Privacy Policy

1. What this document is

It explains what data stackin processes, why, who it is shared with, and how you exercise your rights. It is a plain summary of how the system works today — it is not legal advice.

2. Who processes your data

The controller is Fernando Celmer, CNPJ 68.849.750/0001-76, in Florianópolis, Brazil. Data protection officer: dpo@stackin.io. Write to that address for any request about your data — it is the data subject channel, answered within 15 days.

3. Data we collect

We collect what is needed for you to use the platform and to meet the fiscal rules for issuing invoices.

• Account: full name and email, used to sign in. If you sign in with Google, we receive your name, email and Google account id — never your Google password.
• Company: legal name, tax registrations and address, required by law to issue an invoice.
• Digital certificate: the .pfx file and its password, needed to sign the invoice — stored encrypted, never in plain text.
• Issued invoices: the recipient's name and tax id, line items and amounts — required by fiscal law, not collected by choice.
• Usage and diagnostics: access logs, IP address, API calls and errors, used to run the service, investigate failures and prevent abuse.
• Payment: when you subscribe to a plan or buy credits, the card is processed by Stripe. We never receive or store your card number.

4. Why we process it

Legal obligation, for the fields fiscal law requires. Performance of a contract, to keep your account, issue your invoices and bill for the service. Legitimate interest, for security, fraud prevention and diagnosing failures. We do not sell your data and do not share it for third-party marketing.

5. Who we share it with

Only with those the service needs to work, and each one processes the data on our instructions.

• Tax authorities: the invoice is transmitted to the competent authorizer (state, municipal, or the national NFS-e service). Without that there is no issuance.
• Amazon Web Services: application hosting and digital certificate storage, in the North Virginia region (us-east-1), United States.
• Hostinger: database hosting, where your account, your companies and the issued invoices live — on a server in the Boston data center, United States.
• Stripe: payment for plans and credit packs.
• Google: when you choose to sign in with Google, and — if you accept advertising and analytics cookies — Google Ads and Google Analytics, which measure how our ads perform and how the pages are used. Refusing does not limit your use of the platform.
• Sentry: application error tracking, for diagnostics. Documents, names and tax ids are masked before anything is sent.
• Your own destinations: if you register a webhook, we send your invoice events to the URL you provide. What happens there is your responsibility.

6. International transfers

All of stackin's infrastructure runs in the United States: the application and the digital certificate in Amazon Web Services' us-east-1 region, and the database on a Hostinger server in the Boston data center. Stripe, Sentry and Google also process data outside Brazil. Those transfers rely on the contractual clauses and safeguards those providers offer, under article 33 of the LGPD. Brazilian law does not require this data to stay in the country — what it requires is that fiscal records be kept for the minimum period, which holds wherever the server is.

7. Connected applications

You can connect a third-party application — such as the ChatGPT plugin — to your account through OAuth. You always authorize the connection, it has a limited scope (read, issue, cancel), and the application then acts on behalf of your company within that scope. We never share your password or your certificate with it. You can revoke access at any time in the platform, and revocation takes effect immediately.

8. Cookies and local storage

Your browser stores your session token and your theme preference locally — without them you would have to sign in on every page. Those are necessary and do not depend on consent. Beyond those, we use Google Ads and Google Analytics to measure how many visits from our ads become signups and how the pages are used. Those cookies are only written if you accept: the Google tag loads with consent denied by default, and the notice on your first visit gives Accept and Reject the same weight. Refusing limits nothing on the platform, and you can change your mind by clearing the site's data — the notice comes back.

9. How long we keep it

Account data for as long as the account exists. Invoices and your company's records for at least five years after issuance, the retention period Brazilian fiscal law requires — including after you close the account. Access logs for six months, under the Brazilian Internet Act. The digital certificate is deleted as soon as you remove it.

10. How we protect it

The certificate sits in private storage, never publicly reachable, and its password is encrypted before being saved. Your login password is never stored in plain text, only a one-way hash. Traffic is always over HTTPS. Documents, names and tax ids are masked in error logs before they leave the application.

11. Your rights

The LGPD gives you confirmation and access, correction, anonymization or deletion, portability, information about sharing, and the right to withdraw consent. You can edit your name and email on the My account page, and close the account there — that anonymizes your login data. For anything else, write to dpo@stackin.io. Invoices and companies remain, unlinked from your personal data, because the law requires those records to be kept.

12. Security incidents

If an incident poses a relevant risk to your data, we notify you and the Brazilian data protection authority, with what is known about what happened and what we did about it.

13. Changes to this policy

We may update this document as the product evolves. The date at the top marks the last revision, and relevant changes are announced in the platform.

Summary