Privacy Policy

Contents

1. 1. Who we are and the scope of this Privacy Policy
2. 2. The data we collect
3. 3. Purposes of use and their lawful basis
4. 4. Sharing data
5. 5. Data location and international transfers
6. 6. Retention periods
7. 7. Data security
8. 8. Your rights
9. 9. Minors
10. 10. Marketing messages
11. 11. Changes to this Privacy Policy
12. 12. Contact us

Version: 1.2 · Published: 16 October 2026 · Last updated: 30 October 2026 · Effective: on acceptance for new Workspaces; for Workspaces that accepted an earlier Version, on the date STAK gives in its notice under clause 20 of the Customer Terms of Service · Governing text: English (clause 23.9 of the Customer Terms of Service)

Issued by: STAK Global, LLC, a limited liability company formed in the State of Delaware, United States of America (file number 10798493), which owns STAK (ستاك) and the Services. Contact: [email protected].

1. Who we are and the scope of this Privacy Policy

1.1 This Privacy Policy explains how STAK Global, LLC ("STAK", "we"), the provider named in clause 1.1 of the STAK Customer Terms of Service (the "Terms"), collects, uses and protects the Personal Data of the individuals who act for its customers and of the Users of the Services, as Controller of Account Data and of the other data described in clause 2. Expressions defined in the Terms have the same meaning in this Privacy Policy.

1.2 This Privacy Policy does not apply to the Personal Data that businesses enter into the Services about their own customers, employees, suppliers and others, which is Customer Personal Data. STAK processes that data on behalf of each business, on its instructions and under the Data Processing Agreement, and the privacy policy adopted by that business applies to it. If you are a customer of a business that uses STAK, please send requests about your data directly to that business. The exception is the phone number an End Customer verifies on a business's Public Pages and the record of that verification, which STAK processes as Controller under this Privacy Policy.

1.3 This Privacy Policy applies to the sign-in and service pages at app.stakpos.com (and app.trystak.co while it remains in use) and to STAK's phone and tablet apps. It does not apply to the pages of the marketing website at stakpos.com, which are covered by the website privacy notice published there.

2. The data we collect

• (a) Account and sign-in data: name, phone number, email address, preferred language and sign-in method. The sign-in method covers the verification code sent by WhatsApp, a passkey, or your account identifier with Google, Apple or Microsoft if you choose to sign in through them, and an authenticator app if you use one for two-step sign-in. We do not ask for or store passwords.
• (b) Business data: trade name, country, address, commercial registration and tax registration numbers, the Plan and the Apps switched on, and the roles of Users.
• (c) Billing data: STAK Invoices, their payment status and the transaction references from the Payment Service Provider we use. We never receive or store card numbers.
• (d) Usage and device data: internet protocol (IP) address, browser and device type, app version, session and Account sign-in logs, and security events.
• (e) Correspondence and support: the messages and support requests you send us, and contact requests.
• (f) Use of the Staki assistant: when AI Features are used and the AI Credits consumed. What a User writes to the assistant and the answers they receive are Customer Data, which STAK processes as a Processor under the Data Processing Agreement.
• (g) Acceptance records: the Version of the terms and policies you accepted, the time of acceptance, the IP address and the browser used.
• (h) Cookies and local storage: we use what is needed to run the Services, such as session cookies and language, appearance and Staki assistant preferences. On our advertising landing pages only, and only if you press Accept in the notice shown there, we also load Google's advertising tag (Google Ads). It sets cookies that let Google tell us which advertisement led to a sign-up. If you press Decline, or do nothing, the tag is not loaded and no advertising cookie is set. On the rest of our website and in the apps we do not use advertising cookies or cookies that track you across websites.
• (i) Owner app notifications: if we switch on push notifications for the owner app and you turn them on, we collect the device identifier needed to send them. We add their provider to clause 4.1, and notify you under clause 11, before doing so.
• (j) Phone verification on Public Pages: if you are a customer of a business and verify your phone number on its Public Pages, we collect the phone number and the record of that verification, and send you the verification code by WhatsApp.
• (k) If you use an Autopilot that writes in your name (replies to Google reviews, Google profile posts, messages to customers who stopped coming), a member of STAK's team or STAK's automatic checker reads the words before you see them. For review replies that is the public review text, the reviewer's first name and the star rating, nothing else about your customers. For a clinic, pharmacy, nursery or school STAK never lets AI read a review.

