Privacy Policy

What we collect, why, where it is kept and how to reach us. This site sets no cookies unless you agree to analytics.

stackurity.dev, Stackurity Cloud (app.stackurity.dev) and Stackurity are operated by OUTDO INC, 35, 5th B Cross, 16th Main, BTM 2nd Stage, Bangalore, Karnataka, India 560076, which is responsible for the personal data described here. Contact: info@stackurity.dev.

This website

Analytics

• If you click Accept in the banner, we use Google Analytics and Google Tag Manager to count visits and see which pages are useful. Google sets cookies and receives your browser’s details and an anonymised IP address. Google’s own privacy policy applies to what it collects.
• If you decline, or ignore the banner, nothing is sent to Google.
• Your choice is stored only in your browser. Change your choice.

Spam protection

The contact and feedback forms, and the Stackurity Cloud sign-up form, use Cloudflare Turnstile to tell people from bots. Your browser loads Turnstile from Cloudflare only when you start filling in the contact or feedback form, and when you open the sign-up page; Cloudflare then receives your IP address and browser details to run the check. Cloudflare’s Turnstile privacy addendum applies to that.

The contact form

• When you send the form, we receive your name, email address, company, what you are interested in, the size you mention and your message, plus the time and your IP address to protect the form from abuse.
• We use it only to reply to you and, if you become a customer, to set up your licence or service. We do not sell it or add you to a mailing list.
• It is stored on our own server and in our email inbox. We delete enquiries that do not lead to a customer relationship within 24 months.

Feedback

• When you send feedback, from the feedback page or from inside Stackurity, we receive what kind of feedback it is, your message and your email address if you give one, plus the page path, the Stackurity version and edition, the time and the IP address it came from.
• We use it only to improve Stackurity and, if you gave an email address, to reply. It is stored on our own server, emailed to our inbox and posted to the Stackurity team's Slack workspace.

Stackurity Cloud

Stackurity Cloud is the hosted service. Your organisation decides which systems it connects; for the data those systems send, we act on your organisation’s behalf and process it only to provide the service (see the Terms of Service).

What we collect

• When you sign up: your name, email address, organisation name and password, plus your IP address, the time, and the versions of these terms and this policy you accepted. The password is stored only as a one-way hash (Argon2id).
• Your account: the names, email addresses and roles of your organisation’s users, sign-in sessions, and an audit log of actions taken (who, what, when, and from which IP address).
• What your systems report: host names, IP addresses, operating systems, installed packages and versions, application, repository, image and cluster names, and the findings, notes and decisions built from them. Keep personal data out of what you connect where you can; we do not need it.
• Integrations and notifications: the settings for channels you add (for example a Slack, Jira or email destination). Credentials you store are encrypted.
• Billing: your organisation’s plan, the number of assets paid for, and the subscription and invoice ids from Razorpay. Razorpay receives your name, email address and payment details on its own payment page. We never see or store card or UPI details.

The app uses one cookie to keep you signed in. It sets no advertising or analytics cookies.

How we use it

• To create and secure your account, provide the service, send the emails it needs (sign-up links, alerts and summaries you set up, billing notices), collect payment, prevent abuse and meet legal obligations such as tax records.
• We do not sell personal data, use it for advertising or use your organisation’s data to train AI models.

Connected AI assistants

If you connect an AI assistant, such as Claude or ChatGPT, to Stackurity Cloud, the assistant's provider receives the results of the requests it makes on your behalf: inventory, findings, project and asset names and, where a request needs them, the names and email addresses of people in your organisation. The provider handles that data under its own terms and privacy policy.

• We record which assistant you connected, what it may see and do, and when it was last used. Changes it makes are recorded in your organisation's activity log under your name.
• We do not receive your conversations with the assistant.
• An assistant can never see or do more than your own role allows, and it can change things only if you ticked "Allow changes" when connecting it. Its access tokens are short-lived.
• You can disconnect an assistant at any time under Connected assistants in your account menu, which revokes its access at once.

Where it is kept

• The service and its database run in India, in a DigitalOcean data centre in Bangalore.
• Daily database backups are kept on the same server for 7 days. Copies made before an upgrade are kept until three newer upgrades have been made.
• An off-site backup copy is encrypted on our server, with a key only we hold, before it is sent to Cloudflare R2 storage, where it is kept for 30 days. Cloudflare cannot read it. That storage may be located outside India.

Who else processes it

Notifications you set up go to the services you choose (for example your Slack workspace or Jira site); their own policies apply there. We may also disclose data where the law requires it.

How long we keep it

• Sign-ups that are never confirmed are deleted about a week after the link expires.
• When a trial or a paid plan ends, the organisation becomes read-only. If no plan is chosen within 30 days, its data is deleted, and backups that still hold it expire on the schedule above.
• Account and organisation data is kept while the organisation exists. When you ask us to close it, we delete its data within 30 days. Backups that still hold it then expire on the schedule above.
• Billing and tax records are kept as long as Indian law requires (currently 8 years).

The Stackurity software

Stackurity that you run on your own servers sends us nothing on its own: no telemetry, no usage data and no licence checks. The only exception is feedback a signed-in user writes and sends with Send feedback. It carries the message, the email address if given, the page path, the version and the edition, and never findings, asset names or hostnames. An administrator can turn it off. What Stackurity connects to is listed in its documentation.

Your rights

• You can ask us for a summary of the personal data we hold about you, to correct or complete it, or to delete it. You can withdraw consent you gave, for example to analytics. Under India’s Digital Personal Data Protection Act you can also nominate someone to exercise these rights for you.
• If your account belongs to an organisation on Stackurity Cloud, its administrators can change or remove your access and details too. For data your organisation’s systems sent, we may refer your request to them.
• Write to info@stackurity.dev. We may need to confirm your identity first. We acknowledge requests and grievances within 48 hours and answer within 30 days. If you are not satisfied, you can complain to the Data Protection Board of India.

Security

How the service protects data is described on the Security page. If we learn of a breach that affects your personal data, we will tell you and the authorities as the law requires.

Children

Stackurity is for businesses. It is not meant for anyone under 18, and we do not knowingly collect their data.

Changes

When this policy changes we update the version and date below. For material changes to how Stackurity Cloud uses personal data, we email the administrators of each organisation before the change takes effect.

Version 2026-10. Last updated 29 October 2026.