Privacy Policy

Last updated: October 2, 2026

We never sell your data to anyone.

This Privacy Policy applies to personal data processed by HockeyStack, Inc. ("HockeyStack," "we," "us") in our business, including on our websites and other online or offline offerings (each a "Service" and collectively, the "Services"). It explains what personal data we collect, how we use it, who we share it with, and the rights available to you.

HockeyStack considers data protection and privacy to be of paramount importance. We never sell personal data, and we carry out all processing operations in compliance with the European Union General Data Protection Regulation ("GDPR") and other applicable privacy and data protection laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and other US state privacy laws (collectively, "Applicable Law").

For this Privacy Policy, "Personal Data" means any information relating to an identified or identifiable natural person (or household, as applicable), and includes any equivalent definition in Applicable Law.

Personal Data We Collect and Why

Usage Data

When you visit our site, we process the website from which you visited us, the parts of our site you visit, the date and duration of your visit, and information about the device you used (device type, operating system, language, country, and browser type). While we process your IP address during your session, the IP address is deleted before it is ever written to disk on our servers.

We process this usage data to facilitate your access to our Services (for example, to adjust our Services to the device you are using) and to recognize and stop misuse, which is in our legitimate interest (Article 6(1)(f) GDPR). We also process usage data in aggregated or de-identified form for statistical purposes and to improve our site.

Cookies

Cookies are small data files transferred onto computers or devices. On our own website, we use cookies to operate the site and to understand how visitors use it so we can improve it. You can manage cookie preferences through the cookie banner on our site. For details, see our Cookies Policy.

HockeyStack's own tracking technology used by our platform is free of cookies.

Contacting Us

When you contact us (for example, via a contact form or email), we ask for contact information such as your email address. We use this data solely to answer your query (Article 6(1)(f) GDPR).

HockeyStack Account

When you sign up for a HockeyStack account, or sign up for content or offers, we may ask for information such as your name, email address, and details about your organization. We process this information to provide the Service you signed up for (Article 6(1)(b) GDPR).

You may deactivate your HockeyStack account and/or unsubscribe from content or offers at any time. Following termination of your account, we may retain your personal data (in part or in whole) to meet regulatory and reporting requirements for the timeframes stipulated by law and to address customer service issues. Any other personal data we process on your behalf is deleted permanently within 30 calendar days.

Billing Information (Self-Serve Subscriptions)

If you purchase a self-serve subscription, payment is handled by our payment processor, Stripe, Inc. ("Stripe"). We receive limited billing information (such as your name, billing address, the card type, the last four digits of the card, and transaction status) to manage your subscription, but we do not receive or store full payment card numbers. Stripe's handling of your data is described in its own privacy policy at https://stripe.com/privacy. The legal basis for this processing is performance of our contract with you (Article 6(1)(b) GDPR) and compliance with legal obligations such as tax and accounting rules (Article 6(1)(c) GDPR).

Use of De-Identified and Aggregated Information

We may use Personal Data and other data to create de-identified and aggregated information, such as de-identified demographic or location information, information about devices used to access our Services, or other analyses we create. De-identified and aggregated information is not Personal Data. We use Userguiding for these purposes.

Sharing and Disclosure

HockeyStack does not sell, and has never sold, Personal Data. Except as described below, we do not share or disclose your Personal Data.

Service providers. We use a select number of trusted external service providers for technical data analysis, processing, and/or storage (for example, cloud hosting and IT services). These providers are carefully selected, meet high data protection and security standards, receive only the information required for their services, and are contractually bound to confidentiality and to process Personal Data only on our instructions. The subprocessors we use to deliver the HockeyStack platform are listed in our Data Processing Agreement.

Vendors and public institutions. Where necessary to make use of services requiring special expertise (such as legal, accounting, or auditing services), we may share Personal Data with vendors of such services or public institutions (for example, courts) (Article 6(1)(f) GDPR).

Disclosures to protect us or others. We may access, preserve, and disclose stored information if we in good faith believe doing so is required or appropriate to comply with law enforcement or national security requests and legal process (such as a court order or subpoena); protect rights, property, or safety; enforce our policies or contracts; collect amounts owed to us; or assist with an investigation or prosecution of suspected or actual illegal activity (Article 6(1)(b), (c), or (f) GDPR, depending on the circumstances).

Merger, sale, or other asset transfers. If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, your information may be transferred as part of that transaction as permitted by law and/or contract (Article 6(1)(f) GDPR).

Other than the cases above, we will only pass your data to third parties with your express consent (Article 6(1)(a) GDPR) or where we are obliged to do so by law or by an instruction of a public authority or court.

Third-Party Websites

The Services may contain links to other websites, and other websites may link to ours. These websites are not controlled by HockeyStack, and we are not responsible for their privacy practices or content. We encourage you to read the privacy policy of every website and application you interact with.

Data Hosting and International Transfers

HockeyStack hosts platform data on AWS's eu-central-1 region in Frankfurt, Germany.

Data Security

HockeyStack takes a defense-in-depth approach to securing personal data. We maintain administrative, technical, and physical safeguards designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, including:

Encryption in transit. All data transmitted between users, our applications, our APIs, and our backend services is encrypted in transit using TLS 1.2 or higher.

