FullStak — Privacy Policy

Effective Date: October 29, 2026
Last Updated: October 29, 2026
Service Provider: FullStak
Website: https://fullstak.com
Privacy Contact: support@fullstak.com

1. Introduction

FullStak respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how FullStak ("FullStak," "we," "us," or "our") collects, uses, stores, discloses, and protects personal information when individuals and organizations access our websites, applications, products, platforms, and related services (collectively, the "Services").

This Policy applies to FullStak websites, including fullstak.com and fullstak.ai, and to applicable FullStak products, including FullStak Desktop, Workspace, Cloud, Code, AI, business applications, communications services, creative applications, and associated mobile and native applications.

Our Services may be offered through free, paid, business, professional, and product-specific subscriptions.

The information we process depends on the Services you use, the features you enable, your account settings, and the permissions you grant.

Our privacy principles are:

• Transparency about how information is collected and used.
• User control over authorized access and connected services.
• Separation of private Personal information from organization-controlled information.
• Responsible processing of information by AI systems and external providers.
• Reasonable safeguards against unauthorized access, misuse, and disclosure.
• Respect for applicable privacy rights.

This Policy should be read together with our Terms of Service and any applicable product-specific privacy disclosures.

2. Who Is Responsible for Your Information

The FullStak service provider and responsible contracting entity is:

FullStak
Doing business as FullStak, if applicable.

For information processed directly for our own business purposes, FullStak generally determines the purposes and means of processing.

When FullStak processes information on behalf of a Business or Professional organization, that organization may determine how its authorized users' business information is collected and used. In those circumstances, FullStak may act as a service provider or processor under applicable law and contractual agreements.

Individuals seeking to exercise rights relating to organization-controlled information may need to contact the relevant organization.

3. Information We Collect

We collect information directly from users, automatically through use of our Services, and from third parties or integrations authorized by users or organizations.

3.1 Account and Identity Information

We may collect:

• First and last name.
• Email address.
• Username and account identifiers.
• Telephone number.
• Authentication credentials and password verification information.
• Email verification status.
• Account recovery information.
• Subscription and account status.
• User preferences and account settings.
• Organization memberships and authorized roles.

We use this information to create accounts, authenticate users, manage subscriptions, prevent unauthorized access, and provide account support.

3.2 Organization and Business Information

When users create or join an organization, we may collect:

• Organization name and contact information.
• Business addresses and contact records.
• Team memberships and roles.
• Customer relationship management records.
• Projects, tasks, appointments, and business documents.
• Sales, support, billing, and operational information.
• Organization settings, integrations, and permissions.

Organizations and their authorized administrators may control access to information maintained within organization-managed workspaces.

3.3 Customer Content

Customer Content includes information users create, upload, store, transmit, or process through FullStak.

Examples include documents, spreadsheets, images, videos, audio recordings, source code, repositories, project files, databases, business records, communications, and AI conversations.

We process Customer Content to provide the features requested by users, subject to applicable permissions, account settings, agreements, and legal requirements.

FullStak does not acquire ownership of Customer Content merely because it is stored or processed through the Services.

3.4 Device and Technical Information

We may automatically collect:

• IP address.
• Device type and operating system.
• Browser type and version.
• Application version.
• Device and session identifiers.
• Login and authentication events.
• Error reports and diagnostic information.
• Feature usage and performance information.
• Security events and access logs.
• Approximate location derived from network information.

Where a feature requests more precise location information, we will provide applicable disclosures and permission controls.

3.5 Payment and Subscription Information

When users purchase paid Services, we may process:

• Subscription plan.
• Billing contact information.
• Billing address.
• Payment status.
• Transaction amounts and dates.
• Invoices and receipts.
• Subscription renewal and cancellation records.
• Payment method type and limited identifying details provided by payment processors.

Payment information may be processed by Stripe or other authorized payment providers.

