Privacy policy
Effective 22/10/2026
This policy explains what personal data Stakkd collects through this website, the client portal and the Stakkd mobile app, why we collect it, and the rights you have over it. We keep it deliberately short and plain — if anything is unclear, email us.
On this page
Who we are
Stakkd is operated by Stakkd Limited, a company registered in England and Wales (company number 17335891) with its registered office at 124-128 City Road, London, England, EC1V 2NX. We are the data controller for the personal data described in this policy. Contact: [email protected].
What we collect
We collect only what we need to respond to you and run the service:
Enquiry and demo requests — your name, company, email address, phone number (if given) and the message you send us. If you choose to tell us, also your type of business (for example limited company or sole trader), your trade and your team size.
Your marketing choice — whether you ticked the box to hear about product news and offers, when, and the wording you were shown.
Which advert or link brought you to the site — the campaign tags in the link (such as utm_source or a Google Ads click ID), the page you landed on and the site you came from. See "Cookies and analytics" below.
Client portal accounts — your name, email address and sign-in records (including one-time login codes sent by email).
Website analytics — anonymous, aggregate usage of the marketing site. See "Cookies and analytics" below: this works without cookies and cannot identify you.
Mobile app diagnostics — see "The Stakkd mobile app" below.
How we use it
To respond to your enquiry or set up the demo environment you asked for.
To operate and secure the client portal (sign-in, multi-factor authentication, fraud prevention).
To understand, in aggregate, how the website is used so we can improve it.
To contact you about your account or demo. We do not sell your data, and we do not share it with third parties for their marketing.
To send you occasional product news and offers, within the rules in "Marketing emails" below.
To learn which adverts and links bring us enquiries, so we spend our advertising sensibly.
Our lawful bases
Taking steps at your request before entering a contract — handling demo requests and enquiries.
Performance of a contract — operating the client portal for customers.
Legitimate interests — securing the service, measuring the website in aggregate, working out which adverts bring us enquiries, and marketing email to limited companies and LLPs (see "Marketing emails").
Consent — marketing email to individuals, sole traders and partnerships who ticked the box on our forms. You can withdraw it at any time.
Cookies and analytics
The marketing site sets no cookies at all. Our analytics is first-party and cookieless: it records the pages you view, the trial buttons you click and the form steps you reach against a salted code that changes every day at midnight UK time, so it cannot recognise you between days, build a profile of you, or follow you to other sites. We never store your IP address or browser details. We keep these visit records for up to 400 days to see which pages and adverts lead to enquiries, then delete them. No third-party analytics or advertising scripts run on this site.
The client portal sets strictly necessary cookies only — short-lived sign-in and security tokens (portal_access, portal_refresh, portal_csrf). They exist solely to keep your session signed in and secure, and are not used for tracking of any kind. Because we use no optional cookies anywhere, there is no cookie banner to click.
If you arrive from one of our adverts or a tagged link, we record the campaign tags in that link (and, for a Google advert, its click ID) with that day’s visit, along with the page you landed on and the site you came from (without any search terms or other details in its address). Click IDs are deleted after 63 days. The site also keeps the tags in your browser’s own storage, not in a cookie, for the browser session only, so they can go with a form if you send one. When you send a form, we record that day’s visit code with it, so we can see which pages and advert led to your enquiry. Where you came from a Google advert, we may tell Google Ads that the click led to an enquiry, a trial or a subscription. We send the click ID and a one-way scrambled (hashed) copy of your email address, which Google can only match to an account it already holds, and nothing else about you.
Forms on this site are protected by Cloudflare Turnstile, which checks that submissions come from humans. Turnstile is provided by Cloudflare, Inc. and may process technical signals from your browser for that single purpose.
Where your data lives
Stakkd is built and hosted in the UK, and your data is stored in the UK. Each customer’s platform environment is isolated — your business’s data is never pooled with anyone else’s. The crash-reporting service used by the mobile app is also our own and hosted in the UK.
The Stakkd mobile app
The Stakkd mobile app is for engineers working in the field. Your login is created by your employer (the Stakkd customer) — there is no sign-up inside the app — and your name, email address and sign-in records are held in your employer’s own isolated Stakkd environment. This is what the app does on your phone:
Device identifier — the app generates a random identifier on first launch and stores it in the phone’s secure keychain. It is not Apple’s or Google’s advertising identifier. It is used to tie your sign-in session to the device and to group diagnostic reports.
