Last updated: October 2026
Looking for how STACKS handles Google user data, including the Google API Services User Data Policy and its Limited Use requirements? See Section 4, Google User Data.
We collect information you provide directly, including:
We automatically collect usage data, device information, and cookies when you use the Service.
We use collected information to:
Data obtained through Google APIs is used only for the purposes described in Section 4 and is not used for the general product analytics described above.
We do not sell your personal information. We may share data with:
Data obtained through Google APIs is subject to the narrower sharing limits in Section 4, which override this section for that data.
STACKS offers an optional connection to Google Business Profile, described in sections 4.1 to 4.7, and an optional connection to Google Merchant Center, described in section 4.8. This section describes how STACKS accesses, uses, stores, and deletes data obtained through Google APIs. It applies in addition to the rest of this policy, and where it is narrower than another section, this section controls.
STACKS' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
When a business connects its Google account, STACKS requests a single scope:
https://www.googleapis.com/auth/business.manage
Through that scope STACKS accesses:
STACKS never receives or stores your Google account password, and never accesses profiles you have not selected.
We use this data for no other purpose. It is used only for the business that granted consent, and only for the locations that business selects. Performance figures, search terms and reviews obtained through this connection are never used by the STACKS advertising tools, including advertising copy written with AI, and are never sent to the AI assistants described in Section 5.
We do not sell, rent, or license Google user data, and we do not share it with data brokers or information resellers. We transfer it only where one of the following applies:
Google user data is never used for advertising of any kind. That includes personalized advertising, retargeting, interest-based advertising, audience building, lookalike audiences, and advertising measurement. It is never passed to any advertising platform or tag, and it is never combined with the marketing and analytics data described in Section 7.
Google user data is processed by automated systems. No STACKS employee or contractor reads it, except in these limited cases:
We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.
OAuth access and refresh tokens are encrypted at rest, held separately from application data, never written to logs, and never exposed to the browser or to any client-side code. Access to the systems holding them is restricted to the small number of personnel who need it to operate the feature. Location data, performance figures, search terms and reviews are cached only to the extent needed to show the connection, its post history, and the business's own performance and reviews. Performance figures are kept for at most 90 days and search terms for at most the last three months.
A business can revoke STACKS' access to its Google account at any time, by any of these routes:
On revocation, by any route:
Posts that were already published to a Google Business Profile remain on that profile, because they are Google-hosted content owned by the business. They can be edited or removed by the business in Google Business Profile directly.
Deletion also happens without a revocation request when a STACKS account is closed, on the same timetable.
A plain-language description of the connection itself, including the authorization steps and what each permission is used for, is documented at stacks.tech/integrations/google-business-profile.
STACKS also offers an optional connection to Google Merchant Center, so that an online store built with STACKS can list its products on Google. This connection is separate from signing in to STACKS. Signing in to STACKS with Google asks only for your name and email address. Merchant Center access is asked for only when an owner or admin of the business chooses to connect Merchant Center inside STACKS.
When the business connects, STACKS requests a single scope:
https://www.googleapis.com/auth/content
STACKS uses that permission once, during the connection, to:
The access token from this connection is used only during the connection and then discarded. STACKS does not store it, does not request a refresh token, and never writes it to logs. After the connection, STACKS works on that Merchant Center account through its own service identity, within the administrator access the business granted, to upload and update the products of the business's STACKS online store, to set the store's shipping and return policies and business details from the information the business keeps in STACKS, and to show the business its Merchant Center status and issues inside STACKS.
Sections 4.3, 4.4 and 4.5 apply to this data in full: it is not sold or shared, it is never used for advertising, it is not read by people except in the cases listed there, and it is not used to train generalized artificial intelligence or machine learning models.
A business can end the connection at any time by disconnecting Merchant Center in STACKS, by removing the STACKS user under People and access in Merchant Center, by removing STACKS at myaccount.google.com/permissions, or by emailing yes@stacks.tech. When the business disconnects in STACKS, STACKS stops all calls to that Merchant Center account and removes the STACKS product feed from it, so the listings STACKS uploaded are taken down. The Merchant Center account itself always stays with the business.
Some features let you connect an account you already control at another service, such as a marketplace, a payment processor, or an advertising platform. STACKS acts only within the permissions you grant at the time of connection, and only until you revoke them. You can disconnect any connected account from its settings in STACKS, or from the other service directly. Data from a connected account is used to provide the feature you connected it for, and the other service's own privacy policy continues to apply to the data it holds.
Ad STACKS lets a business connect its own Meta account with Facebook Login for Business, then choose one Facebook Page it manages and one ad account. The Instagram professional account used is the one the business has linked to that Page inside Meta.
What STACKS accesses: the list of Pages and ad accounts the person can choose from; the Page's posts and their engagement; the Instagram account's id, username and profile picture; and the ad account's campaigns, ad sets, ads and performance figures (spend, impressions, reach, clicks). STACKS uses this only to publish the posts the business creates and approves, to create ads the business asks for on its own ad account, and to show the business its own results. When the business asks the assistant to review its ads, the same figures for that business alone are sent to the AI provider that powers the assistant, and to no one else.