3. Purposes of use and their lawful basis

3.1 We process data for the following purposes, on the lawful basis shown next to each:

3.2 By ticking the consent box before you first use the Services, and again for each new Version of this Privacy Policy, you expressly consent to the processing of your data as this Privacy Policy describes, including hosting outside your country under clause 5. This consent is a basis for the processing, alongside the bases in clause 3.1, wherever Applicable Law requires consent. We also rely on it as a matter of best practice under the Data Privacy Protection Regulation of the Communication and Information Technology Regulatory Authority in the State of Kuwait. You may withdraw your consent at any time. This does not affect the lawfulness of processing before you withdraw it, but withdrawing it may stop you using the Services where the processing is needed to provide them. Where the European Union or United Kingdom General Data Protection Regulation applies, we do not rely on this consent for processing that is needed to provide the Services or that rests on another basis in clause 3.1. We rely on consent there only for marketing messages and where clause 3.1 says so.

4. Sharing data

4.1 We do not sell Personal Data, we do not use the content of your business data for advertising, and we share Personal Data only in the following cases:

• (a) The service providers we work with: they process data on our behalf, under contracts that oblige them to protect it. They are:
  • Amazon Web Services, for hosting;
  • Cloudflare, for network protection;
  • Google (Google Workspace), for the [email protected] mailbox, your correspondence with us, and the invitations, notices, STAK Invoices, Pay Links and security alerts we email to you from [email protected];
  • Google Ireland Ltd / Google LLC (Google Ads), for advertising measurement, only for visitors who press Accept on an advertising landing page;
  • Anthropic, when AI Features are used;
  • the payment providers through which you pay a STAK Invoice, shown at checkout, each of which also processes payment data as an independent provider under its own terms: Paddle (Paddle.com Market Limited), our online reseller and merchant of record where checkout shows Paddle; and Stripe (Stripe, Inc. or its regional affiliate), where checkout shows Stripe;
  • only once we switch them on, after updating this Privacy Policy and notifying you under clause 11 at least 30 days in advance: Meta, to send sign-in and verification codes, Pay Links and notices by WhatsApp from STAK's own number; Resend, Inc., as an email delivery provider; Twilio and Unifonic, to send sign-in codes and notices by text message; and Expo (650 Industries, Inc.), to deliver owner app notifications.
• (b) The business you belong to: the Owners and Admins of the business can see the names, verified phone numbers and roles of its Users and their activity in the audit trail, and, on the Plans that include it, receive alerts with device and network details when a User signs in from a new device.
• (c) Sign-in providers: Google, if you choose to sign in with it, and Apple or Microsoft once we offer them and you choose to sign in through them.
• (d) Competent authorities: where the law requires it or a binding order is issued.
• (e) A successor to STAK: in the event of a merger, acquisition or transfer of the business, provided the successor complies with this Privacy Policy.
• (f) Advertising measurement (only if you accept it): if you press Accept on the notice of an advertising landing page, Google (Google Ads) receives the usual tag data: that you visited the page, your device and browser details, the identifier of the advertisement you clicked and the fact that you pressed the sign-up button. We do not send Google your name, email address or phone number. Google handles this data under its own privacy policy.

4.2 If we add a provider that is not listed in clause 4.1, we will update this Privacy Policy and notify you under clause 11 before it starts processing your data.

