Privacy policy
Last updated: August 17, 2026
This policy explains what personal data Zeldia collects through Stack32, why, and what your rights are.
This document is a structured legal draft intended to inform users. It has not been reviewed by a lawyer and does not constitute legal advice. If in doubt, consult a qualified legal professional.
1. Data controller
The data controller is Zeldia (SIREN 951 022 094, 951 022 094 R.C.S. Evreux). Contact: hello@stack32.com.
2. Data we collect
Account data (email, name, password hash); profile data provided during onboarding (first name, phone number, role, discovery source, use case); content you submit (prompts, conversations, documents); usage data (features used, technical logs); and billing data processed by our payment provider.
3. Why we process it
To provide the service (create and run your agents), to secure accounts, to improve the product, to provide support, to handle billing, and to comply with legal obligations. Legal bases include contract performance, legitimate interest, legal obligations, and consent for optional analytics and advertising cookies.
4. AI processing
Your prompts and connected documents are processed by AI model providers acting as processors, strictly to generate your agents' answers while your account is active. After account deletion, we may retain anonymized excerpts (with no identity or contact details) useful for product improvement, as described in section 7.
5. Sharing
Data is shared only with processors necessary to run the service (IONOS hosting, database, AI model providers, payment provider) and, if you consent, analytics (PostHog) or advertising partners (Meta, TikTok), under data-processing or platform terms. We do not sell personal data for money. Advertising pixels can count as “sharing” under some US laws — see section 12.
6. Retention
Account data is kept while your account is active. On account deletion, identifying personal data and your agents are erased (see section 7). Some data may be kept longer when a legal obligation requires it (e.g. billing).
7. Account deletion — what is erased / what may be retained
When you delete your account: (a) we erase your profile, credentials, agents (published or not), account-linked conversations, stored files, connections, secrets, favorites, product-side subscriptions and any related public access — agents do not remain available under @stack32 or any other platform account; (b) we may retain, in anonymized or pseudonymized form and with no link to your identity, signals useful to improve Stack32: prompts / technical instructions, agent structures and briefs (role, goal, instructions, rules, tools without secrets), execution error patterns, and usage aggregates. Legal basis: legitimate interest in making the product more reliable. These archives are not used to re-identify you or to reactivate your account.
8. Your rights
You have rights of access, rectification, erasure, portability, restriction and objection, and the right to lodge a complaint with the CNIL (French supervisory authority). To exercise your rights, contact hello@stack32.com.
9. Security
We apply appropriate technical and organizational measures: encryption in transit, access controls, isolation of customer data and least-privilege access.
10. Transfers outside the EU
Some processors may be located outside the European Union. In that case, transfers are protected by appropriate safeguards such as the European Commission's standard contractual clauses.
11. Cookies and similar technologies
Strictly necessary cookies (session, security, language, theme, consent record) run without extra consent because the service cannot work without them. Analytics (PostHog, including session replay with form fields masked) and advertising pixels (Meta, TikTok) load only after you accept them in the cookie banner. You can accept all, reject all, or customise categories, and change your mind at any time from the footer or the cookie policy. See the Cookie policy for the full list.
12. Rights in the United States (CCPA/CPRA)
If you are a California resident (and, where applicable, a resident of other US states with similar laws), you may request access, correction, deletion, and information about data we collected. We do not sell personal information for money. Advertising pixels, if you enable them, can qualify as “sharing” for cross-context behavioural advertising. Use “Do not sell or share my data” in the footer, or reject marketing cookies, to opt out. We honour Global Privacy Control (GPC) as an opt-out of advertising cookies. To exercise other rights, contact hello@stack32.com.
13. Rights in Canada (PIPEDA and Quebec Law 25)
If you are in Canada, you may request access, correction, and withdrawal of consent for optional processing, and you may complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information. Optional analytics and advertising cookies are off until you opt in. To exercise your rights, contact hello@stack32.com.