What STACKS stores: the access token Meta issues, encrypted, one per business; the id and name of the chosen Page, Instagram account and ad account; and, for each post or ad made through STACKS, the id Meta assigned to it. Data from one business is never shown to, combined with, or used for another business.
Disconnecting: a business can disconnect Meta at any time from the CONNECT screen in Ad STACKS, or remove STACKS from Business integrations in its Facebook settings. On disconnect STACKS revokes its own access at Meta and erases the stored access token immediately. Posts and ads already published remain on the Page, Instagram account and ad account, because they are the business's own content there. A Page post can be removed from STACKS or in Facebook; an Instagram post is removed in Instagram, and STACKS then forgets it; ads are paused or deleted in STACKS or in Meta Ads Manager. Meta's own terms and privacy policy continue to apply to the business's Meta accounts.
A business can connect an AI assistant it already uses, such as ChatGPT or Claude, to its own STACKS account. The connection is made with OAuth: the business signs in with the Google account it uses for STACKS and approves what the assistant may do. No password, API key or token is ever typed into the assistant, and STACKS never receives the credentials of the assistant provider.
What the assistant can read: it can read a grouped summary of the business inventory (counts and price ranges by model, storage, carrier, condition and status, never individual units), observed market price bands for the devices it has priced, its own buy price configuration, its locations (name, city, business type, website, Google rating, the number of reviews, and whether a Google Business Profile is linked), which integrations it has connected (as yes or no, with connection and expiry dates, plus the display name of a chosen ad account), the business's verified website addresses and whether analytics is linked to each, and its own advertising copy and images. It can also read the public pages of the business's own websites verified with STACKS, exactly as any visitor sees them, with scripts, tracking and verification tags and anything shaped like an API key removed; for a repair website, what Google Search Console reports about whether the pages of the business's own verified website are indexed; for a buyback website, the business's own buy price list with the price adjustment on each device, and its own verified website's search performance from Google Search Console, including the search terms people used to find it; and, where the website offers it, a list of the business's own pages, posts, FAQ entries, home page sections, menu items and store pages, including hidden or unpublished ones that are not shown on the public site, giving for each its title or label, its place in the order and whether it shows; and, one item at a time, the stored text of one of those pages, posts, FAQ entries or store pages, or of a brand, category or model page (its title, body, search title and description, header image and alt text, and whether it is published), including unpublished or hidden ones, so the assistant can read a draft before it changes it. Where the business has connected its point of sale (POS) system to STACKS and leaves that permission ticked on the approval screen, the assistant can also read the business's own repair tickets as STACKS keeps them from that POS: for each ticket its number, type and status, the devices on it with each device's status, due date and task type, the amount due, the total and the amount paid, the name of the staff member it is assigned to, the dates it was created and last updated, and its location name; and the business's repair mix, which is the number of tickets per device and task type, how many are still open, and how many were created in the last 30 and 90 days. Where the business has Ad STACK and leaves those permissions ticked, the assistant can also read the business's own Ad STACK posts as STACKS keeps them (their words, picture, planned date and time, the places each is set to go, and whether STACKS has sent it), its own Ad STACK library pictures, and its own Facebook and Instagram ads on its own Meta ad account, with each ad's name, text and status and its spend, reach, impressions and clicks as Meta reports them. The assistant never receives anything STACKS reads from Google about the business's Business Profile, including its performance figures, search terms, reviews, and the status or error Google gives a post.
What the assistant cannot read, by design: customer names, phone numbers, email addresses or any other customer record; order history; payment or payout data; and any API key, secret or credential. There is no tool that returns them, and every tool is restricted to the single business that approved the connection. A repair ticket is returned without the customer's name, phone number or email address. The business may type a customer's name into its assistant to find that customer's tickets: STACKS matches the name against that business's own tickets only, never returns it, and does not keep it in the copies of requests described below. A phone number or email address cannot be used to search. A connection can never read another business's data. These are not given to the assistant from the business's STACKS records. When the assistant reads one of the business's public web pages, it sees what any visitor to that page sees, which can include published reviews with the name shown on them and devices listed for sale with their price and condition.
What the assistant can change, and only with permission: when a business connects an assistant, the approval screen lists each kind of change separately, and the assistant can make only the kinds the business leaves ticked there. Every kind of change starts ticked, and the business can untick any of them, including creating new pages or entries, before it approves. Depending on the kind of website STACKS runs for the business, the kinds of change are: page titles and search descriptions; the text of pages, blog posts, FAQ entries, menu items and home page sections, and which of them show and in what order; the images and icons on those pages, posts and home page sections, and the images shown for its brands and categories; the labels and links of the buttons in its home page sections; website colours and layout options; and, on a buyback website, the price adjustments applied to its buy prices, within a fixed limit that cannot be raised. The assistant can change only the business's own public website content, through STACKS. It cannot change the catalogue, the prices a business syncs from its own price list, orders, customer records, credentials, or anything the business did not allow.