Encryption at rest. All personal data stored in our production databases and primary object storage is encrypted at rest using industry-standard AES-256 encryption, with keys managed through our cloud provider's managed key service under role-based access restrictions and rotation policies.

Access controls. Access to systems containing personal data is limited to authorized personnel with a documented business need, granted on a least-privilege basis, requires multi-factor authentication, and is reviewed periodically. Production database access is logged and monitored. All employees and contractors are bound by written confidentiality obligations and complete annual security and privacy training.

Network and application security. Our production environment is hosted in audited cloud infrastructure protected by firewalls, network segmentation, vulnerability scanning, and continuous monitoring. Code changes undergo peer review, automated static analysis, and dependency scanning before deployment.

Logging and monitoring. Security-relevant events are centrally logged, retained, and monitored for anomalies, with alerts investigated by our security team.

Vulnerability management. We conduct regular vulnerability scans and engage independent third-party assessors for periodic penetration testing, remediating identified issues under defined service levels based on severity.

Incident response. We maintain a documented incident response plan. In the event of a personal data breach, we will notify affected users and applicable supervisory authorities as required by law, including under GDPR Articles 33 and 34 where applicable.

Backups and resilience. Personal data is backed up in encrypted form, backups are tested periodically, and we maintain documented business continuity and disaster recovery plans.

Independent assessments. Our security documentation is available at security.hockeystack.com.

No system can be guaranteed 100% secure. We continually evaluate and improve our security program in response to evolving threats and best practices.

Use of Google API Services

HockeyStack integrates with Google API services (including Google Calendar) to provide features explicitly requested by our users. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

  • We access Google user data only with the user's explicit authorization through Google's OAuth consent flow.
  • We use Google user data solely to provide and improve the user-facing features for which the user authorized access.
  • We do not use Google user data to serve advertising, including retargeted or personalized advertising.
  • We do not transfer Google user data to third parties except as necessary to provide the user-facing feature, comply with applicable law, or as part of a merger, acquisition, or sale of assets where users will be notified.
  • We do not allow humans to read Google user data except (i) with the user's affirmative consent, (ii) where necessary for security purposes (such as investigating abuse), (iii) to comply with applicable law, or (iv) where the data has been aggregated and is used for internal operations in compliance with applicable privacy laws.

Google user data is protected by the safeguards described in the Data Security section above. You may revoke HockeyStack's access to your Google data at any time through your Google Account permissions page or by contacting us at ar@hockeystack.com.

Communications

We may occasionally send you notification emails about product updates, changes to legal documents, customer support, or marketing. Where required by Applicable Law, we will only send such messages with your consent (Article 6(1)(a) GDPR); otherwise the legal basis is our legitimate interest (Article 6(1)(f) GDPR). Except where we are required to contact you by law (for example, to notify you of a data breach), you can unsubscribe from these messages free of charge at any time. We process requests to be placed on do-not-contact lists as required by Applicable Law.

Your Rights

Depending on where you live, you have some or all of the following rights regarding Personal Data we hold about you as a controller:

  • Access / to know: the right to be informed about, and receive a copy of, the Personal Data we process about you.
  • Rectification / correction: the right to have inaccurate Personal Data corrected.
  • Erasure / deletion: the right to request deletion of your Personal Data, subject to exceptions prescribed by law.
  • Restriction and objection: the right to restrict or object to processing based on our legitimate interests.
  • Portability: the right to receive Personal Data you provided to us in a structured, commonly used, machine-readable format.
  • Withdrawal of consent: where processing is based on consent, the right to withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at ar@hockeystack.com. To protect your privacy, we take steps to verify your identity before fulfilling a request; we can identify you via your email address, and we can only respond regarding Personal Data we hold as a controller.

We do not sell Personal Data or share it for cross-context behavioral advertising, and we have not done so. Because of this, we do not offer an opt-out of sale or sharing. Authorized agents may submit requests on a consumer's behalf as permitted by Applicable Law. If we decline a request, you may appeal by replying to our decision, and you also have the right to lodge a complaint with your data protection authority or, in the US, your state attorney general.

Duration of Processing

We store usage data until you withdraw your consent for us to do so, where processing is based on consent. All other data described above is retained for as long as necessary for the purposes for which we collected it, or to provide our Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, and enforce our agreements. We may also retain information as required by law.

Children's Information

The Services are not directed to children under 13 (or other age as required by local law), and we do not knowingly collect Personal Data from children. If you learn that your child has provided us Personal Data without your consent, contact us as set forth below. If we learn that we have collected Personal Data in violation of Applicable Law, we will promptly delete it and terminate the child's account.

Changes to This Privacy Policy

We may revise this Privacy Policy from time to time. The most current version governs our practices for collecting, processing, and disclosing personal data, and we will post notice of modifications on our site. If you have an account with us, we will notify you of material modifications by email to the address associated with your account unless you have unsubscribed from all email communications. Changes take effect on the sooner of the day you use the site and/or Services after they are posted or 30 calendar days after posting. Your continued use after the effective date constitutes acceptance of the modified policy.

Contact

HockeyStack, Inc.
210 King St, Floor 3
San Francisco, CA 94108
ar@hockeystack.com

You can request deletion of your data at any time by emailing us with the subject line "Delete My Data."