Privacy policy
Last updated 12 October 2026.
This page says what personal data StackRails holds about you, why, where it came from and what you can do about it. It covers this website, our meeting booking pages and the emails our sales team sends.
1. Who is responsible for your data
The controller is StackRails Ireland Limited, a company registered in Ireland with company number 815991. Its registered office is Riverside One, Sir John Rogerson's Quay, Dublin 2, D02 X576, Ireland.
For any question about your data, or to use any of your rights, write to contact@stackrails.ai.
2. What we collect and why
When you visit this website
Our hosting provider records technical data about each request: IP address, date and time, the page asked for, the page you came from, and your browser and device type. We use it to keep the site running and secure, to count visits and to measure loading speed. Our visit statistics set no cookies and do not follow you across other sites.
Legal basis: our legitimate interest in running a secure and working website (Article 6(1)(f) GDPR).
When you accept marketing cookies
Only if you click Accept on the cookie banner, we load scripts from LinkedIn, Albacross and Happierleads. They tell us which company a visit comes from and, where they can, which person, and whether a LinkedIn ad led to a visit or a booked meeting. The cookie policy lists them and lets you change your choice at any time.
Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time.
When you send us a form
The demo, assessment, security pack and partner forms collect what you type into them: your name, work email, company, and, depending on the form, your role, phone number, team size, website and message. We use it to answer your request and to stay in touch with you about it.
Legal basis: steps taken at your request before a possible contract (Article 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Article 6(1)(f) GDPR).
When you book a meeting with us
Our booking pages collect your name, company, email address and the time you choose. We use them to hold the slot, send you the confirmation and prepare for the meeting.
Legal basis: your consent, given on the booking form (Article 6(1)(a) GDPR). You can withdraw it at any time by writing to us. We then cancel the meeting.
When we write to you first
We contact people in engineering, architecture, IT and security roles at companies we think StackRails is relevant to. For this we hold your name, employer, job title, work email address, LinkedIn profile address and country, and a record of the emails we sent and any reply.
Legal basis: our legitimate interest in telling relevant companies about our product (Article 6(1)(f) GDPR). You can object at any time, with no reason needed. Reply to any of our emails saying so, or write to contact@stackrails.ai. We then stop and keep only your email address on a do-not-contact list, so that we do not write to you again.
When you write to us or meet us
We keep the emails and messages you send us and our notes from calls and meetings, to answer you and to keep a record of what was agreed.
Legal basis: our legitimate interest in handling enquiries (Article 6(1)(f) GDPR).
3. Where your data comes from
Most of it comes from you. Where it does not, the sources are:
- Business contact databases, currently Apollo and Clay, and public sources such as LinkedIn and your employer's website. This is where the contact details for a first email come from.
- Albacross and Happierleads, which match a website visit to a company and sometimes a person, and only if the visitor accepted marketing cookies.
We hold business contact details only. We do not collect sensitive personal data.
4. Who receives your data
We do not sell personal data. We share it only with the companies that help us work:
- Kolomolo AB, Sweden, whose staff run sales, marketing and this website for StackRails.
- plusfigaro, our marketing agency, which prepares and sends sales emails and runs our adverts on our instructions, and the tools it uses to find, check, write and send email.
- Vercel and Supabase, which host this website and its forms.
- Amazon Web Services, which hosts our meeting booking pages.
- Resend, which delivers the emails our forms send.
- Microsoft, for email, calendar and documents.
- LinkedIn, Albacross and Happierleads, for the marketing scripts described above, if you accepted them.
- Cloudflare, which serves the videos on this site.
- Our lawyers and accountants, and public authorities where the law requires it.
5. Transfers outside the European Economic Area
Some of these companies are based in the United States or process data there. Where personal data leaves the European Economic Area, the transfer relies on a European Commission adequacy decision, such as the EU-US Data Privacy Framework, or on the Commission's standard contractual clauses. Write to us for more detail on a specific transfer.
6. How long we keep it
- Contact details used for a first email: while we are in contact with your company about StackRails. We delete them when you object or when we stop writing to your company.
- The do-not-contact list: for as long as we send sales emails.
- Form requests, bookings and correspondence: for as long as we are dealing with your request or your company, and afterwards only for as long as a legal claim could be made.
- Marketing cookies: until you withdraw consent. We ask again after six months.
- Customer contracts and invoices: for the period the law requires.
7. Your rights
Under the GDPR you can:
- ask what data we hold about you and get a copy
- have wrong or incomplete data corrected
- have your data deleted
- have its use restricted
- object to our use of it, including any use for direct marketing, which we then stop
- withdraw a consent you gave, without affecting what was done before
- receive the data you gave us in a common electronic format
Write to contact@stackrails.ai. We answer within one month. It costs nothing.
8. Complaints
You can complain to a data protection authority. Ours is the Data Protection Commission in Ireland, at dataprotection.ie. You can also complain to the authority in the country where you live or work. The European Data Protection Board lists them at edpb.europa.eu.
9. Whether you have to give us data
No. Nothing on this site requires it. If you leave a form field empty we may not be able to answer your request.
10. Automated decisions
We make no decisions about you by automated means alone, and none that have a legal or similar effect on you.
11. Changes to this policy
When we change how we handle personal data we update this page and the date at the top.