Privacy Policy
Last updated: 28 October 2026
This Privacy Policy explains how Smallstacks LLC, a Tennessee limited liability company (“Smallstacks,” “we,” “us,” or “our”), collects, uses, and shares information when you visit smallstacks.net (the “Site”) or use our websites, the Stacks AI chat assistant, Stacks Ads, Stacks Academy or the AI agents we build (the “Services”). By using the Site or Services, you agree to this Policy.
Information we collect
Information you give us
When you submit our request form or contact us, we collect your name, email address, business name, and any details you share about your business and the website you want. If you fill in one of our forms on Facebook or Instagram (a Meta lead form), we receive what you typed in it, such as your name, email address, phone number, business name and type, city, and how you would like to be contacted; the same goes for messages you send us there. If you become a customer, we collect the information needed to build and run your site — such as content, images, hours, and services — and your billing details.
Businesses we contact
To offer businesses a free website mockup or our other products, we look up businesses in public sources: Google Maps listings, a business’s own website and its public Facebook page. From them we note the business name, its public phone number and email address, its city, its website address, and public facts about the business such as its services, hours and when its page last posted. We do not look for, or keep, information about people’s private lives. We may use these details to make a draft website for the business, kept at an unlisted address that search engines are told not to show, and to contact the business about it by phone, email or message.
Every email we send to a business we found this way has a one-click link to stop hearing from us; you can also just reply or email us. When you opt out we keep only a scrambled code (a hash) of your email address, so we can skip it in future without keeping the address itself, and we delete the draft website for your business if you ask.
Payment information
Payments are processed by our payment provider, Stripe. We do not store your full card number; Stripe handles card data under its own security standards and privacy policy.
The Stacks AI chat assistant
Stacks AI is a chat assistant a business can add to its own website. When a business switches it on, we process information about that business’s visitors on its behalf — the business decides to run the assistant and what it knows; we run it.
For each conversation we store the messages the visitor types, the replies the assistant gives, the address of the site it happened on, and the times. We do not store the visitor’s IP address: to stop one person using up a business’s daily message allowance we store a one-way hash of it instead, which cannot be turned back into an address.
If the business has the “Leave your number” button switched on and a visitor chooses to use it, we store the name and the phone number or email address they type, any note they add, and which conversation it came from, so the business can ring them back. It is never pre-filled and never required in order to use the chat. Businesses can switch the button off in their dashboard.
To write a reply, the visitor’s message and the information the business has given the assistant are sent to Anthropic, which provides the underlying model and processes it to return an answer.
When a business sets up its assistant, we can draft what it knows by reading the business’s own website, pages and photos it gives us, its answers to our questions, and a short search of the public web about the business. That material is sent to Anthropic to write the draft, which the business reads and edits before anything is used.
A business that uses Stacks AI on its own website should say so in its own privacy policy, since its visitors’ data is its responsibility as well as ours.
Stacks Ads
If you use Stacks Ads, we store the business details you give us (such as your business name, town, services, customers, phone number, website address and colors), your logo, the text of your website’s homepage, which we read to write your ads, and the ads made for you with their words. To write the ads and your setup guide, your business details and that website text are sent to Anthropic; to make the photographs, a short description of each picture is sent to Cloudflare Workers AI. Your logo is sent to neither: image ads are put together in your own browser.
If you try Stacks Ads for free on ads.smallstacks.net without an account, we keep the three sample ads made for you (their words and photographs, with the business name and website you typed) for 30 days, so a private link can show them again. If you ask us to email them, we also keep your email address and when you agreed, send you that link once and one follow-up the next day, and then nothing more; the address goes to our email provider (Resend) to send them, and the whole record is deleted after 30 days.
Video ads with moving footage, a voiceover and music are made on our own computer, run by Smallstacks: it receives the ad’s photographs, words and narration, and the details shown on the closing card (your business name, phone number, website address, logo and colors), and the footage, voice and music are made by AI models running on that computer, not sent to another company. The finished video is stored with your other ads. Your choices for videos (length, sound on or off, and the voice) are stored with your account.
The logo, photographs and videos are kept at long, unguessable web addresses so your browser can show and download your ads, and all of it is deleted when you delete your account.
