StackFill

Legal

Privacy Policy

Last updated: July 2, 2026.

This policy explains what Parameter, LLC (“StackFill,” “we,” “us”) collects when you use StackFill, why, who helps us process it, how long we keep it, and the rights you have. It covers our website, apps, and API (the “Service”).

1. Roles: who controls what

Your account & workspace data. For the information you give us to run your account and workspace, StackFill is the data controller.

Your customers’ fill data. When your customers personalize a template through your hosted link or storefront embed, they enter data into your form. For that data, you are the controller and StackFill is your processor — we process it on your instructions to provide the Service. You are responsible for the notices and lawful basis for collecting it.

2. What we collect

  • Account & sign-in. Your email address, display name, and authentication metadata. Sign-in is passwordless — we do not store passwords. If you sign in with Google, we receive your verified email and basic profile from Google.
  • Workspace content. The files and data you upload or create: master PDFs, derived template scenes (geometry, fonts, colors, field labels), images, uploaded fonts, projects, selection sets, and branding.
  • Fill data. The values your customers submit through a fill link or embed (which may include their name, email, and whatever fields you add), plus the generated PDFs.
  • Billing. Payments are processed by Stripe. We store your Stripe customer and subscription identifiers, plan, and status — we do not receive or store full card numbers.
  • Usage & technical data. Product events (e.g. template uploaded, fill completed) and API request logs, recorded with a truncated IP address and a general user-agent family rather than full device fingerprints. Standard server logs from our infrastructure providers.
  • Support. Messages you send to our support addresses.

3. How we use it

To provide, secure, and improve the Service; authenticate you and keep you signed in; parse, host, and render your templates and fills; process subscriptions and enforce plan limits; send transactional email (sign-in links and, where applicable, receipts and service notices); detect and prevent abuse and fraud; understand aggregate product usage; and comply with law. We do not sell your personal information, and we do not use your workspace content to train machine-learning models.

4. Cookies & tracking

We use a single first-party cookie, sf_session, that keeps you signed in. It is HttpOnly, Secure, and SameSite=Lax. We do not use third-party advertising or cross-site tracking cookies.

5. Who processes data for us (sub-processors)

We share data only with service providers that help us run StackFill, under contracts that require them to protect it:

  • Cloudflare — hosting, storage (databases, key-value, object storage for your files), and network security.
  • Stripe — payment processing and billing.
  • Mailgun — transactional email delivery (sign-in links, service notices). Click/open tracking is disabled.
  • Fly.io — the compute that renders your print-ready PDFs.
  • Google — only if you choose Google sign-in.

6. International transfers

Our providers may process data in the United States and other countries. Where required, we rely on appropriate safeguards such as the Standard Contractual Clauses.

7. How long we keep it

  • Account & workspace content — kept while your account is active. When you delete your workspace or account (Settings → Delete), we erase your users, templates, scenes, fills, renders, assets, API keys, and settings.
  • Sign-in links — expire within about 10 minutes. Sessions — up to about 30 days, and are revoked on sign-out or deletion.
  • Financial & audit records — we retain limited transaction and audit records (for example, revenue and event logs), which are de-linked from your identifiers on deletion, for as long as needed for accounting, tax, fraud-prevention, and legal compliance.
  • Backups — residual copies may persist in encrypted backups for a limited period before rotation.

8. Your rights

Depending on where you live (including under the GDPR and California’s CCPA/CPRA), you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent.

  • Delete now, yourself. You can erase your workspace or your entire account at any time from Settings → Delete in the app. Deleting your account cancels any active subscription and removes your data as described above.
  • Access / export / other requests. Email privacy@stackfill.com and we will respond within the timeframe required by applicable law.
  • No sale of personal information. We do not sell or “share” your personal information as those terms are defined under U.S. state privacy laws.
  • You may also lodge a complaint with your local data-protection authority.

If StackFill processes fill data as your processor, direct end-customer requests to you (the controller); we will assist you in responding.

9. Security

We use encryption in transit, signed and revocable sessions, scoped access controls, and other safeguards described at /security. No system is perfectly secure, but we work to protect your data and to notify you of incidents as required by law.

10. Children

The Service is for business use and is not directed to children under 16, and we do not knowingly collect their personal information.

11. Changes

We may update this policy; material changes will be announced by email or in-app, and the “last updated” date above will change.

12. Contact

Privacy questions or requests: privacy@stackfill.com. StackFill is a product of Parameter, LLC, Miami, Florida.

← Back to home