This Privacy Policy describes how Policy Stack ("Company," "we," "us," or "our") collects, uses, stores, and shares information when you use the Service. By using Policy Stack, you agree to the practices described here.
All financial values are encrypted at rest using AES-256-GCM field-level encryption via Supabase Vault. This means individual financial fields are encrypted in the database, not just the disk they reside on.
Payment details (credit card numbers, billing addresses) are collected and processed entirely by Stripe. We store only your Stripe customer ID, subscription status, and invoice history — never your card number or full billing details.
We store your theme preference and tool calculator inputs in your browser’s local storage so they persist between visits. This data never leaves your device.
We use your information to:
We do not sell your personal information. We do not use your financial data to train machine learning models without your explicit consent.
Supabase — Database, authentication, and storage infrastructure
All your account data, financial records, and uploaded documents are stored on Supabase infrastructure (PostgreSQL on AWS, US region). Supabase manages authentication sessions and provides row-level security ensuring you can only access your own data.
Stripe — Payment processing and subscription management
Handles all billing, subscription management, and payment collection. We send Stripe your email address to create a customer record. Stripe stores and processes your payment method — we never see or store your full card details.
OpenRouter — AI model routing
Routes AI requests to language models (currently Anthropic Claude and Google Gemini). When you use AI features, relevant data is sent to OpenRouter, which forwards it to the appropriate model provider. OpenRouter does not retain input data for training. See openrouter.ai/privacy.
Resend — Transactional and product email delivery
Sends collaboration invitation emails and optional weekly AI insight emails on our behalf. Receives recipient email addresses and email content.
Google — Authentication (optional)
If you choose “Sign in with Google,” Google provides your email and basic profile to Supabase for account creation. Google Fonts (Inter, Lora) are self-hosted by our application at build time and are not loaded from Google’s servers at runtime.
Vercel — Application hosting and edge delivery
Hosts the Policy Stack web application and serves static assets.
If you are a consumer connected to an advisor on Policy Stack, your advisor may access data you have explicitly shared through the platform’s collaboration features. You control this access.
Advisors may use Smart Lists to query across their connected and seated clients’ policy and financial data to segment clients. This data is not shared externally and powers advisor-facing notifications only.
Advisor Workflows evaluate client signals (anniversary dates, engagement metrics, financial thresholds) to generate advisor-facing notifications. No client-facing emails are sent by workflows.
We may disclose information if required by law, court order, or government request, or to protect the rights, property, or safety of Policy Stack, its users, or the public.
If Policy Stack is acquired or merges with another entity, your information may transfer as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
We may share your information for other purposes with your explicit consent.
Data is stored in Supabase-managed infrastructure hosted on AWS in the United States. Sensitive financial data fields (policy numbers, cash values, loan amounts, deployment amounts) are encrypted at rest using AES-256-GCM.
No method of transmission or storage is 100% secure.
We retain account data for as long as your account is active. After account closure, data is retained for a 30-day grace period, then permanently deleted. Uploaded documents are automatically deleted after 30 days (or per applicable data retention requirements). Billing records are retained for 7 years per legal requirements.
You can permanently delete your account at any time from Settings > Profile > Danger Zone. Account deletion removes your profile, policies, snapshots, deployments, loans, goals, documents, AI messages, and all associated data. Activity log entries are retained after account deletion with your user ID removed (anonymized) for system integrity purposes.
Policy Stack uses third-party AI models via OpenRouter to power document extraction, the AI Assistant, and AI Insights.
When you use these features:
See our AI Usage Policy for full detail on AI feature scope and limitations.
Update your account information at any time through account settings. Contact support@policystack.co for corrections not available in-app.
Export your financial data at any time through the Export feature in account settings.
Request deletion by contacting support@policystack.co or use the Danger Zone in account settings. Requests are processed within 30 days, subject to retention requirements in Section 4.3.
Opt out at any time via the unsubscribe link in any email or through notification preferences in account settings. Transactional emails cannot be disabled while your account is active.
California residents have the right to:
Contact support@policystack.co. We will respond within 45 days.
If you are located in the European Economic Area or United Kingdom, our legal basis for processing your data is:
You have the right to:
Your data is transferred to and processed in the United States. By using Policy Stack, you acknowledge this transfer. We rely on our service providers’ data protection measures (including Standard Contractual Clauses where applicable) to safeguard international transfers.
You may invite a partner (spouse, business partner, or advisor) to access your account via the Collaboration feature. When accepted, your partner gets full read and write access to your policy, loan, deployment, and goal data. You can revoke partner access at any time from Settings.
The Service is not directed to children under 18. We do not knowingly collect information from children under 18. Contact support@policystack.co immediately if you believe we have done so.
The Service may link to third-party sites. We are not responsible for their privacy practices.
Material changes will be communicated at least 14 days before taking effect. The “last updated” date reflects the most recent revision.
For privacy questions, data requests, or concerns:
Policy Stack
Email: support@policystack.co
policystack.co/privacy