[VERIFY: Confirm payment collection architecture, whether FullStak ever receives complete card details, and the actual payment processor disclosures.]

3.6 Support and Communications

We may collect information submitted through support requests, emails, service inquiries, feedback, customer communications, and authorized support sessions.

This information may be used to respond to requests, investigate issues, maintain service quality, and fulfill legal obligations.

4. Personal and Business Workspace Privacy

FullStak provides Personal workspaces and organization-managed workspaces.

These environments may have different ownership, access, and administrative controls.

4.1 Personal Workspaces

Personal workspaces are intended for the private use of their authorized account holders.

Joining a Business or Professional organization does not, by itself, authorize that organization's administrators to access information in a user's separate Personal workspace.

4.2 Organization Workspaces

Information stored in an organization-managed workspace may be accessible to authorized organization members, administrators, and other users according to applicable permissions.

Organization administrators may control memberships, business integrations, access policies, and organization-owned information.

4.3 Transfers Between Workspaces

Information should not be transferred from a private Personal workspace to an organization-controlled workspace without an authorized transfer process.

Users should review applicable ownership and access implications before transferring information.

[VERIFY: Confirm actual workspace provisioning, transfer behavior, administrator permissions, and separation guarantees before publication.]

5. Artificial Intelligence Services

FullStak offers AI-powered features that may include chat, document generation, analysis, coding assistance, automation, voice processing, and autonomous agents.

5.1 Information Processed by AI

Depending on the feature and permissions granted, AI systems may process:

• User prompts and instructions.
• Conversation history and relevant context.
• Uploaded files and documents.
• Source code and repository information.
• Authorized application data.
• Tool results and execution logs.
• Audio or speech inputs.
• Generated content and responses.

5.2 Third-Party AI Providers

Certain AI features may use external model providers.

When an external provider is selected or required, information necessary to perform the requested operation may be transmitted to that provider.

Provider processing, storage, retention, and model-training practices depend on the applicable provider, service configuration, and contractual terms.

[VERIFY: Publish the actual provider categories, routing controls, retention settings, and provider-training arrangements.]

5.3 AI Training and Product Improvement

FullStak may use diagnostic information, feedback, and other appropriately authorized information to evaluate and improve its Services.

Customer Content must not be described as excluded from model training unless the actual FullStak systems and third-party provider contracts enforce that restriction.

[DECISION REQUIRED: Establish whether customer prompts, files, source code, recordings, and outputs are excluded from model training by default, and whether any separate opt-in is offered.]

5.4 Autonomous Agents

When a user authorizes an AI agent to access applications, files, connected accounts, or development environments, FullStak may process the information required to execute the authorized Task.

Such processing may include source files, terminal output, screenshots, execution receipts, and permitted tool results.

Users should grant only the permissions necessary for the intended operation.

FullStak maintains responsibility for its own security and authorization controls.

5.5 AI Logs and Retention

AI conversations, execution records, diagnostic logs, and recovery information may be retained according to applicable service settings, operational requirements, and retention schedules.

[VERIFY: Actual retention periods, user deletion controls, provider retention and recovery-record exceptions.]

6. FullStak Code and Development Environments

FullStak Code may provide development workspaces, source editing, terminals, AI coding agents, application previews, build tools, and connected development devices.

To provide these features, FullStak may process:

• Source code and project files.
• Repository metadata.
• Build and test output.
• Terminal commands and execution results.
• Application logs.
• Development environment configuration.
• Screenshots and preview output.
• Authorized Git repository information.
• Task execution and approval records.

FullStak may use isolated infrastructure to execute authorized development operations.

Access to external repositories, computers, devices, and accounts depends on the permissions granted through the applicable integrations.

Development files and logs may contain personal or confidential information. Users should avoid placing unnecessary secrets or sensitive information in prompts, logs, or test fixtures.

7. Files, Cloud Storage, and Creative Applications

FullStak may store and process documents, spreadsheets, photographs, videos, audio, project files, and creative assets.