Crash and diagnostic reports — sent to our own crash-reporting service hosted in the UK (a self-hosted Sentry-compatible service; the SDK comes from Sentry, but no data goes to Sentry’s servers). A report contains the error message and stack trace, performance timings, the screens visited leading up to the error, the app and operating-system versions, the device model, your user ID and username, your employer’s workspace name and your role, and your IP address at the time of the report. Reports are used only to find and fix faults. Customer records (client names, addresses, job notes, prices) are not included.
Push notifications — if you allow notifications, the app registers the device’s push token with your employer’s Stakkd environment so it can send job and approval alerts. The token is removed when you sign out.
Camera and photos — used only when you choose to attach a photo to a job, an expense or a site issue. Photos are resized and re-encoded before upload, which removes location and camera metadata. The app never reads your photo library in the background.
Face ID / Touch ID — handled entirely by the phone’s operating system; the app only learns whether the check passed. No biometric data is stored or sent anywhere.
Device integrity — the app checks for signs that the phone is jailbroken or rooted. If it finds any, it shows a warning and records a diagnostic report; it does not stop you using the app.
Working offline — your employer’s business data that you have access to is cached on the phone in encrypted storage so the app works without signal. It is removed when you sign out or delete the app.
No third-party analytics, advertising or tracking software runs in the app.
Payments made through Stakkd
When you pay an invoice that a business has sent you through Stakkd, you pay by card or by Pay by Bank. Card details are entered on a page run by Stripe and go to Stripe only, and Stakkd never receives or stores your full card number. With Pay by Bank you approve the payment in your own bank’s app, and Stakkd never sees your bank login or account details. On behalf of the business you are paying, Stakkd receives and stores a payment reference, the payment method, the amount, the date and the payment’s status, plus the card brand and the last four digits for a card payment.
The business you are paying is the controller of this data and Stakkd is its processor. Stripe is a separate controller for the data it uses to process the payment and prevent fraud, and its privacy policy is at stripe.com/gb/privacy. We keep payment records for as long as the business keeps its account with us, because businesses must keep financial records for tax purposes.
Accounting integrations (QuickBooks Online and Xero)
A business using Stakkd can connect its Stakkd account to its own QuickBooks Online or Xero company. Nothing is shared until an administrator on that Stakkd account signs in to the accounting provider and authorises the connection. Once connected:
Stakkd sends the business’s customers, invoices, credit notes and payments to the accounting software. This includes customer names, contact and address details, invoice lines, amounts and VAT.
Stakkd reads payments recorded in the accounting software and records them against the matching invoice in Stakkd.
The access tokens the provider issues are stored encrypted. For QuickBooks, Stakkd asks Intuit for accounting access only (the com.intuit.quickbooks.accounting scope).
Data received from Intuit or Xero is used only to run the sync for that business. We do not sell it, and we do not use it or share it for advertising or marketing.
The business can disconnect at any time, either from Settings in Stakkd or from inside QuickBooks or Xero. Disconnecting from Stakkd also removes Stakkd’s access at the provider. Records already copied to either system are not deleted.
For this data the business is the controller and Stakkd is its processor. Intuit and Xero are separate controllers for the data held in their own services, under their own privacy policies.
Marketing emails
We follow the Privacy and Electronic Communications Regulations (PECR). The marketing box on our forms is never ticked for you, and what we send depends on the type of business you tell us you are:
Individuals, sole traders and partnerships: we only send product news and offers if you tick the box to say yes, or if you are already a customer or have asked us about Stakkd and we are telling you about similar services of ours (you can say no at any time, including the first time we ask).
Limited companies and LLPs: we may send occasional product news to your work email because it is in our legitimate interests to do so, unless you tell us not to.
Every marketing email has an unsubscribe link. Unsubscribing takes effect straight away and does not stop emails about your enquiry, demo, account or billing.
We keep a record of when and how you said yes, including the wording you saw, so we can show it if asked. If you unsubscribe, we keep a record that you did, so we do not email you marketing again.
How long we keep it
Enquiries and demo requests: kept while we deal with them, then deleted no later than 12 months after our last contact with you.
Portal accounts: kept for the life of the customer relationship, then deleted within 12 months of the account closing (except records we must keep longer to meet legal or accounting obligations).
Crash and diagnostic reports from the mobile app: kept for up to 90 days, then deleted.
Push notification tokens: removed when you sign out of the app, or when the phone stops accepting notifications.
Aggregate analytics: contains no personal data and is kept indefinitely.
Your rights
Under UK GDPR you can ask us for access to, correction of, or deletion of your personal data; ask us to restrict or object to processing; and ask for a portable copy. Email [email protected] and we’ll act on it promptly.
If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office (ico.org.uk).
Changes to this policy
If we change this policy we’ll update this page and the effective date above. Material changes affecting portal customers will be flagged to account owners directly.