Privacy Policy

NowStack, Inc. (“NowStack,” “we,” “us”), a Delaware corporation, operates the NowStack operations OS at nowstack.ai. Our principal business address is 2810 North Church Street, STE 90443, Wilmington, DE 19802, USA. The product is subscription SaaS with a 7-day trial: Command Center, tasks, unified inbox, CRM, and AI agents with human-in-the-loop approvals.

Privacy, legal, and security questions: use the contact form at nowstack.ai/contact, or write NowStack, Inc. at the address above. We aim to respond within 30 days. We have not appointed a separate public DPO or EU Article 27 representative; you may request a data-processing addendum or signed vendor packet through the form.

NowStack is a multi-tenant web application. Each customer workspace is isolated. Agents draft and route work; people approve before customer-facing actions ship. nowstackworks.com is an email sending domain, not a second marketing site. nowstack.app is used as an Eve JWT issuer, not as the public website.

What we do not collect by default

• We do not sell personal information for money. By using the site we share identifiers with Meta, Google, and TikTok for ads measurement (a “share” under CPRA). You can block cookies in your browser or write /contact to request do-not-share.
• We do not ask for government ID, precise GPS, or biometric templates to open a trial.
• We do not scrape your contacts unless you connect an integration or upload them.
• We do not take payment card numbers onto our servers. Stripe collects the payment method on Stripe Checkout.

Data you submit

• Account data: name, email, password hash, company, role, and workspace membership.
• Trial and marketing inputs: company name, website, niche, differentiator, favorite-client description, budget band, waitlist and contact-form messages.
• Workspace data you create or import: tasks, contacts, companies, messages, files, SOPs, agent artifacts, and custom fields.
• Connected-account tokens: OAuth tokens for Google, Microsoft, GitHub, or other integrations you choose to connect.
• Billing identifiers Stripe returns to us (customer id, subscription id, checkout session id). We do not store full card PAN or CVC.

Data generated in the product

Agent drafts, classifications, and studio output are stored in your tenant so you can review and reuse them. Output is probabilistic and may be inaccurate.

Technical and security data

IP address, user agent, timestamps, and security events needed to operate login, rate limits (including Arcjet on public forms), and abuse prevention. Server logs are kept for operations and security, not for advertising.

Analytics and advertising

Analytics and advertising stay off until you choose Accept, or a custom choice that turns them on. Reject keeps essential cookies only. A browser Global Privacy Control signal (Sec-GPC) is honored: ads and analytics stay off unless you later Accept. When you have accepted, we may load Vercel Web Analytics, Google tags, Meta Pixel, and TikTok Pixel when configured, and we may send server-side conversion events (Meta Conversions API, GA4 Measurement Protocol, TikTok Events API) for StartTrial when a trial workspace is provisioned and Subscribe when a Stripe subscription moves from trial to paid. Those events include hashed email, click ids, and technical data from signup — they can fire after you have left the site.

We use personal data to:

• Create and authenticate your account, keep you signed in, and isolate your tenant.
• Run the trial, Stripe subscription, credits, and related billing notices.
• Send transactional email (password, trial, security, product notices you cannot opt out of while the account is open).
• Respond to contact, waitlist, and support requests.
• Operate agents and models you invoke, including sending prompts and necessary context to model providers.
• Protect the service, other tenants, and the public (fraud, abuse, security incidents).
• Measure ads (Meta, Google, TikTok) only after you Accept or save a custom choice that allows it — including matching a trial start or a later paid subscription back to the click that brought you here.
• Comply with law and enforce the Terms, Acceptable Use Policy, and Trial and Billing Terms.

AI model training disclosure

We do not use your workspace content to train a NowStack-owned foundation model. Prompts and tool results are sent to model providers you or we configure, typically through Vercel AI Gateway. API and enterprise endpoints generally do not train on customer traffic; consumer-style endpoints can differ. A workspace may enable Gateway Zero Data Retention where the provider supports it. Do not put secrets, payment card data, or credentials in prompts you would not send to a vendor.

We do not use public marketing-form contents to train third-party foundation models.

Details and opt-out steps live in the Cookie Policy. Summary:

Analytics and advertising cookies stay off until you Accept, or until you Customize and turn a category on. Reject keeps the essential session and OAuth cookies only. The banner offers Accept, Reject, and Customize. A Sec-GPC signal keeps ads and analytics off unless you later Accept. Do Not Track is not a separate switch. Theme preference is stored in localStorage.