Processing may include previews, thumbnails, format conversion, editing, synchronization, search, sharing, backup, and recovery.

Where users enable file sharing, information may become accessible to recipients authorized by the applicable sharing mechanism.

Users are responsible for reviewing sharing permissions before distributing sensitive content.

FullStak may retain limited operational records relating to file access, changes, synchronization, and security.

[VERIFY: Public-link defaults, link expiration, recovery windows, backup retention, and access logging.]

8. Financial Account Data and Plaid Integrations

When users authorize financial account connections, FullStak may receive financial information through Plaid or another authorized financial data provider.

Depending on the connection and requested functionality, information may include:

• Financial institution and account names.
• Account types and identifiers.
• Partial or other authorized account numbers.
• Account balances.
• Transaction history.
• Transaction dates, amounts, and descriptions.
• Merchant information.
• Account categories.
• Loan, credit, investment, or other financial account metadata.

We use this information to provide requested features such as accounting, transaction synchronization, reconciliation, expense tracking, cash-flow reporting, and financial insights.

8.1 Authorization

Financial information is accessed through connections authorized by the user or an authorized organization representative.

The scope of information available depends on the financial institution, provider, connection permissions, and enabled features.

8.2 Financial Information Sharing

FullStak does not sell financial account data.

Financial information may be disclosed to authorized service providers where necessary to provide requested services, maintain security, prevent fraud, or comply with applicable law.

8.3 Disconnecting Accounts

Users may disconnect financial integrations through available FullStak controls or applicable provider mechanisms.

Disconnecting an account may stop future synchronization but may not immediately delete previously imported financial records.

Retention and deletion remain subject to applicable user requests, legal obligations, and operational requirements.

8.4 Plaid Privacy

Plaid independently processes certain information under its own privacy policies and applicable contractual arrangements.

Users may review Plaid's privacy information at https://plaid.com/legal.

[VERIFY: Actual enabled Plaid products, data fields, disconnect behavior, token handling, and deletion lifecycle.]

9. Communications, Voice, SMS, and PhoneFilter

FullStak may provide communications services, including VoIP, telephone features, SMS, call screening, AI receptionists, PhoneFilter, and related tools.

Depending on the feature, we may process:

• Telephone numbers.
• Caller and recipient identifiers.
• Call dates and durations.
• Routing and connection information.
• Call screening decisions.
• Voicemail.
• Audio recordings.
• Transcripts and AI-generated summaries.
• SMS messages and delivery records.
• Communications preferences and consent records.

9.1 Call Recording and Transcription

Where enabled, recording and transcription features may process the contents of communications.

Users are responsible for obtaining any notices and consents required by applicable law.

FullStak may provide recording controls and disclosures as part of the Services.

9.2 PhoneFilter

PhoneFilter may process incoming call information to identify, screen, classify, or route calls according to user settings.

AI screening may involve processing caller speech and related call information.

[VERIFY: Actual recording, transcript retention, caller notice, AI provider processing, and standalone PhoneFilter data flows.]

9.3 SMS

FullStak may use telephone numbers to send verification codes, transactional notices, account alerts, support responses, and service notifications.

Message frequency depends on account activity and enabled services. Message and data rates may apply.

Where supported, recipients may reply STOP to opt out or HELP for assistance.

SMS consent information is not sold or shared with third parties or affiliates for their independent marketing purposes.

Consent to receive service messages does not automatically constitute consent to unrelated promotional communications.

10. Cookies and Similar Technologies

FullStak may use cookies, local storage, and similar technologies to support:

• Authentication and session management.
• Security and fraud prevention.
• User preferences.
• Application functionality.
• Performance measurement.
• Analytics and service improvement.

Where required by law, FullStak will provide applicable notice and choices for nonessential tracking technologies.

[VERIFY: Actual analytics, advertising pixels, third-party cookies, consent mechanisms, and Global Privacy Control handling.]