The Stacks Ads Helper Chrome extension
Stacks Ads Helper is our Chrome extension for Stacks Ads customers. You sign in to it with your Smallstacks account; it keeps your sign-in, your business details, your newest ads and their pictures in your own browser (Chrome’s storage for the extension), and signing out deletes them there. It never sees or keeps your password after signing in, and it does not track your browsing, show ads, or sell or share anything.
It only works on a page when you press Fill this page, and only on the sites you allow it on (such as Facebook, Instagram, Google and other ad and listing sites). To decide which of your details goes in which box, it sends us the page’s title, the headings of its form, the labels of its boxes and buttons, and the choices in its dropdowns, never what you or anyone else typed into them, together with your own business details and ad words. These are read by an AI model running on our own computer, not sent to another company, and are deleted as soon as the answer is sent back (and in any case within an hour). It never reads password, payment, budget or legal boxes or who sees an ad (audiences, places and locations), never fills messages or comments, and never presses publish, post, submit or pay buttons. It never puts your ad picture into a profile picture, cover photo or logo.
Online booking and payments on the websites we run
A business whose website we run can take bookings and payments on it. When someone books, we store what they booked and when, the name they give, the email address and/or phone number they give, any note they add, whether it was booked on the website, through the business’s chat assistant or by the business itself, and whether it has been paid. We use it to hold the time, to email the customer their confirmation and a reminder before the booking (from us, with replies going to the business), and to tell the business — and the member of its team the booking is with, if the business gave us their email. Each confirmation carries a private link the customer can use to move or cancel the booking; the link is only in their email and is not stored by us. As with the chat assistant, we do this on the business’s behalf: the customer is the business’s customer.
Payments are taken by Stripe on the business’s own Stripe account. The card details go to Stripe and never reach us; we see only what Stripe tells the business — the amount, the date, the name or email on the payment and whether it was refunded — so the business can see it in its Smallstacks account.
If a business connects its Google or Outlook calendar so its website does not offer times it is busy, we read only when it is busy. The titles, places and guests of its own events are not stored. A business can also subscribe to its bookings from its own calendar app through a private link; anyone the business shares that link with can see its bookings, so the business is told to keep it to itself.
Bookings stay with the business’s website for as long as we run it for them, and are deleted with it. A business can download them from its account at any time.
Stacks Academy
Stacks Academy, at academy.smallstacks.net, is our course on using AI assistants at work. The free lesson opens for anyone. For the rest you sign in with your Smallstacks account: your email address and password go from your browser straight to our accounts service, so the Academy never sees your password, and it keeps no email address.
For each person who signs in, the Academy keeps the ID of their Smallstacks account, the name on that account (copied again at each sign-in), the team they are in and whether they manage it, and which lessons they have finished and when. Your answers to a lesson’s questions are not kept: they are marked and shown back to you, and the lesson is recorded as finished when every answer is right. To stop guessing, it counts your tries at a lesson’s questions: after two in a row that are not all right, the next opens 5 minutes later. It keeps the count and the time of your last try, never your answers, and clears them when every answer is right. To stop people guessing team codes, the Academy counts wrong codes for 15 minutes; the codes typed are not kept.
If you are in a team, its manager can see your name, whether you manage the team, and which lessons you have finished and when. Your manager does not see your answers, or anything you paste into the agent desk. Smallstacks can see each team’s name, its codes and how many of its seats are in use, so we can set teams up and look after them.
Finish every lesson and you get a certificate of completion, with a random number that cannot be guessed. We keep the number, the name your account had on the day you earned it, that day, and how many lessons the course had. Anyone who has the number can check the certificate at academy.smallstacks.net/certificate: that page shows the name, the day and the number of lessons, and nothing else about you. The Academy’s pages tell search engines not to list them.
Seats are bought at academy.smallstacks.net/buy and paid on Stripe’s own checkout page, so your card details go to Stripe and never reach us. For each purchase we keep the Smallstacks account that paid, the number of seats, the team name you typed, the amount charged, Stripe’s reference for the payment, and whether it was later refunded or disputed. We email ourselves about each sale, with your name, email address, the seats, the amount and the team name. The Academy keeps which team your seats went to and how many.
