Privacy policy

Last updated: 6 October 2026

This policy explains what personal data ("we") collects when you use Stacksift, why, and your rights. We are the data controller. Contact us at , or write to .

The free audit

When you choose a bank, card or user-list file, Stacksift reads it inside your web browser. The file and its contents are not sent to us or stored by us. Your preferences (currency, which tools you keep) are saved in your own browser's local storage and never leave your device.

Accounts and paid plans

If you create an account we process:

• Your email address, to sign you in and send you service emails. Lawful basis: performance of our contract with you.
• Audits you choose to save: company name, tool names, categories, amounts, billing cycles and dates, and totals. Never the statement, other transactions or card details. Lawful basis: contract.
• Subscription status received from Paddle (plan, status, renewal date and Paddle customer and subscription IDs). Lawful basis: contract.
• Reminder settings and a log of reminders sent, so you don't get the same reminder twice. Lawful basis: contract; you can switch reminders off at any time.

Who we share data with

• Paddle.com, our reseller and Merchant of Record, processes your payment and billing details under its own privacy policy. We never see your card number.
• Supabase hosts our database and sign-in service.
• Resend sends renewal reminder emails.
• Our website host serves the pages and may keep standard server logs (IP address, browser type) for security.

Some of these providers may process data outside the UK. Where they do, they use safeguards approved under UK data protection law, such as the International Data Transfer Agreement or adequacy regulations.

Cookies and storage

We don't use advertising or analytics cookies. Signing in stores a session token in your browser's local storage so you stay signed in. Paddle's checkout may set its own cookies needed to take a payment.

How long we keep data

Saved audits stay until you delete them or close your account. If you close your account we delete your account data within 30 days, except billing records we must keep for tax law (usually 6 years, held by Paddle).

Your rights

You can ask to access, correct, export or delete your data, or object to how we use it, by emailing . We reply within one month. You can also complain to the UK's data protection regulator, the Information Commission (formerly the ICO), at ico.org.uk.