not mean that all personal information is processed exclusively in that region. Certain service providers and shared services may process personal information outside the selected region. Personal information may be processed in the United States and other countries where Microsoft Azure or our other service providers operate. These countries may have privacy and data protection laws that differ from those in your jurisdiction.
Where required by applicable law, we use appropriate safeguards for international transfers of personal information. These safeguards may include applicable adequacy decisions, the European Commission’s Standard Contractual Clauses, the United Kingdom International Data Transfer Addendum, and applicable Swiss transfer safeguards. To request additional information about these safeguards, contact us at security@stackjack.io.
Eighteen and up.
The Services are designed for business use and are not intended for individuals under 18 years of age. We do not knowingly collect personal information from individuals under 18. If we learn that we have collected such information, we will delete it. If you believe we may have information from or about an individual under 18, please contact us at security@stackjack.io.
When this changes.
We may update this Privacy Policy from time to time to reflect changes to our Services, processing activities, legal obligations, or business practices.
When we update this Privacy Policy, we will revise the Effective Date at the top of the policy. If required by applicable law, we will provide additional notice of material changes through the Site, the Services, email, or another appropriate method.
We will provide any notice or obtain any consent required by applicable law before using personal information for a materially different purpose. We will not apply material changes retroactively unless permitted by applicable law.
In any format you need.
We are committed to making this Privacy Policy accessible. If you require this Privacy Policy or any related privacy notice in an alternative format or need assistance accessing this information, please contact us at security@stackjack.io.
Questions about your privacy?
If you have questions about this Privacy Policy or our privacy practices, or wish to exercise an applicable privacy right, contact us at:
MSP Automator Labs, LLC
8 Lombardy St #41520, Newark, NJ 07102
Email: security@stackjack.io
Privacy requests: https://support.stackjack.io