The Academy sets two cookies of its own. academy_tool remembers which AI assistant you picked, for a year, and holds nothing about you. Once you sign in, academy_session keeps you signed in for two weeks: it holds a random value, of which we keep only a scrambled code (a hash), and signing out deletes it. Signing in there also sets the small marker that tells our other pages you are signed in, and our accounts service keeps its own sign-in cookie, as it does for every product. The Academy’s pages load nothing from other companies: no Google tag and no Meta Pixel.
The agent desk
A team can have AI agents on the Academy’s agent desk. Each one does one job and only writes drafts: someone in the team pastes in the thing to work on, such as a customer’s message, the notes from a meeting or a list of unpaid invoices, and reads the draft. An agent cannot send, book, pay for or change anything.
When we set up an agent for a team, we store its name, the material the team gives it to draw on (such as its own answers, price list, past proposals or handbook), what it must leave to a person, what it must never do, and how many runs it may make a month. Everyone in the team can read that material on the agent’s page. It is kept until we delete the agent.
Each time someone runs an agent, what they paste in and the agent’s saved material are sent to Anthropic, whose model, Claude, writes the draft. We do not store what was pasted or the draft, and neither is written to our logs: the draft is shown on the page and nowhere else. We keep a count instead: which agent ran, who ran it and when, so each agent stays within its monthly limit. What a team pastes in is often about other people, such as its customers, staff or job applicants; we handle it on the business’s behalf, and the business decides what to paste. Leave out passwords, card numbers and anything your company says must not be shared.
AI agents and the free agent plan
If you ask for a free agent plan on agents.smallstacks.net, we keep what you type: your name, email address, business name, phone number if you give one, the job you picked and what you tell us about it, and that it came from that page. To stop the form being flooded, we also keep a scrambled code (a hash) made from your internet address, never the address itself, and the description your browser gives of itself (its name and version). The request joins our queue of website requests. We email ourselves a copy, and send you one email (through Resend) to say we have it; nothing more is sent to you automatically. You can ask us to delete your request at any time.
To write your plan we look at how the job is done today. An agent we build gets only the access its job needs, which you grant through your own accounts and can take away, and each plan names the AI service the agent uses and what is sent to it. An agent set up on the Academy’s agent desk keeps only what is described above under The agent desk.
Information collected automatically
Like most websites, our hosting provider (Cloudflare) automatically logs basic technical data such as IP address, browser type, pages viewed, and timestamps to keep the Site secure and reliable. We also keep our own daily counts of how many times each page on the Site was loaded and how many times our request form was started and sent, and of the kind of place visits began (for example a search engine, an ad, a business directory or a link on another site; the address itself is not kept). These are totals only: they use no cookies and record nothing about who you are.
Advertising
We advertise Smallstacks through Google Ads. Our public pages load Google’s tag (gtag.js), which tells us when someone who clicked one of our ads goes on to request a website. Google may set cookies and receive your IP address, the page address you are on, and your browser details; Google acts as our processor for measurement and may also use this data for its own advertising purposes under its own terms. We do not send Google your name, email address, phone number or anything you type into our forms.
We also advertise on Facebook and Instagram. When we have it switched on, our public pages load the Meta Pixel, which tells us when someone who saw or clicked one of our ads goes on to request a website, try Stacks Ads for free or start a Stacks Ads subscription. Meta may set cookies and receive your IP address, the page address you are on, and your browser details, and may link this to your Facebook or Instagram account under its own terms. We do not send Meta your name, email address, phone number or anything you type into our forms.
Pages that can contain a private link — the password reset page and the email confirmation page — are deliberately not tagged, so those links are never reported to anyone. Your signed-in account pages are not tagged either.
You can opt out of Google’s advertising personalisation at adssettings.google.com and of Meta’s in your Facebook or Instagram ad preferences, and any browser-level ad or cookie blocker will stop the tags loading at all. Nothing on this Site stops working if you block it.
Cookies
We use the essential cookies needed to run the Site and to keep you signed in to your account. In addition, the Google Ads tag and the Meta Pixel described under Advertising above may set their own cookies on our public pages to measure whether an ad led to a request. We do not use cookies to build a profile of you for anyone else, and we do not sell your data. Stacks Academy sets two cookies of its own, described under Stacks Academy above, and its pages load neither the Google tag nor the Meta Pixel.