We use processors to host and run the service. Each has its own privacy policy. A signed DPA and a current sub-processor list for your workspace are available on request via /contact.

• Public contact and waitlist submissions: kept while we are evaluating or corresponding, then deleted or minimized except where we must keep a record of the request.
• Pending trial rows: kept to complete checkout and activation; expired unused trials are removed in the ordinary course.
• Account and workspace data: kept while the workspace is active. An Administrator can erase the active workspace from Settings → Account. That deletes the workspace Neon branch immediately and then clears the stored connection. Billing identifiers we must keep (typically invoices, up to about 7 years) stay on the account row. Neon point-in-time history, if the Neon project has a history window turned on, can still hold a copy until that window rolls off. This product does not set that window. Restore of one branch is the operator procedure in the tenant-branch restore runbook.
• Stripe records: retained by Stripe under its policy; we keep customer and subscription identifiers needed for accounting.
• Security and access logs: typically up to 30 days, longer if an incident is open.
• Vercel Analytics aggregates: retained by Vercel under its analytics retention.

Email or use the contact form. We may need to verify you control the account. We respond within 30 days (GDPR) or the time your state law requires.

GDPR (EEA/UK)

You may request access, rectification, erasure, restriction, portability, and objection. An Administrator of the active workspace can download a copy of workspace tables (Settings → Account, or GET /api/accounts/export) and can erase that workspace (POST /api/accounts/erase) without waiting on /contact. You may withdraw consent where processing is based on consent. You may complain to your supervisory authority. Legal bases we rely on: contract (Art. 6(1)(b)) to run the account and trial; legitimate interests (Art. 6(1)(f)) for security, product integrity, and limited analytics; legal obligation (Art. 6(1)(c)) for tax and compliance; consent (Art. 6(1)(a)) where we ask for optional marketing.

California and similar US state laws

You may request to know, delete, and correct personal information. We do not sell personal information for money. If you Accept advertising cookies, we share identifiers (such as hashed email, IP, user agent, and click ids) with Meta, Google, and TikTok for cross-context behavioral advertising and conversion measurement. That is a “share” under the CPRA. Reject, or a Sec-GPC signal, keeps that share off unless you later Accept. You can also write via /contact. Authorized agents may submit requests with proof of authority. We will not discriminate against you for exercising these rights.

We host primarily on US infrastructure (Vercel, Neon, and the processors above). If you access the service from the EEA, UK, or another region, your data is transferred to the United States. Where required we rely on Standard Contractual Clauses or the vendor’s equivalent transfer mechanism. Data may transit other regions as part of ordinary internet routing.

The service is for business users. It is not directed to children. You must be at least 18 to start a trial or open an account. We do not knowingly collect personal data from anyone under 16 (EEA) or under 13 (COPPA). If you believe a child has submitted data, contact us and we will delete it.

We use HTTPS in transit, isolated tenant databases with row-level security, signed HTTP-only session cookies, and human-in-the-loop gates on customer-facing agent actions. No method of transmission is perfectly secure. See Security. We will notify affected customers of a personal-data breach as required by law (including GDPR’s 72-hour supervisory notice where it applies to us).

We will post material changes with a new “Last updated” date. Continued use after the update is posted constitutes acceptance of the revised policy, except where the law requires a new consent. For account holders we may also email the administrator or show an in-product notice.

Controller / operator: NowStack, Inc., 2810 North Church Street, STE 90443, Wilmington, DE 19802, USA. Phone: (877) 735-9739. Prefer nowstack.ai/contact and ask for Privacy.

We respond within 30 days. Copyright complaints are handled as described in the Terms.

EEA and United Kingdom

Controller: the operator of nowstack.ai (NowStack, Inc.). Purposes and legal bases are in §§4 and 8. International transfers are in §9. You may lodge a complaint with your local authority (for example the ICO in the UK or your EU DPA). A DPA for customer-as-controller / NowStack-as-processor workspace data is available on request.

California categories

In the last 12 months we may have collected identifiers (name, email, IP); commercial information (trial and subscription status); internet activity (product logs and analytics); professional information (company, role, client records you store); and inferences agents generate from data you provide. We disclose these to processors in §6 for the business purposes in §4. We do not sell them for money. We share identifiers with ad platforms as described in the California section above. Sensitive personal information is not used to infer characteristics for advertising.

Other regimes (LGPD, PIPEDA, DPDP, and similar) apply when you or your users are in those places. The same access, correction, and deletion request channel is /contact.