11. How We Use Information

We process personal information for purposes including:

1. Providing and operating the Services.
2. Creating and managing accounts.
3. Authenticating users and securing access.
4. Storing and processing authorized Customer Content.
5. Providing AI, automation, development, and communications features.
6. Processing subscriptions, payments, and billing.
7. Providing customer support.
8. Detecting fraud, abuse, and security incidents.
9. Maintaining service reliability and diagnosing technical issues.
10. Improving products using information processed under applicable permissions and legal requirements.
11. Communicating important account and service changes.
12. Complying with applicable laws and legal obligations.

We will not use sensitive information for materially incompatible purposes without an appropriate legal basis, notice, or authorization.

12. When We Share Information

FullStak may disclose information to the following categories of recipients when appropriate:

12.1 Infrastructure and Service Providers

Providers supporting hosting, storage, networking, communications, payment processing, authentication, monitoring, customer support, and other operational functions.

12.2 AI Providers

Authorized AI model and infrastructure providers necessary to fulfill requested AI operations.

12.3 Financial Data Providers

Plaid, financial institutions, and related authorized providers supporting requested financial integrations.

12.4 Connected Applications

Third-party applications and services that users or organizations explicitly connect or authorize.

12.5 Organization Administrators

Authorized organization administrators and members, limited by applicable workspace permissions and organizational controls.

12.6 Legal and Security Purposes

Authorities or other parties where disclosure is required or permitted by law, necessary to respond to valid legal process, or reasonably necessary to address fraud, abuse, security threats, or protect legal rights.

12.7 Business Transactions

Parties involved in a merger, acquisition, restructuring, financing, or sale of business assets, subject to applicable confidentiality and legal obligations.

FullStak does not sell financial account data.

[VERIFY: Whether FullStak sells or shares any other personal information as those terms are defined by applicable privacy laws. If not, a broader no-sale/no-sharing commitment may be added.]

13. Information Security

FullStak uses administrative, technical, and organizational safeguards intended to protect information against unauthorized access, alteration, disclosure, and loss.

Depending on the Services, safeguards may include access controls, authentication, encrypted communications, tenant isolation, logging, monitoring, and restricted service permissions.

No internet-connected service can guarantee absolute security.

Users are responsible for protecting their credentials, configuring authorized access, and promptly reporting suspected account compromise.

FullStak will investigate and respond to security incidents in accordance with applicable legal and contractual requirements.

[VERIFY: Actual encryption-at-rest coverage, backup controls, administrator access, subprocessors, and incident-response commitments.]

14. Data Retention

We retain information for periods reasonably necessary to provide Services, fulfill authorized purposes, maintain security, resolve disputes, comply with legal obligations, and enforce agreements.

Retention may differ by category, including:

• Account and identity records.
• Customer files and documents.
• AI conversations and execution logs.
• Financial account information.
• Billing and tax records.
• Communications metadata and recordings.
• Security logs.
• Backups and disaster-recovery copies.

When information is no longer required, FullStak will delete, de-identify, or otherwise dispose of it according to applicable retention procedures and legal obligations.

[REQUIRED BEFORE PUBLICATION: Insert the actual retention period or retention criteria for each category, including backup deletion timing and account closure behavior.]

15. Data Access, Export, Correction, and Deletion

Depending on the Services and applicable law, users may be able to:

• Access information associated with their accounts.
• Correct inaccurate personal information.
• Export supported Customer Content.
• Delete selected information.
• Request account closure.
• Disconnect integrations.
• Manage communication preferences.
• Exercise applicable privacy rights.

Requests may be submitted to:

support@fullstak.com

We may need to verify the requester's identity and authority before processing a request.

Certain information may be retained where required or permitted by law, including for security, fraud prevention, legal claims, or financial recordkeeping.

Organization-managed information may be subject to the organization's instructions and applicable agreements.

