Privacy Policy

Our Commitment to Your Privacy

PrivateStack is a product of Data Science & Engineering Experts, Inc. ("DSE," "PrivateStack," "we," "us," or "our"), a Georgia corporation located at 8735 Dunwoody Place #5714, Atlanta, GA 30350. This Privacy Policy explains how we collect, use, disclose, and safeguard information in connection with the PrivateStack website at privatestackhub.com, our waitlist, and the PrivateStack platform and services (collectively, the "Services").

Questions may be directed to privacy@privatestackhub.com or submitted through the privacy request form available on this site.

1. Controller and Processor Roles

PrivateStack involves two distinct kinds of data, handled under two different roles:

• Account and website data (we are the controller). Information about visitors, waitlist signups, and the individuals who administer a customer account. We determine the purposes and means of processing this information, and this Privacy Policy governs it.
• Tenant Content (we are a processor / service provider). The data a customer and its authorized users submit to, generate in, or process through the platform — including prompts, conversations, model inputs and outputs, uploaded files, and knowledge-base content ("Tenant Content"). The customer controls Tenant Content and determines why and how it is processed. DSE processes Tenant Content only to provide the Services, under the customer's instructions and our customer agreement and Data Processing Addendum (DPA). The customer's tenant administrator controls access to and the rights of that tenant's end users. Where a customer's own privacy notice differs from this policy as to Tenant Content, the customer's notice and instructions govern.

2. Deployment Models

The Services are available in more than one deployment model. For customers on the hosted service, the processing descriptions in this policy apply. For enterprise Bring-Your-Own-Cloud (BYOC) deployments under a signed agreement, prompt and output content and knowledge bases reside in the customer's own cloud environment, and processing is governed by that agreement and the DPA.

3. Information We Collect (as Controller)

3.1 Website Visitors

When you browse privatestackhub.com, we collect standard server logs (IP address, user agent, timestamp) for security and operations and, only with your consent, cookie-based analytics data (see our Cookie Policy). We also measure aggregate site usage with self-hosted, cookieless web analytics running in our own AWS infrastructure; it sets no cookies, does not track you across other sites, and is not used for advertising.

3.2 Waitlist Signups

When you join the waitlist, we collect the information you provide, such as name, business email, company, and role, to evaluate and manage access to the beta and to communicate with you about it.

3.3 Account and Administrator Data

When a customer establishes a beta tenant, we collect account-registration and identity information for the individuals who administer or access the account (for example, name, business email, organization, and authentication identifiers managed through our identity and authentication provider), together with billing and tax information where applicable, processed by our payment processor.

3.4 Service Usage and Operational Data

To operate, secure, and improve the Services, we collect operational metadata such as uptime and availability metrics, error and performance logs, feature-usage analytics (which features are used, not the substance of Tenant Content), and API-call and infrastructure-utilization data.

4. Information We Process on a Customer's Behalf (as Processor)

We process Tenant Content solely to provide and support the Services under the customer agreement and DPA. We do not determine the purposes of processing Tenant Content, and we do not access it except as necessary to deliver, secure, maintain, or support the Services, to prevent or address technical or security issues, or as the customer instructs or applicable law requires.

5. How We Use Information

As controller, we use account and website information to:

• Provide, operate, maintain, and secure the Services;
• Administer the waitlist, beta access, and customer accounts;
• Process billing and payments and manage the customer relationship;
• Respond to support requests and send service, security, and account communications;
• Analyze operational and feature-usage data to maintain and improve the Services; and
• Comply with legal, tax, and regulatory obligations, and enforce our terms.

6. AI and Customer Content

Our handling of Tenant Content processed through AI features is governed by the following commitments:

7. How We Share Information

We do not sell personal information. We disclose information only as follows:

7.1 Subprocessors and Service Providers, by Category

We engage vendors that support the Services, including: cloud infrastructure and hosting providers; identity and authentication providers; AI model and inference providers; payment processors; analytics providers; error tracking and service diagnostics providers; and customer-communication providers. Each is bound by contract to protect the information and to use it only to provide services to us. Error tracking and service diagnostics providers receive application error reports solely to diagnose and remediate faults in the Services; we do not enable session replay, do not use this information for advertising, and personal information is scrubbed from error reports before transmission. A list identifying the specific vendors within these categories is available to customers under the DPA on written request, along with our mechanism for advance notice of new subprocessors.

