Privacy Policy

1. Introduction

This Privacy Policy describes how Stack Seven AS, Terrasseveien 31 E, 1363 Høvik, Norway, company registration number 934 480 724 ("Stack Seven", "we", "us", or "our") processes personal data in connection with the Policy Confirm service, our websites, communications, and related business operations.

Policy Confirm is a business-to-business software-as-a-service platform used by organizations to distribute internal policies and document acknowledgements in a controlled and auditable manner. The service is intended solely for professional use by organizations and individuals invited by those organizations.

This Privacy Policy applies to website visitors, customers and prospective customers, authorized users invited to use Policy Confirm by a customer, and individuals who communicate with us for sales, support, or administrative purposes. This Privacy Policy does not replace or override any data processing agreement entered into between Stack Seven and its customers.

2. Roles and responsibilities

When Policy Confirm is used by an organization to manage policies for its employees, contractors, or external recipients, the customer acts as the data controller for personal data relating to those individuals. The customer determines which individuals are invited to the service, which policies are distributed, how long data is retained, and the legal basis for processing end-user personal data.

In these scenarios, Stack Seven acts as a data processor and processes personal data solely on documented instructions from the customer, in accordance with applicable data protection laws and the applicable data processing agreement.

Stack Seven also acts as an independent data controller for personal data processed for its own legitimate business purposes. This includes processing related to sales and marketing activities, account administration, billing and payments, customer support, service security, fraud prevention, service improvement, and compliance with legal obligations.

3. Categories of personal data

Depending on the context in which the service is used or an interaction takes place, Stack Seven may process personal data relating to authorized end users, customer representatives, and website visitors.

For end users invited by a customer, this may include name, work email address, organizational affiliation, policy acknowledgement status, timestamps related to actions such as sending, viewing, and confirming policies, and limited technical metadata associated with confirmations, such as IP address and browser information.

For customers and business contacts, this may include name, job title, company affiliation, business contact details, account credentials, contractual and billing information, and communications related to support or service administration.

When individuals visit our websites, we may process technical and usage data such as IP address, device and browser information, usage logs, and information collected through cookies or similar technologies, as further described in Section 11.

4. Purposes and legal bases for processing

When Stack Seven processes personal data on behalf of a customer as a data processor, such processing is carried out for the purpose of delivering the Policy Confirm service, enabling controlled policy distribution and confirmation, maintaining audit logs and proof documentation, and ensuring the security, availability, and reliability of the service. The legal basis for this processing is determined by the customer, typically based on compliance with legal obligations, legitimate interests, or performance of employment or contractual obligations.

When Stack Seven acts as a data controller, personal data is processed based on performance of a contract, Stack Seven's legitimate interests in operating and improving its business, compliance with legal obligations, or consent where required by applicable law, such as for certain marketing activities.

5. Data retention

Stack Seven retains personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law.

Personal data relating to customers and authorized users of the Policy Confirm service is generally retained for up to 12 months after the end of the customer's active subscription, unless otherwise agreed with the customer or required by law. After this period, such data is deleted or anonymized in accordance with Stack Seven's internal deletion routines.

Personal data associated with trial accounts is retained for up to 12 months after the end of the trial period. This retention supports account follow-up, security, fraud prevention, and potential conversion to a paid subscription. Data is deleted or anonymized once this period expires.

Email correspondence, support tickets, and other customer communications are retained for up to 24 months, unless a longer retention period is necessary to meet legal, accounting, or dispute-resolution requirements.

Billing and payment-related data is retained in accordance with applicable accounting, tax, and financial regulations. Certain payment-related personal data is processed and retained directly by Stack Seven's payment service provider in accordance with that provider's own retention policies.

Audit logs, confirmation records, and proof documentation generated within the service may be retained for longer periods where necessary to support compliance, auditability, and contractual obligations, subject to customer instructions and applicable law.

6. Subprocessors and third parties

Stack Seven uses carefully selected subprocessors to operate and deliver the Policy Confirm service. Subprocessors are engaged only where necessary and are subject to contractual data protection obligations consistent with applicable data protection laws.

For payment processing and billing, Stack Seven uses Stripe. Stripe acts as an independent data controller for certain payment-related personal data and retains such data in accordance with its own legal and regulatory retention requirements, typically for as long as necessary to comply with financial, accounting, and anti-fraud obligations.

