Privacy Policy
Last updated: 17 May 2026
What we collect
Account details: your email, password (hashed), business name, industry, timezone and social handle. Voice inputs: the Facebook posts you upload (we retain the post text), or the website content we read if you choose website setup, plus the voice profile we generate and its version history. Content you create or we generate for you: drafts and your feedback and edits on them, weekly plans and reviews, Coach chat messages, brain dumps, content pillars, generated images in your gallery, and branding such as your logo and brand colour. If you connect a Facebook Page: your Facebook Page ID and name, your Facebook user ID, and access tokens (encrypted at rest). Performance metrics you log or that we pull for connected accounts. Referral data: your referral code, who referred you, and attribution metadata (which can include the IP address and browser user-agent at the time of referral; this is scrubbed after 90 days). Operational data: your IP address and browser user-agent for security monitoring and in our admin audit log, and basic product-usage events such as onboarding steps reached. Billing: Stripe customer and subscription references (your card is handled directly by Stripe; we never see it).
What we do with it
We use your data only to operate Stacked Echo for you. Your post or website content is sent to Anthropic's Claude API for voice extraction and draft generation. Image generation uses fal.ai. Transactional email is sent through Resend. Payments are processed by Stripe. Error and performance monitoring uses Sentry. Rate limiting uses Upstash. Product-usage analytics are processed by PostHog. Scheduled jobs are triggered by cron-job.org. Hosting is provided by Vercel. These providers are listed in full under Sub-processors below.
What we do not do
We do not sell your data. We do not share it with advertisers. We do not use your content to train our own models, and we do not use it to improve the product for other users. Our AI provider (Anthropic) processes your content under its commercial API terms; confirm the current data-handling and training position in Anthropic's terms. We do not share content with any third party not listed under Sub-processors.
Where it lives and overseas processing
Your primary data lives in Supabase (Sydney region) with row-level security so only you can access your records. Backups are encrypted at rest and connections are TLS-encrypted in transit. To operate the service, some of your content and metadata is processed overseas, including in the United States, by Anthropic, fal.ai, Sentry, PostHog and other sub-processors listed below. By using Stacked Echo you consent to this overseas processing.
Your rights
You can request an export of your data by emailing us. You can delete your account from your dashboard, which removes your data within 30 days unless we are legally required to retain it. Note that deletion removes data from our systems; content already processed by a sub-processor is subject to that provider's own retention period. You can request correction of any inaccurate data.
Cookies and analytics
We use minimal cookies, only for authentication. We do not use advertising cookies. We do not run third-party tracking scripts in your browser. We do collect basic product-usage analytics server-side (processed by PostHog) to understand activation and improve the product; this is not used for advertising.
Sub-processors
Anthropic (AI inference, United States). fal.ai (image generation, United States). Supabase (database, auth, storage; Sydney). Stripe (payments). Resend (transactional email). Sentry (error and performance monitoring, United States). PostHog (product-usage analytics). Upstash (rate limiting). cron-job.org (scheduled job triggers). Vercel (hosting). Each is engaged to handle your data only as needed to operate the service.
Changes
We will notify you of material changes via email at least 14 days before they take effect.
Contact
Stacked Echo is operated by Stacked Digital Pty Ltd. For privacy questions, data export requests, or deletion requests, email matthew@stackeddigital.com.