• Account, business, identity, contact and recovery information.
• Stack content, forms, leads, mailing lists, campaigns and appointment details.
• Payment references, amounts, currencies, fees, balances, refunds, disputes and payout details. Full card credentials are handled by payment providers.
• Customer email, contact details and actions when they pay, join, book or request passwordless access.
• Device, IP, approximate country, usage, security, delivery and webhook records.

We use information to operate and secure Selstack, route payments, calculate fees, release balances, deliver receipts and files, send authorised messages, sync calendars, attribute verified Discover visits, provide analytics, answer support requests, prevent abuse and comply with legal or provider obligations.

A creator controls the customer information collected through their Stack and must have a lawful basis to use it. Selstack processes that information to provide the requested service and may also act as an independent controller for payment, fraud, support, compliance and platform-security records.

Selstack shares only what is needed with infrastructure and payment partners, which may include Paystack, Stripe, SendGrid, Google Calendar and OAuth, Bunny storage/CDN, hosting, analytics, monitoring and professional advisers. Those providers process information under their own terms and security obligations.

If you choose Google sign-in, Selstack uses the Google account identifier, email address, name and profile image returned by Google to authenticate you, create or match your Selstack account, and display your account profile. We do not use Google sign-in data for advertising, sell it, or use it to determine eligibility for credit.

• Connecting Google Calendar is optional and requires your explicit Google consent.
• Selstack requests your Google account email and the calendar.events.owned scope. This permits Selstack to view and manage events only on calendars you own; Selstack connects to the primary calendar selected by the integration.
• For calendar import, Selstack reads event identifiers, titles, descriptions, locations, status, start and end times, and Google event links. The current sync window covers events from one year before the sync through two years after it.
• Selstack stores imported event details as appointments in the connected Selstack workspace so you can view your schedule and avoid conflicting bookings.

• Selstack reads calendar events only to provide the calendar connection, appointment display and synchronisation features you request.
• When you create or update a Selstack appointment, Selstack may create or update the corresponding Google Calendar event. That event can include the appointment title, time, customer name and email, and booking note supplied through Selstack.
• Selstack does not use Google Calendar data for advertising, sell it, transfer it to data brokers, or use it for lending or credit decisions.
• Selstack personnel do not read Google user data except with your affirmative permission for support, when necessary to investigate abuse or a security incident, when required by law, or when the data has been aggregated and anonymised for internal operations.

• Google OAuth access and refresh credentials are encrypted at rest, excluded from normal application responses, and used only by Selstack's server to provide the connected calendar feature.
• Google data is not shared with unrelated third parties. It may be processed by Selstack's contracted hosting, database, monitoring and support providers only as needed to operate or secure the service, or disclosed where the law requires it.
• You can disconnect Google Calendar from the Appointments page at any time. Selstack then removes the stored OAuth credentials, connected Google account details and appointments imported from Google, and requests revocation of the Google token. Selstack-created appointments remain in Selstack.
• You may also revoke Selstack from your Google Account permissions. To request deletion of other account data, contact hello@selstack.com; legal, fraud, payment or backup records may remain for the limited periods described in this policy.

Selstack's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Creators may send messages only to recipients they are authorised to contact. Selstack records delivery, bounce, complaint, open and click events where enabled. Pro creators may configure pixels or Google tags on their own Stack; they are responsible for required notices and consent.

Selstack collects aggregate page-use statistics by default to improve the service. These statistics are kept separate from advertising profiles. Optional creator or Selstack advertising pixels remain disabled unless a visitor has previously allowed them.

We retain data while an account is active and for the period needed for receipts, disputes, tax, fraud prevention, backups and legal obligations. Deletion requests may not remove records that Selstack must lawfully preserve. Backup copies expire on their normal rotation.

We use access controls, encryption in transit, signed webhooks and downloads, password hashing, restricted customer sessions, monitoring and backups. No system is perfectly secure, so users must protect their credentials and notify us promptly of suspected misuse.

Selstack and its providers may process information outside the user’s country. Where required, we use contractual, organisational or provider safeguards intended to protect transferred information.

• Update creator account and business information in Settings.
• Use passwordless customer access to view activity tied to a verified email.
• Manage email subscriptions and unsubscribe links.
• Request access, correction, deletion or another applicable privacy right.

Privacy requests can be sent to hello@selstack.com. We may need to verify identity before disclosing or changing personal information.