7.2 Legal and Safety

We may disclose information to comply with law or legal process, to respond to lawful requests from public authorities, to enforce our agreements, and to protect the rights, property, or safety of DSE, our customers, or others.

7.3 Business Transfers

In connection with a merger, acquisition, financing, or sale of assets, information may be transferred as a business asset, subject to this policy.

We do not use Tenant Content to train models, and we do not share Tenant Content with third parties for their own purposes.

8. Data Security

We maintain administrative, technical, and physical safeguards designed to protect information, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256);
• Role-based, least-privilege access controls and multi-factor authentication;
• Secrets held in managed secret storage;
• Audit logging and monitoring; and
• A documented incident-response program, with breach notification provided without undue delay and as required by applicable law and our customer agreements.

DSE operates a SOC 2-aligned control environment, and a SOC 2 Type II examination is in progress. Our infrastructure is designed to support HIPAA-regulated workloads where covered by a separate agreement. No system can be guaranteed perfectly secure, and we cannot warrant absolute security.

9. Data Retention and Deletion

We retain account and website information for as long as needed to provide the Services and to meet legal, tax, and contractual obligations. Operational logs are retained for a limited period appropriate to their purpose.

We honor verified deletion requests. Upon termination of a customer account, Tenant Content and associated customer personal data are purged within 30 days, except where a longer period is required by law (for example, tax records or a legal hold). Residual copies that persist in encrypted backups after deletion age out according to our backup rotation schedule and are not restored to active use.

10. Your Privacy Rights

Depending on your location, you may have rights to access, correct, delete, and obtain a portable copy of your personal information, to opt out of targeted advertising or "sharing," and to non-discrimination for exercising these rights.

• Account and website data. To exercise rights over information we control, submit a request through the privacy request form available on this site or email privacy@privatestackhub.com. We will verify and respond within the timeframes required by applicable law.
• Tenant Content. Because customers control Tenant Content, end users should direct requests concerning Tenant Content to the relevant customer (the tenant administrator). We will assist our customers in responding to verified requests as provided in the DPA.

10.1 California Residents (CCPA/CPRA)

You have the right to know, access, delete, and correct personal information, to opt out of "sharing" for cross-context behavioral advertising, and to non-discrimination. We do not sell personal information for money. Certain analytics/advertising cookies may constitute "sharing" — you may opt out through our cookie consent controls and by sending a Global Privacy Control (GPC) signal, which we honor.

10.2 Other U.S. States

Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive privacy laws have comparable rights, exercisable through the same channels.

10.3 EEA/UK Individuals

DSE is based in the United States and does not target the EEA or UK markets. Where we process personal information of individuals located in the EEA or UK, our lawful bases are typically legitimate interests, performance of a contract, or consent, and such individuals may exercise access, rectification, erasure, restriction, portability, and objection rights, and withdraw consent, by contacting us as above.

11. Cookies and Tracking

The website uses strictly necessary cookies for authentication and security and, only after you consent, analytics cookies configured through Google Consent Mode. Non-essential cookies are denied by default for visitors in regions that require it, based on geo detection, until consent is granted. We do not use third-party advertising cookies to track you across unrelated websites. See our Cookie Policy to manage your choices.

12. International Data Transfers

We are headquartered in Atlanta, Georgia, USA, and information is processed in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States. Where required for transfers of personal data from the EEA or UK, we rely on appropriate safeguards such as the Standard Contractual Clauses, as further addressed in the DPA.

13. Children's Privacy

The Services are directed to businesses and are not intended for individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this site, revise the "Last Updated" date, and, for material changes affecting account holders, provide additional notice. Continued use of the Services after an update constitutes acceptance of the revised policy.

15. Contact Us