Privacy Policy
Last updated 10 August 2026
This describes what Stackly (made by Fullhold) collects, why, and how you can control it. We built Stackly around the idea that you own your data — this policy is written to reflect that in practice, not just in marketing copy.
What we collect
- Account data — your email address and password (handled by Supabase Auth; we never see your plaintext password).
- Profile data — whether you're set up as an individual or organization member, and your onboarding status.
- Organization data — organization name, branch structure, member roles, and invite records, for organizations you create or join.
- File data — the files you upload, their extracted text (used to answer your questions), and metadata like name, size, and type.
- Chat history — questions you ask the AI assistant and the answers it gives, stored so your conversation persists across sessions.
What we don't collect
- Your AI provider API key. BYOK keys live in your browser and are sent directly with each request — our servers pass them through to Anthropic, OpenAI, or Google, but never write them to a database.
- We don't run advertising trackers or sell data to third parties.
Where your data goes
- Supabase (our database, auth, and storage provider) — hosts account records, organization/branch data, file metadata, and file content you haven't routed to your own cloud provider.
- Your chosen AI provider (Anthropic, OpenAI, or Google) — receives your question and relevant file excerpts only when you've configured a BYOK key, and only for that request.
- Your connected cloud provider (e.g. Google Drive), if you or your organization connects one — files may be read from or written to that account directly.
Organization hierarchy and access
If you're a member of an organization, access to files is restricted by branch: you can see your branch and everything below it in the hierarchy, never above it or in a branch you're not part of. This is enforced at the database level (Postgres row-level security), not just hidden in the interface. Branch structure — names and where they sit in the tree — is visible org-wide so the org chart is navigable; branch contents (files) are not.
Your controls
- You can delete individual files at any time from the dashboard.
- You can remove your BYOK key at any time; nothing is retained after removal since it was never stored server-side.
- To delete your account and associated data, contact privacy@[your-domain] — placeholder until Fullhold has a registered domain and business email. We'll add a self-service option here as the product matures.
Security
Data in transit is encrypted (HTTPS). Data at rest is encrypted by our infrastructure provider (Supabase). Organization access control is enforced server-side via row-level security, not just in the app's UI — this was a deliberate design choice given how much trust an organization is placing in us with internal files.
Changes
We'll update the date at the top of this page whenever this policy materially changes.
Contact
privacy@[your-domain] — placeholder until Fullhold has a registered domain.