16. Your Privacy Rights and Choices

16.1 Access to Personal Information

Depending on your location and applicable law, you may have the right to request information about the personal information FullStak collects, uses, discloses, or retains.

You may also have the right to obtain a copy of certain personal information associated with your account.

FullStak will respond to verified requests within the timeframes required by applicable law.

16.2 Correction of Personal Information

You may request correction of inaccurate personal information maintained by FullStak.

Certain account information may be updated directly through your account settings.

Where information cannot be corrected through the application, you may contact FullStak using the contact information provided in this Policy.

16.3 Deletion of Personal Information

You may request deletion of personal information, subject to applicable legal exceptions.

FullStak may retain information where reasonably necessary to:

• Complete transactions or provide requested services;
• Comply with legal, tax, accounting, or regulatory obligations;
• Detect or prevent fraud and security incidents;
• Resolve disputes or enforce agreements;
• Maintain records required by applicable law; or
• Exercise other rights permitted by law.

Deletion of an account may result in the loss of access to associated files, applications, subscriptions, and stored information.

Information retained in backups may remain until the applicable backup-retention period expires, subject to legal and operational requirements.

16.4 Data Portability

Where required by applicable law, you may request a portable copy of eligible personal information.

FullStak may also provide application-specific export tools for documents, files, contacts, financial records, or other supported data.

The availability and format of exports may vary by Service.

16.5 Opting Out of Certain Data Processing

Depending on applicable law and FullStak's actual processing practices, you may have rights to opt out of:

• Sale of personal information;
• Sharing of personal information for cross-context behavioral advertising;
• Processing for certain targeted advertising;
• Certain forms of profiling or automated decision-making; or
• Other processing activities subject to statutory opt-out rights.

[Operational verification required: Determine whether FullStak engages in any processing classified as a sale, sharing, targeted advertising, or regulated profiling. Provide the legally required opt-out mechanisms and disclosures where applicable.]

16.6 Sensitive Personal Information

FullStak may process information considered sensitive under applicable privacy laws, including certain financial information, authentication credentials, precise location information, communications content, or other protected categories, depending on the features a user enables.

Where applicable law grants rights to limit certain uses or disclosures of sensitive personal information, FullStak will provide the required notices and mechanisms.

FullStak will not use sensitive personal information for purposes incompatible with applicable legal requirements.

16.7 Authorized Agents

Where permitted by applicable law, you may designate an authorized agent to submit privacy requests on your behalf.

FullStak may request appropriate verification of the agent's authority and the identity of the individual whose information is involved.

16.8 Appeals and Complaints

Where applicable law provides a right to appeal a privacy-request decision, FullStak will provide an appropriate appeal process.

You may also have the right to contact a relevant privacy or data-protection regulator.

16.9 Exercising Your Rights

Privacy requests may be submitted to:

support@fullstak.com

FullStak may need to verify your identity before fulfilling certain requests.

We will not discriminate against individuals for exercising privacy rights protected by applicable law.

17. California Privacy Rights

This Section supplements the rest of this Privacy Policy for California residents to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), applies to FullStak and the relevant processing.

17.1 Categories of Personal Information

Depending on the Services used, FullStak may collect the following categories of personal information:

The actual categories collected depend on the Services and integrations used.

17.2 Sources of Personal Information

FullStak may obtain information:

• Directly from users;
• From organizations administering authorized workspaces;
• From connected applications and financial institutions;
• From communications and payment service providers;
• Automatically through use of the Services; and
• From other sources authorized by the user or permitted by law.

17.3 Purposes of Collection and Use

FullStak processes personal information for the purposes described throughout this Policy, including account administration, service delivery, security, communications, billing, customer support, analytics, and user-authorized integrations.

17.4 Disclosure of Personal Information

FullStak may disclose personal information to service providers, contractors, authorized integrations, payment processors, telecommunications providers, and other recipients described in this Policy.

