Privacy policy

Accounts and Google sign-in

When you create an account, we store your name, email address, verification status, account identifier, and account creation and update dates. If you choose Google sign-in, Google provides your Google account identifier, email address, basic profile information such as your name and profile picture, and authentication tokens. We use this information to authenticate you, associate you with your StackMango account, and display your profile.

Google sign-in requests only basic identity permissions: OpenID, email, and profile. It does not give StackMango access to your Gmail messages, Google Drive files, contacts, calendars, Analytics, or Search Console data. You can instead request a sign-in link by email. We do not receive your Google password.

Account information and authentication records are stored in our Cloudflare-hosted database. We do not sell Google user data, use it for advertising, or use it to train AI models. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Workspace and security information

We store the profile changes, schedules, usage records, and tool-run records you create in your workspace. Provider API keys you choose to save are encrypted on the server.

AI Rank Tracker

We store your tracking settings, brands, aliases, domains, prompts, provider connections, answers, citations, scores, and usage records in your private workspace. When you run checks or enable a schedule, we send your prompts and optional country hint to the AI providers you enable: OpenAI, Perplexity, Anthropic, or Google Gemini. Each provider processes requests under the terms and data settings of your connected API account and may charge that account. OpenAI checks use stored background responses so we can collect them after submission. Gemini checks do not enable Google Search.

Optional AI prompt suggestions send your business description and language preference to your selected provider. Optional sentiment analysis sends the answer and tracked brand names to a connected provider for classification. Both are separate, metered operations. You can use written prompts and deterministic brand matching without either option.

Answer text and snippets are retained for 26 weeks by default; you can choose 1–104 weeks in tracker Settings. Aggregate scores, source records, run history, and the spending ledger remain until reset or an applicable deletion request. Operational tracker logs are retained for 90 days. Tracker reset removes tracker configuration, answers, reports, and schedules while retaining shared API keys and spending records. Remove keys separately in Settings. If you opt into summaries, Resend delivers reports to your verified account email; you can turn summaries off in tracker Settings.

We process session identifiers, IP addresses, browser information, request counts, and administrative audit records to operate accounts, prevent abuse, and diagnose failures. Essential cookies support sign-in and security. Sessions expire after seven days unless renewed through use; email sign-in links expire after five minutes. Expiry ends access and is not a promise that every associated database record is immediately erased.

Lead & Partner Finder

The finder uses YouTube API Services and Brave Search with the source accounts you connect. It sends your search terms to the selected provider and stores matching channel identifiers, current channel names and published subscriber counts, website domains, and discovery dates in your private workspace. Brave result titles and snippets are not retained. Read the Google Privacy Policy and Brave Search API privacy policy for their data practices.

StackMangoBot visits permitted public websites to find published contact addresses. We record the selected address, its source page and check time, along with notes and follow-up statuses you enter. Page contents and full YouTube descriptions are processed temporarily, not stored. The finder does not reveal hidden YouTube contact fields or send outreach messages.

Leads and your notes remain until you delete them, reset the finder or close your account. Stored YouTube details are refreshed after 25 days or removed after 30 days if refresh is unavailable. Expiry removes the channel identifier and links obtained only from the API; your notes and contact details independently obtained from a website or added by you remain. Activity records are retained for up to 90 days. Usage records are retained for up to four months so deleting a key or resetting cannot bypass allowances. Do not contact records retain a hash of the normalised address to prevent collecting it again. Reset offers a separate choice to clear your workspace’s suppression list; platform suppression and website opt-outs remain in force.

Delete a lead or use Reset finder to remove its stored finder data immediately; this does not change information held by YouTube or the original website. People whose details appear in a lead list can use our contact form to request correction, deletion or suppression. We verify requests without disclosing another customer’s private workspace. You control the prospects you research, your notes and any subsequent outreach; you are responsible for the lawful basis and notices required for your use of personal data. StackMango operates the finder and handles its security, suppression and support records as described in this policy.

Contact messages and email

If you use our contact form, we process your name, email address, subject, message, and related correspondence to respond. Resend delivers account and contact-form emails, and our support inbox holds correspondence. Contact-form abuse controls use hashed identifiers derived from your email address and IP address. Cloudflare Turnstile checks browser and device signals and your IP address to protect the form from automated submissions. We verify its security token before sending your message. Subject-based help suggestions are matched in your browser; typing a subject does not send the subject to our support inbox. Do not include passwords, API keys, or sensitive personal information in a contact message.

Turnstile is an essential security service, separate from optional analytics. Our contact-form widget does not request a challenge-clearance cookie. See Cloudflare’s privacy policy for information about its processing.

