PRIVACY policy.

This Privacy Policy describes how StackSmiths Private Limited ("we", "us", "our") collects, uses, and protects your personal information when you use the HEDA platform, website, desktop application, and related services (collectively, the "Service").

1. Information We Collect

Information You Provide

• Account information: name, email address, and password when you register.
• Workspace information: organization name and team details.
• Payment information: billing details are collected and processed by our payment provider, Paddle.com. We do not store your credit card or payment method details.
• Communications: messages you send us via email or support channels.

Information Collected Automatically

• Usage data: pages visited, features used, actions taken within the Service.
• Device data: browser type, operating system, screen resolution, and IP address.
• Cookies: we use essential cookies for authentication and session management. Analytics cookies are used only with your consent.

2. How We Use Your Information

We use your personal data for the following purposes:

• Providing, maintaining, and improving the Service.
• Processing your transactions (via Paddle as Merchant of Record).
• Sending transactional emails (account confirmation, password resets, billing notifications).
• Providing customer support.
• Analyzing usage patterns to improve the product (aggregated and anonymized where possible).
• Preventing fraud and ensuring security.

We do not sell your personal data to third parties. We do not use your data for purposes beyond providing, supporting, and improving the Service.

3. Payment Processing

All payments are processed by Paddle.com, which acts as the Merchant of Record for all transactions. When you make a purchase, Paddle collects your payment information directly. Paddle may share your name, email, and transaction details with us for the purposes of order fulfillment, support, and fraud prevention. Paddle's handling of your data is governed by Paddle's Privacy Policy.

4. Data Sharing

We share personal data only in the following circumstances:

• Paddle.com: for payment processing, billing, and refunds.
• Analytics providers: aggregated, anonymized data for product improvement (e.g., Google Analytics, Microsoft Clarity).
• Legal requirements: when required by law, regulation, or legal process.
• Business transfers: in connection with a merger, acquisition, or sale of assets, with prior notice.

5. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. After account deletion, we may retain certain data for up to 90 days for legal and operational purposes (e.g., resolving disputes, enforcing agreements). Anonymized and aggregated data may be retained indefinitely.

6. Data Security

We implement industry-standard security measures to protect your data, including:

• Encrypted data transmission (TLS/HTTPS).
• Encrypted passwords (bcrypt hashing).
• Encrypted session cookies (iron-session).
• Role-based access controls.
• Regular security reviews.

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: request a copy of your personal data.
• Correction: request correction of inaccurate data.
• Deletion: request deletion of your personal data.
• Portability: request your data in a portable format.
• Objection: object to processing of your data for certain purposes.
• Withdrawal of consent: withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at contact@thestacksmiths.com. We will respond within 30 days.

8. GDPR Compliance

If you are located in the European Economic Area (EEA), we process your data under the following legal bases:

• Contract: processing necessary to provide the Service you requested.
• Legitimate interest: improving the Service, fraud prevention, and security.
• Consent: analytics cookies and marketing communications (where applicable).

Paddle, as the Merchant of Record, independently complies with GDPR for payment-related processing. For data processing between Paddle and StackSmiths, Paddle's Data Processing Addendum applies.

9. Cookies

We use the following types of cookies:

• Essential: required for authentication and core functionality. Cannot be disabled.
• Analytics: help us understand usage patterns. Enabled only with your consent.

You can manage cookie preferences through your browser settings.

10. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. Your continued use after changes are posted constitutes acceptance of the updated policy.

12. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at:

StackSmiths Private Limited
Email: contact@thestacksmiths.com
Website: www.getheda.com