5. Data location and international transfers

5.1 Account Data is hosted with Amazon Web Services in the Frankfurt region, in the Federal Republic of Germany. Its Backups are kept in the same region, with copies in the Republic of Ireland.

5.2 Some service providers process some data in other countries, including the United States of America, and our staff may access data from the State of Kuwait when needed. Where the law requires a safeguard for a transfer out of the European Economic Area, the United Kingdom or Switzerland, we use the European Commission's standard contractual clauses (with the UK Addendum and the Swiss adaptations where they apply), or the provider's certification under the EU-U.S. Data Privacy Framework where it holds one. For other countries we use the transfer mechanisms their law requires. You can ask for a copy of the relevant safeguard at [email protected].

5.3 We may in future move hosting to another region, and will notify customers at least 30 days in advance. Temporarily running the Services from the Backups in the Republic of Ireland after the loss of the primary hosting region is not a move, and we will notify customers of it without delay.

6. Retention periods

• (a) We keep Account Data about a User for as long as their Account exists, and data about the Customer for as long as the Agreement is in force. You can ask us to close your Account by emailing [email protected]. After the Account is closed or the Agreement ends, as the case may be, we delete that data within 90 days, subject to paragraphs (b) to (h). We keep the phone verification records in clause 2(j) until you ask us to delete them at the same address.
• (b) We keep STAK Invoices and payment records for 15 years after the Agreement ends, or any longer period required by applicable commercial and tax laws.
• (c) We keep acceptance records, and what is needed to establish and defend legal rights, for 15 years after the Agreement ends, the longest limitation period in Kuwaiti law.
• (d) We keep sign-in and security event logs for as long as the Account exists and for 12 months after it is closed, unless a pending dispute or investigation requires keeping them longer.
• (e) We keep correspondence and support requests for 24 months after the request is closed.
• (f) We keep records of consent to marketing messages while the consent stands, and for 24 months after it is withdrawn.
• (g) Questions put to the Staki assistant and its answers are kept with Customer Data and deleted with it under the Data Processing Agreement.
• (h) Daily Backups expire within 35 days, and monthly Backups within 12 months.

7. Data security

We apply technical and organisational measures to protect data. These include encryption in transit and at rest, isolation of each business's data, two-step sign-in, the audit trail and Backups. The details are in the Security Overview. If a breach affects your data and is likely to harm you, we notify you without undue delay: within 24 hours of learning of it where feasible, and in any event within 48 hours. We notify regulators where the law requires.

8. Your rights

8.1 To the extent Applicable Law gives you these rights, you may:

• access your Personal Data and obtain a copy of it;
• correct it;
• delete it;
• object to its processing or ask for its processing to be restricted;
• transfer it;
• withdraw your consent where the processing is based on consent.

You can change much of your data directly in your Account settings.

8.2 To exercise these rights, email us at [email protected]. We will verify your identity and then respond within 30 days, or within the shorter period set by Applicable Law.

8.3 You have the right to complain to the competent regulator, such as the Communication and Information Technology Regulatory Authority in the State of Kuwait, the Saudi Data and Artificial Intelligence Authority, the UAE Data Office, the data protection authority of the European Union Member State where you live or work or where the alleged infringement took place, or the Information Commissioner's Office in the United Kingdom.

8.4 We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

9. Minors

The Services are intended for businesses. No one under the age of eighteen may create an Account.

10. Marketing messages

We send you marketing messages about STAK only with your consent, and you can unsubscribe at any time. Operational, security and billing messages continue while your Account exists.

11. Changes to this Privacy Policy

We notify you of any material change to this Privacy Policy, within the Services or by email, at least 30 days before it takes effect. When you sign in, we show you the new Version so that you can confirm you have read it.

12. Contact us

For questions about this Privacy Policy or your data, email our data protection contact at [email protected], or write to the address at the top of this Privacy Policy. We will appoint a data protection officer, or a representative in any country, where Applicable Law requires it.