How we use information
- To respond to your requests and prepare a quote or preview
- To find businesses that may want a website or our other products, make them a free draft, and contact them about it
- To design, build, host, and maintain your website and AI tools
- To process payments and manage your subscription
- To send service-related messages (updates, renewals, support)
- To secure, maintain, and improve the Site and Services
- To comply with our legal obligations
- To run Stacks Academy for you and your team: sign-in, progress, certificates and seats
- To write your free agent plan, and to build the agents you order
How we share information
We do not sell your personal information. We share it only with service providers who help us run the business, including:
- Stripe — payment processing, including Stacks Academy seats and payments a business takes on its own Stripe account through the website we run for it
- Web3Forms — delivering form submissions to our email
- Cloudflare — website hosting, security, and content delivery, and Workers AI, which makes the photographs for Stacks Ads
- Anthropic — the model behind the Stacks AI chat assistant, which receives visitors’ messages in order to answer them, behind the drafts of what an assistant knows, behind the words Stacks Ads writes, and behind the Stacks Academy agent desk, which receives what a person pastes in
- Resend — sending our email, such as password resets, sign-in confirmations, notices that someone left their number in a chat, and the note confirming an agent plan request
- Twilio — sending text messages, only to a mobile number you added and confirmed with a code, and only if you switched text alerts on
- Meta (Facebook and Instagram) — the lead forms and messages you send us there, and the Meta Pixel measurement described under Advertising, which Meta also handles under its own privacy policy
- Google — the Google Maps listings we use to find businesses to offer a mockup to, and the Google Ads measurement described under Advertising
- Domain registrars — to register or connect your domain (which you own)
We may also disclose information if required by law or to protect our rights, our users, or the public.
Visit counts on the websites we run
For the monthly report we send each website client, the sites we build count page views, visits and contact-form submissions with a small script. It sets no cookies and keeps no internet addresses. To count a visitor once a day, it makes a code from their connection with a secret that changes every day, so one day cannot be linked to the next, and it deletes that code after two days. What is kept is only totals: views per day and per page, and how many forms were sent. It does nothing if the browser asks not to be tracked.
Data retention
We keep your information for as long as needed to provide the Services and for legitimate business or legal purposes. You can ask us to delete your information at any time (see “Your rights”).
Some of it is deleted automatically on a schedule rather than on request. Chat transcripts are removed after one year, and contact details a visitor left through the chat after two years — longer, because a name and a number is a business record rather than a passing conversation. Usage history is kept for two years, and the drafts our setup research produces are cleared a month after they are collected. When an account is deleted, everything belonging to its assistants goes with it, including any contact details visitors had left.
One thing is kept after an account is deleted: when a free trial is started, we record the website it was started for (its domain name, such as example.com) and the fingerprint our payment processor, Stripe, gives the card — a code that is the same each time the same card is used, but is not the card number and cannot be charged. That is how each website and each card gets one trial. Deleting your account removes your details from that record but keeps the domain name and the card fingerprint. To stop one person starting trial after trial, we also keep a scrambled code (a hash) made from the internet address a trial was started from — never the address itself — and delete it after 30 days.
Deleting your Smallstacks account does not remove your Stacks Academy record yet. Until it does, email hello@smallstacks.net and we will delete it for you: your name, your place in a team, the lessons you finished, your certificate (its check page then no longer finds it) and your sign-ins. The record of a seat purchase stays in our books, with your account detached from it.
Security
We use reasonable administrative and technical safeguards to protect your information. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.
Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, email us at hello@smallstacks.net. If you are in the EEA/UK (GDPR) or California (CCPA/CPRA), additional rights may apply, and we honor applicable requests.
Children’s privacy
Our Services are intended for businesses and are not directed to anyone under 18. You must be 18 or older to create an account. We do not knowingly collect information from children.
International users
We operate from Tennessee, United States. If you access the Services from elsewhere, your information may be processed in countries whose data-protection laws differ from your own.
Changes to this Policy
We may update this Policy from time to time. We will post the updated version here with a new “Last updated” date.
Contact us
Questions about this Policy? Email hello@smallstacks.net or call (901) 446-7345.