Privacy Policy

Last updated: July 1, 2026 · Applies to srce-app.fly.dev ("SRCE")

1. What we collect

Data	Why
Account email + password (hashed)	Authenticate you; we never see or store your plain-text password (pbkdf2, salted).
Business relationship data you send us	Company/contact/deal records, revenue, usage, and note facts you explicitly push via the app, API, or your own integration — this is the product.
Billing data	Handled entirely by Stripe; we store only your plan, subscription status, and Stripe customer ID — never your card number.
Basic request logs	IP address and request metadata, kept briefly for abuse prevention and debugging.

2. What we don't do

We don't sell your data or share it with advertisers.
SRCE never holds your other third-party API keys (HubSpot, Intercom, Stripe, etc.) as part of its normal integration model — the primary way data reaches SRCE is via an agent/integration you control, which holds its own keys and pushes facts to us. Some optional connectors (e.g. HubSpot sync) let you paste a token directly into your workspace; that token is stored encrypted and scoped to your tenant only, never shared across tenants.
We don't use your business data to train models outside serving your own account's features (e.g. your own ICP scoring). If we ever change this, we'll update this policy and ask first for anything beyond your own tenant's data.

3. Where your data lives

Each workspace ("tenant") has its own isolated database file — your data is never comingled with another tenant's. Data is stored on encrypted disk (Fly.io volumes) with TLS in transit, and backed up via daily automated snapshots (5-day retention). See the operational detail in our backups documentation if you'd like specifics.

4. Third parties we use to run the Service

Provider	Purpose
Fly.io	Application hosting and database storage.
Stripe	Payment processing for paid plans (only if you upgrade).
Anthropic	Powers optional AI features (chat, column-mapping, ICP narrative) — only the specific data needed for that request is sent, not your whole dataset.

5. Your rights

Export — a full, re-importable copy of everything (JSON or CSV), any time, from Settings.
Delete — permanently erase your account and all associated data via Settings → Danger zone. This is irreversible and removes your tenant database, not just a soft flag.
Access/correct — since you write all the business data yourself via the app/API, you already have full read/write access to correct it directly.

If you're in the EU/UK/California or another jurisdiction with statutory data-subject rights and want to exercise them beyond the self-serve tools above, contact us at nick@stackswap.ai.

6. Data retention

We keep your data for as long as your account is active. If you delete your account, your tenant database is permanently removed (backups age out per the retention window above). We may retain minimal billing records as required by law/tax obligations.

7. Beta notice

SRCE is in beta. Please don't upload data subject to a compliance regime we haven't certified against (health records/HIPAA, payment card data, government IDs, etc.) until we've explicitly confirmed that certification.

8. Changes to this policy

We'll update the date at the top when this policy changes; material changes will be called out here.

9. Contact

Questions about this policy or your data: nick@stackswap.ai

This document is a plain-language draft and is not a substitute for legal advice — have it reviewed by counsel before relying on it for a public launch, particularly if you'll have EU/UK users (GDPR) or California users (CCPA).