u.s. stateprivacy notice.
effective date // September 7, 2026
California and other U.S. state disclosures: what we collect, what counts as sensitive, and who it goes to — in the category tables the CCPA/CPRA asks for.
Supplements the Privacy Policy · exercise rights via the privacy request form
↓
[ 00 // scope ]
What these tables summarize.
Effective Date: September 7, 2026
These tables summarize the categories of personal information Provider collects and discloses for business purposes under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and other applicable U.S. state privacy laws.
Your rights under these laws, how to exercise them, and our “do not sell” position are described in the California and Other U.S. State Privacy Notice section of our Privacy Policy. Submit a request via the privacy request form, support.stackjack.io, or security@stackjack.io.
[ 01 // table 1 // personal information collected ]
What we collect.
| Category of Personal Information | Examples of Information Collected |
|---|---|
| Identifiers | Name, business email address, telephone number if provided, account identifiers, company or organization name, account role, team membership, permissions, Subscription association, IP address, device identifiers, and online identifiers |
| Customer Records Information | Name, business contact information, billing address, and limited Subscription and transaction information |
| Protected Classification Characteristics | Not collected for Provider’s own purposes |
| Commercial Information | Plan, Subscription, purchase, renewal, cancellation, refund, credit, and transaction information |
| Internet or Other Electronic Network Activity | Site and Services usage, Tool Call metadata, login and authentication activity, pages viewed, navigation paths, browser and device information, latency, response status, error codes, and diagnostic information, and advertising campaign-measurement events |
| Geolocation Data | Approximate location derived from an IP address and location information associated with billing or transaction records. Provider does not collect precise GPS location through the Services. |
| Audio, Electronic, or Visual Information | Communications, screenshots, files, and other materials voluntarily provided for support, feedback, or privacy requests |
| Professional or Employment-Related Information | Business email address, company or organization name, account role, team membership, permissions, and Subscription association |
| Inferences | Not created for profiling, advertising, or decisions producing legal or similarly significant effects |
| Sensitive Personal Information | Account login credentials, authentication information, Connector credentials, Client Secrets, API keys, OAuth access and refresh tokens, and authorized Customer Data containing sensitive personal information |
| Biometric Information | Not knowingly collected. Customers must not submit biometric information unless authorized by Provider in writing. |
| Education Information | Not knowingly collected |
[ 02 // table 2 // sensitive personal information collected ]
What counts as sensitive.
| Category of Sensitive Personal Information | Examples of Information Collected |
|---|---|
| Government Identification Numbers | Not collected for Provider’s own purposes. Customers must not submit government-issued identification numbers unless authorized by Provider in writing. |
| Payment-Card Information | Provider does not receive or store complete payment-card numbers, CVVs, or raw payment credentials. Payment information collected directly by Paddle is governed by Paddle’s privacy notice. |
| Account Login Credentials | Account credentials, authentication tokens, session information, and information relating to two-factor authentication |
| Connector Credentials | Client Secrets, API keys, OAuth access and refresh tokens, and other authentication information used to connect Connected Platforms |
| Precise Geolocation | Not collected |
| Identity-Verification Photos | Not collected for Provider’s own purposes |
| Sensitive Customer Data | Sensitive personal information contained in Customer Data when processing has been authorized by Provider in writing and any required agreement has been executed |
Paddle independently collects payment, billing, location, and tax information directly from Customers as the authorized reseller and merchant of record. Provider does not disclose that information to Paddle unless otherwise stated. Paddle’s own privacy notice and terms govern its processing.
[ 03 // table 3 // personal information disclosed for a business purpose or at customer direction ]
Who it goes to.
| Category of Personal Information | Categories of Recipients | Business Purpose |
|---|---|---|
| Identifiers | Cloud-hosting providers; authentication, security, communications, support, and professional-service providers; legacy commerce providers; legal or regulatory authorities; advertising and campaign-measurement platforms (currently Reddit and Google); site analytics providers (currently Microsoft Clarity) | Account administration; authentication; hosting; security; communications; support; legal compliance; advertising measurement and attribution |
| Customer Records Information | Legacy commerce and payment providers; professional advisers; legal or regulatory authorities | Subscription administration; transaction processing; recordkeeping; legal compliance |
| Commercial Information | Legacy commerce and payment providers; cloud-hosting providers; support providers; professional advisers | Subscription administration; transaction processing; support; accounting; dispute resolution |
| Internet or Other Electronic Network Activity | Cloud-hosting, security, monitoring, and technical-support providers; advertising and campaign-measurement platforms; site analytics providers | Operating and securing the Services; audit logging; fraud prevention; debugging; monitoring; troubleshooting; advertising measurement and attribution; Site usability analysis |
| Approximate Location Information | Cloud-hosting and security providers; legacy commerce and payment providers where applicable | Security; fraud prevention; transaction administration; tax and legal compliance |
| Audio, Electronic, or Visual Information | Support, communications, cloud-hosting, and professional-service providers; legal or regulatory authorities | Customer support; troubleshooting; dispute resolution; legal compliance |
| Professional or Employment-Related Information | Cloud-hosting, authentication, support, and communications providers | Account and Customer Team administration; authentication; permissions management; support |
| Inferences | Not disclosed because Provider does not create inferences for profiling, advertising, or significant automated decisions | Not applicable |
| Sensitive Personal Information | Provider’s cloud-hosting, authentication, and security service providers; and Customer-selected Connected Platforms and MCP Clients, which are independent third parties | Authentication; securing Connector credentials; providing Customer-directed Services; preventing fraud and unauthorized access |
| Biometric Information | Not collected | Not applicable |
| Education Information | Not collected | Not applicable |
[ 04 // exercise your rights ]
Access, correct, delete, opt out.
We do not sell personal information. To opt out of advertising measurement, limit use of sensitive personal information, or exercise any other state privacy right, use the form or write to security@stackjack.io. We honor Global Privacy Control signals where required by law.