Cookies

Cookies are small pieces of information stored in your browser. We use essential cookies for sign-in and security, and optional analytics cookies to understand visits to our public website. This section also explains the browser storage used for your preferences and workspace messages.

Essential sign-in cookies

These cookies support the account functions you request and operate independently of your analytics choice.

• Sign-in session: __Secure-better-auth.session_token keeps you signed in and allows access to your account. It lasts up to seven days and can be renewed while you use your account. Signing out removes it.
• Google sign-in security: __Secure-better-auth.state links your Google sign-in request to its response and helps prevent forged sign-in attempts. It expires after five minutes or is removed when the sign-in response is processed.

Optional analytics cookies

Google Analytics loads on selected public pages only after you accept analytics. Declining does not limit your access to StackMango. Before you accept, or after you decline, we do not load the Google Analytics tag.

• _ga helps Google Analytics recognise visits from the same browser.
• _ga_<container-id> helps Google Analytics group activity into a visit. The last part of the cookie name identifies our analytics configuration.

We configure these analytics cookies to expire after no more than 180 days, without extending their expiry on each page load. Your browser may remove them sooner. They help us measure public page visits, browser and device information, approximate location, and returning visits.

We exclude URL query strings and fragments from the page address sent to Analytics and send only the referring website’s origin. Analytics is not used in account, administration, or sign-in areas. We do not send account email addresses, form contents, contact messages, or tool inputs to Google Analytics. Advertising features and automatic interaction measurement are disabled.

Read Google’s explanation of analytics cookies and how Google uses information from sites that use its services.

Saved preferences and workspace messages

We remember your analytics choice in this browser for 180 days using local storage named stackmango.analytics.v1. This records your acceptance or rejection and its expiry date; it is not an analytics cookie. If your browser blocks storage, the choice applies to the current page only.

The workspace briefly uses session storage named workspace-receipt and lf-receipt to display a confirmation after you save a change. It is removed after the message is displayed, or when the browser tab’s session ends.

Managing cookies and your choice

On the public site, use the Cookie settings link below to accept, decline, or withdraw analytics consent at any time. Withdrawal stops future analytics collection and removes this site’s Google Analytics cookies; it does not itself erase measurements already collected.

You can also delete cookies and browser storage through your browser settings. Deleting essential sign-in cookies signs you out, and blocking them can prevent account access. Deleting your saved analytics choice means we will ask again before loading analytics.

Why we process information

We use account and workspace data to provide the service you request, including steps before entering a service agreement. We rely on our legitimate interests in securing the service, preventing abuse, and responding to general enquiries for related security records and correspondence. Optional analytics relies on your consent. Where a legal obligation requires a record to be retained or disclosed, that obligation is the basis for that processing.

Providing an email address is necessary to create an account or receive a reply. Google sign-in and analytics are optional. We do not use your information for automated decisions that produce legal or similarly significant effects.

Service providers and disclosures

Cloudflare provides hosting, database, and security infrastructure; Resend provides email delivery; Google provides optional sign-in and Analytics, and Gmail is used for support. Information needed for these functions is processed by the relevant provider. Authorised operators may access records to support you and maintain the service. We may also disclose information where required by law or necessary to address abuse or protect legal rights.

Our providers operate internationally, so information may be processed outside Denmark and the European Economic Area. Use our contact form to request information about the locations and transfer safeguards applicable to your data. Read the providers' information at Cloudflare, Resend, and Google.

Retention and account closure

Account and workspace records are kept while needed to provide your account. Support correspondence is kept while needed to handle your enquiry and related follow-up. Security and audit records may be retained where needed to investigate abuse or meet legal obligations. Retention depends on the record's purpose and any unresolved request or legal requirement; it is not determined solely by whether you have recently signed in.

Closing your account in Settings disables access, removes active sessions and stored provider keys, and stops scheduled runs. It does not automatically erase all profile, workspace, correspondence, or audit records. To request erasure of remaining personal data, use our contact form. We assess any records that must be retained and explain applicable exceptions. Deleted data may remain in provider backups until those backups expire.

Your rights and choices

Subject to applicable law, you can request access to, correction of, or deletion of your personal data, restriction of processing, or a portable copy. You may object to processing based on legitimate interests and withdraw consent at any time without affecting the lawfulness of earlier processing. Send your request through our contact form; we may need to verify your identity.

You can remove StackMango's Google connection in your Google Account connections. This revokes that connection but does not by itself delete your StackMango account or information already stored.

You may complain to the Danish Data Protection Agency (Datatilsynet) or your local supervisory authority. Please use our contact form if you would like us to address a concern first.

Changes

We will update this page when our data practices change and provide additional notice where required.