Ad STACK, where the business has it, has its own permissions on the approval screen, each one separate: the assistant can change the words of a suggested post; schedule a suggested post, or post it now, to the business's own Google Business Profile, Facebook Page and Instagram account, which approves it in the same step exactly as SCHEDULE does in the STACKS app; pause or resume one of the business's own ads; and boost a post as a paid Facebook and Instagram ad on the business's own Meta ad account, choosing 5, 10 or 20 a day, for 3, 7 or 14 days, shown within 10 or 25 miles of its locations. A boost spends the business's own money, billed by Meta to the business: the assistant is first given the price, and STACKS starts the ad only when the assistant returns that exact quote, unchanged, within 15 minutes, after the business agrees. Each of these runs as the person who approved the connection, with the same checks as in the STACKS app, and only an owner or admin can schedule posts. Posts and ads made this way show in Ad STACK in the STACKS app like any other, and are cancelled, paused or removed there.
How images are added: when the business allows it, the assistant can add, change or remove an image on its website by giving STACKS the web address of an image, or an image the business uploaded to its assistant. STACKS itself fetches the image from that address, sending nothing about the business with the request, and checks that it is a JPEG, PNG or WebP image within the size the website accepts. Where a place on the website needs a smaller image, the image is resized to fit; what it shows is never changed. STACKS never generates, draws or edits an image. The image is then uploaded to the business's own website and stored there with its other images. An image that is replaced or removed stays stored on the website, and the AI Edits list keeps it, so the change can be undone there.
How changes are recorded and undone: every change an assistant makes shows in the AI Edits list in the business's website admin, with the value it replaced, and can be reverted there. STACKS keeps a separate change record of each change request: when it was made, by which connection, to which website, the names of the fields it touched and whether it succeeded. That change record holds field names only, never the values. That record is kept until the business's STACKS account is deleted.
Who receives it: only the provider of the assistant the business chose to connect, under that business's own account with that provider, and only the answers to the questions the business asks. That provider's privacy policy and terms apply to what it then holds. STACKS does not send this data to any other recipient, and does not use it to train any model. When the assistant changes the website, the change is sent only to that business's own website, and an Ad STACK post or ad goes only to the business's own Google Business Profile, Facebook Page, Instagram account and Meta ad account.
What STACKS stores and for how long: the record of the connection itself (which business, which person approved it, which assistant, when, and what it may do), kept while the connection is active and, once revoked, kept marked as revoked until the business's STACKS account is deleted; a one way sha256 digest of each token, never the token; a short lived access token digest that expires after one hour; the time the connection was last used; and a monthly count of requests for the business. STACKS never receives the questions a business asks its assistant or the assistant's replies to it. STACKS does keep a copy of each request the assistant sends to STACKS and of the answer STACKS gives, including any text the assistant asked to write to the website and, for an image, the address it came from with any access code removed, never the image itself, and with any customer name the business searched by replaced by a placeholder, for 90 days, for support and safety, after which it is deleted automatically. Only STACKS can see it. Revoking a connection deletes every access token under it immediately and the assistant loses access at once.
How to disconnect: open the STACKS app, go to Account, then STACKS AI, and disconnect. You can also remove the connector inside the assistant itself. Disconnecting in the STACKS app is what stops access at source.
We implement industry-standard security measures to protect your data, including encryption in transit and at rest, access controls, and regular security reviews. No method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
We use cookies and similar technologies for site functionality, analytics, and marketing. You can control cookies through your browser settings. We use Google Tag Manager for analytics tracking. These technologies operate on our marketing website and never receive data obtained through Google APIs.
To protect our forms from automated abuse, we use Cloudflare Turnstile, which analyzes limited device and browser signals to distinguish humans from bots without presenting a visible challenge. Turnstile's handling of this data is described in the Cloudflare Turnstile Privacy Addendum and the Cloudflare Privacy Policy.
Depending on your location, you may have the right to:
To exercise these rights, contact us at yes@stacks.tech.
We retain your data for as long as your account is active or as needed to provide the Service. After account termination, we may retain certain data as required by law or for legitimate business purposes. Data obtained through Google APIs is retained and deleted on the shorter timetable set out in Section 4.7, which applies regardless of this section.
Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. If a change materially affects how we handle data obtained through Google APIs, we will describe that change in Section 4.
You may request deletion of your account and related data at any time by emailing jj@stacks.tech. Requests are processed within 10 business days.
To remove STACKS from a connected account first, disconnect it in STACKS or at the other company (myaccount.google.com/permissions for Google; Business integrations in your Facebook settings for Meta). Section 4.7 above sets out what is deleted for Google, and the Meta note under Section 5 does the same for Meta.
For privacy-related questions or concerns, including any question about Google user data, contact us at yes@stacks.tech.