Stack Seven uses cloud infrastructure and database services provided by Google, including Firebase, to host application data and operate core service functionality. Personal data processed within these systems is stored and retained in accordance with Stack Seven's contractual arrangements, customer instructions, and defined retention periods.

Stack Seven uses GoDaddy as its domain registrar and for related domain and email services. As part of normal service operation, email metadata and related technical data may be processed and stored by this provider, subject to its security and retention practices.

Additional information about subprocessors, including processing locations and safeguards for international data transfers, may be made available upon request or through contractual documentation.

7. International data transfers

Policy Confirm is a global service, and personal data may be processed within the European Economic Area and in other jurisdictions. Where personal data is transferred outside the EEA or the United Kingdom, Stack Seven ensures appropriate safeguards are in place, including the use of EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms as required by applicable law.

8. Security measures

Stack Seven implements appropriate technical and organizational security measures designed to protect personal data against unauthorized access, loss, alteration, or disclosure. These measures include access controls and authentication mechanisms, encryption in transit and at rest where appropriate, logging and audit trails, and secure development and operational practices.

Security is a core design principle of Policy Confirm, with a strong emphasis on traceability, explicit user actions, and audit readiness.

9. Data subject rights

Depending on applicable law, individuals may have rights to access their personal data, request rectification or erasure, restrict or object to processing, request data portability, withdraw consent where applicable, and lodge a complaint with a relevant supervisory authority.

Where personal data is processed on behalf of a customer, requests should generally be directed to the relevant customer as data controller. Stack Seven will assist customers in responding to such requests in accordance with applicable law and contractual obligations.

10. California privacy rights (CCPA/CPRA)

Where applicable, Stack Seven processes personal information of California residents in a business-to-business context. For the purposes of the CCPA, Stack Seven acts as a "Service Provider" and processes personal information solely on behalf of our customers to provide the Service. Stack Seven does not sell personal information and does not share personal information for cross-context behavioral advertising.

California residents may have the right to know what personal information is collected, request deletion subject to legal exceptions, and request correction of inaccurate personal information. Requests may be submitted using the contact details below.

11. Cookies and website analytics

Stack Seven's websites use cookies and similar technologies to ensure basic functionality, improve performance and usability, and understand usage patterns. Where required by law, consent is obtained before placing non-essential cookies.

Further information is available in the Cookie Policy, which is accessible via the consent pop-up on our website. You can verify or change your current settings at any time by clicking here: Consent Preferences

12. Changes to this Privacy Policy

Stack Seven may update this Privacy Policy from time to time to reflect changes in the service, legal requirements, or processing practices. The most current version will always be available on our website. Material changes will be communicated where required by applicable law.

13. Notice to US Residents (California & Other States)

This section applies to residents of the United States and supplements the information contained in our Privacy Policy.

13.1 Service Provider Status

Under the California Consumer Privacy Act (CCPA) and similar US state privacy laws, Policy Confirm acts as a "Service Provider" (or "Processor") for our business customers. We process personal information solely on behalf of our customers to provide the Policy Confirm service, and we do not retain, use, or disclose personal information for any purpose other than for the specific purpose of performing the services specified in our customer agreements.

13.2 No Sale of Personal Data

We do not sell personal information. We do not share personal information with third parties for their direct marketing purposes or for cross-context behavioral advertising.

13.3 Data Categories Collected (Last 12 Months)

For transparency purposes under US law, we confirm that we may collect the following categories of information solely to provide our Service:

• Identifiers: Name, email address, IP address.
• Professional/Employment-related information: Job title, employer name.
• Commercial information: Records of policies sent and acknowledged (audit logs).
• Internet/Network Activity: Logs of interaction with our application (e.g., timestamps of when a policy was opened or confirmed).

13.4 Your Rights

If you are a user invited to Policy Confirm by your employer, please contact your employer directly to exercise your data privacy rights (such as access, correction, or deletion), as they are the "Business" (Controller) responsible for your data. If you contact us directly, we will forward your request to the relevant customer.

14. Contact information

For questions about this Privacy Policy or Stack Seven's data protection practices, please contact: