Privacy notice
Version 2026-10-27 · Last updated: 27 October 2026
In short
- We keep your name, e-mail and sign-in details, and the business records you and your team enter: customers, messages, quotes and visits.
- Each business's records are kept apart from every other business. We do not sell data and we show no ads.
- Our AI assistant reads your records to answer and to draft messages. Messages to customers may be written by AI, and are labelled.
- If you use the microphone, your voice is sent to a speech service to be understood. We do not keep the recording.
- You can download your data, ask to correct or erase it, delete your account, switch marketing on or off, and write to the Grievance Officer. You may also complain to the Data Protection Board of India.
- Schools: for a student we keep only a first name or initials and the admission number, we write only to the parent or guardian, and a child's details are never sent to an AI model.
This notice says what personal data Stack19 keeps, why, who handles it, where it goes, how long we keep it, and how you use your rights. It is written for the owners and staff of Indian shops, builders' merchants and schools who use the service, for the customers and parents those businesses write to, and for people who visit our website.
Stack19 is provided by Stack19, a sole proprietorship of Gowtham Reddy Sodanapalli, registered for GST in Andhra Pradesh, India ("we", "us"). Write to privacy@stack19.com for anything in this notice.
1. Two roles
- Your account and your use of Stack19 (you and your team: name, e-mail, sign-in details). We decide why and how this is used. For it we are the data fiduciary under India's DPDP Act 2023.
- Your customers' data (the people and companies a business enters as leads, customers, parents or guardians). The business decides why it keeps them. We only handle this data for the business, on its instructions, to run the service (we are its "data processor"). The business is its data fiduciary and is responsible for having the right to contact its customers.
2. What data, and why
| What | Examples | Why |
|---|---|---|
| Account | Your name, e-mail address, password (kept only as a one-way hash), the secret of your authenticator app, your role in a business (Owner, Admin, Sales, Viewer), language and light or dark choice, the version of this notice and of the Terms you accepted, and when. With Google or Facebook sign-in: the name and verified e-mail address that account shares with us. | To let you sign in and use the service. |
| Business | The business name, team members and roles, type of business, plan, opening times, quiet hours and sending settings. | To run the service for the business. |
| Your customers | Name, phone number, e-mail address, job title; company, city; whether each person agreed to be contacted by e-mail, WhatsApp or phone, and do-not-contact marks; enquiry text; quotes, orders and amounts; store visits; for a school, the records of section 8. | To run the business's work: enquiries, quotes, follow-ups, orders, fees. |
| Extras of a business type | Textile wholesale: catalogue photos (of sarees, not people), store visits and bookings. Construction materials: customer sites (name, address, PIN code, map point, access notes), delivery trips (vehicle number, driver's name and phone), proof of delivery (who received the goods, and a photo that can show people) and what each customer owes. Schools: section 8. | To run the work that business type needs. |
| Messages and chats | Messages drafted for or sent to customers, their status and history, who approved them; your chats with our AI assistant. | To prepare and track messages; to answer you. |
| Voice | If you use the microphone, the recording is sent to a speech service to become text. We do not keep the recording. If a business uses its own voice for calls, the recorded sentence and sample are kept until the Owner deletes them. | To understand what you say and to speak for the business. |
| Records of use | A security log of who did what in a workspace and when (sensitive values by name only, not by content); counts of AI use and cost; short-lived records of sign-up attempts; the time, IP address and browser type of each session, kept by our sign-in provider. | To keep the service safe and to stop abuse. |
| Billing | Business name, GST number if you give one, billing e-mail. Card or UPI details are taken by the payment provider and are not stored by us. | To invoice you and meet tax duties. |
| Website visitors | If you book a demo or join the waitlist: your name, kind of business, city, phone number or e-mail, preferred language, and whether you ticked the box for news and offers. If you write to us: what you send. | To contact you about a demo, and about your place when the service opens. |
| On your device | Cookies and a few settings kept in your browser's own storage (section 11). They stay on your device. | To keep you signed in and remember your choices. |
We do not collect your contacts or address book, your precise location, or advertising or tracking data. We use no advertising and no analytics. We do not sell personal data.
3. Consent: the service, and marketing
- The service. To create an account you agree to the Terms and confirm you have read this notice. We keep the version you saw and the time. This consent is the account itself: it ends when you delete the account.
- Marketing. News and offers about Stack19 are a separate choice. The box is never ticked for you and nothing depends on it. You can switch it on or off at any time in Settings, Privacy and data, as easily as you gave it, and it takes effect at once. We keep each choice with the version of this notice and the time.
- We also rely on the uses the Act allows without consent, such as providing a service you asked for and meeting legal duties.
4. Our assistant is an AI
The assistant in Stack19 is an AI. It reads the business's records to answer questions and to prepare drafts: replies, follow-ups, quotes, visit bookings and reminders. Messages and calls it makes for a business say they come from the business's AI assistant.
The AI never sets prices (they come from the business's price list by fixed rules). A message goes out only under the rules the business has switched on: money, promises and complaints always wait for a person's approval, a campaign is sent only after the Owner approves it, and a customer who said stop is never contacted.
To do this, your question and the records it needs (such as company names, message text and amounts) are sent to an AI model provider. The service is designed not to pass customer contact details to the model, but free text such as an enquiry can contain personal data. A school's student records and children's names are never sent to a model or a speech service (section 8).
6. Where your data goes, and abroad
The list in section 5 gives the country of each provider. Where it is not India, the data that provider needs leaves India. That is a transfer abroad. The DPDP Act allows it except to countries the Government of India restricts. For visitors in the EU or UK we use the safeguards the GDPR requires.
A provider only gets what it needs for its purpose. WhatsApp, run by Meta, is used only when a business connects its own WhatsApp number: the message text and the recipient's number go through it to the customer.
7. How long we keep it
| Data | How long |
|---|---|
| Account data | While your account exists. If you delete the account, it is erased after the 7 days you have to cancel. |
| A business's records | Until the Owner erases them, or the workspace is erased. A workspace whose plan lapsed is read-only for 90 days; we e-mail the Owner 48 hours before erasing it, then erase it. |
| Chats with the AI assistant | As the business's records. |
| Voice recordings | Not kept. A voice a business recorded for its own calls is kept until the Owner deletes it. |
| Security and audit log | At least one year (365 days), then purged. It holds no contact details or message text. |
| Do-not-contact keys | When a customer is erased, a keyed fingerprint (not readable) of their phone number or e-mail is kept only so they are never contacted again. |
| Website enquiries (demo, waitlist) | Until you ask us to delete them, or until we have answered and you no longer want to be on the list. |
| Invoices and payment records | As long as the tax law requires. |
| Backups | Copies age out after about 7 days. If we restore a backup, we repeat any erasures made since. |
8. Children and schools
Stack19 is for businesses and adults. It is not meant for anyone under 18 to use, and we do not knowingly collect data from a child who signs up. If you think we have, write to privacy@stack19.com and we will erase it.
A school can use Stack19 for admissions, fees and messages to parents. The school is the data fiduciary for its students' data and is responsible for the parent's or guardian's consent the law requires. For this we follow strict rules:
- Minimal fields. For a student: a first name or initials and the school's admission number, with the programme and class. There is no field for date of birth, photograph, address, Aadhaar, health, religion, caste, income, behaviour or the child's own phone or e-mail.
- Guardian contact only. The phone number and e-mail belong to the parent or guardian. A child is never a contact and never written to.
- Never sent to AI. A child's name or label and admission number are never given to an AI model or a speech service, never written to a log, and never put in a default export. Marks and progress messages are filled from the file the school uploads, shown to the school before sending, and are not stored by us.
- Fees are records, not profiles. We build no profile of a child, track no behaviour and show no advertising.
- Deletion. The school's Owner can erase a student at any time.
9. Your rights, and how to withdraw
You have the right to: see a summary of your personal data and who it is shared with (access); correct wrong data; have your data erased; withdraw consent at any time; get a reply to a complaint; and name another person to act for you if you die or cannot act (nomination). Visitors in the EU or UK may also receive their data in a common format and ask us to restrict certain uses.
- In the app, Settings, Privacy and data: download my data (a file with each table as JSON and CSV), delete my account, switch marketing on or off, and send us a grievance. Owners can also erase one customer, one company or a whole workspace.
- Delete my account: you type your e-mail to confirm; nothing is erased for 7 days, and you can cancel in that time. Then it is erased and the deletion is logged.
- By e-mail: write to privacy@stack19.com and say what you want (access, correction, erasure or withdrawal). We may need to check who you are first. We answer a request to access, correct or erase your data within 7 days. We act on a withdrawal of consent within 48 hours: we stop messages, calls and campaigns to you. The do-not-contact option in the app takes effect immediately. See also the page /data-deletion.
- If you are a customer or a parent of a business that uses Stack19, please contact that business first: it decides about your data and we will help it to act.
What erasure cannot do: a name inside free text, such as a note that only mentions a person, cannot be found with certainty (those places are listed for the Owner to review); we cannot erase an export you already downloaded; and we keep what the law requires, such as invoices.
10. Grievance Officer, and the Data Protection Board
If you have a complaint about your personal data, write to our Grievance Officer: Gowtham Reddy Sodanapalli, Stack19, at privacy@stack19.com, or use "Raise a grievance" in Settings, Privacy and data. We acknowledge it at once and answer within 30 days. A request to access, correct or erase your data is answered sooner, within 7 days.
If you are not satisfied, you have the right to complain to the Data Protection Board of India. Visitors in the EU or UK may complain to their data protection authority.
12. Security, and if something goes wrong
Each business's records are kept apart from every other business's by rules in the database itself. Owners and Admins must use a second factor. Access is limited to what each role needs, and a log records actions. No service can promise perfect security.
If a breach of personal data happens, we contain it, tell the Data Protection Board of India and the people affected without delay, and send the Board a detailed report within 72 hours.
13. Changes to this notice
When we change this notice it gets a new version and date. For a material change we tell you before it applies and ask you to accept it again. The version you accepted is kept with the time.