[Before publication: Complete a verified category-by-recipient disclosure matrix covering the applicable preceding 12-month period.]

17.5 Sale and Sharing

[Required factual disclosure: State whether FullStak has sold personal information or shared personal information for cross-context behavioral advertising during the applicable reporting period. Do not publish a categorical denial without verifying analytics, advertising, SDK, and third-party data flows.]

Where required, FullStak will provide a "Do Not Sell or Share My Personal Information" mechanism and honor applicable opt-out preference signals.

17.6 Retention

FullStak retains categories of personal information for the periods reasonably necessary to fulfill disclosed purposes, subject to applicable legal obligations.

[Before publication: Add category-specific retention periods or the criteria used to determine them, based on actual retention schedules.]

17.7 California Consumer Requests

California residents may exercise applicable rights to know, access, correct, delete, opt out, and limit certain uses of sensitive personal information.

FullStak will verify and respond to requests as required by law.

18. International Users and Data Transfers

18.1 Global Availability

FullStak may be accessed by individuals and organizations in different countries.

Privacy and data-protection requirements may vary depending on the user's location and the nature of the Services.

18.2 Processing Locations

Personal information may be processed in the United States and other countries where FullStak or its authorized service providers operate.

[Verify actual hosting regions, backup locations, subprocessors, and international data flows before publication.]

18.3 International Transfer Safeguards

Where applicable law requires specific safeguards for international transfers, FullStak will implement an appropriate lawful transfer mechanism.

Such mechanisms may include contractual protections, adequacy arrangements, or other safeguards recognized under applicable law.

18.4 European Economic Area, United Kingdom, and Switzerland

Where the GDPR, UK GDPR, or comparable laws apply, individuals may have additional rights relating to personal information, including rights of access, rectification, erasure, restriction, portability, objection, and certain automated decisions.

FullStak's lawful bases for processing may include performance of a contract, compliance with legal obligations, legitimate interests, consent, or other grounds recognized by applicable law, depending on the processing activity.

[Before publication: Verify GDPR applicability, processing-specific lawful bases, controller/processor roles, international transfer mechanisms, and whether an EU or UK representative is required.]

18.5 Supervisory Authority Complaints

Where applicable law provides this right, individuals may lodge complaints with the relevant data-protection supervisory authority.

19. Children's Privacy

19.1 Age Eligibility

FullStak's general Services are intended for individuals who meet the minimum age requirements specified in the applicable Terms of Service.

[Confirm the intended minimum age and whether FullStak offers any products directed to minors.]

19.2 Children Under 13

FullStak does not intend to knowingly collect personal information from children under 13 through general-audience Services without any legally required parental consent or other applicable authorization.

If FullStak learns that personal information was collected from a child in violation of applicable law, it will take appropriate steps to address the collection and delete the information where required.

19.3 Parents and Guardians

Parents or guardians who believe a child has provided personal information improperly may contact:

support@fullstak.com

FullStak may request information reasonably necessary to verify the request and respond in accordance with applicable law.

19.4 Educational and Youth Services

If FullStak offers educational, family, or youth-oriented Services in the future, additional privacy notices and consent requirements may apply.

Such features will be subject to applicable children's privacy and education laws.

20. Security Incidents and Data Breaches

20.1 Security Practices

FullStak uses administrative, technical, and organizational measures intended to protect personal information against unauthorized access, disclosure, alteration, and destruction.

These measures may include, where implemented and appropriate:

• Authentication and authorization controls;
• Encryption in transit and at rest;
• Network and application isolation;
• Access logging and monitoring;
• Backup and recovery procedures;
• Security testing and vulnerability management;
• Restricted administrative access; and
• Incident detection and response procedures.

No internet-connected service can guarantee absolute security.

20.2 Security Incidents

If FullStak identifies a security incident affecting personal information, it will investigate and respond in accordance with applicable law and contractual commitments.

20.3 Breach Notifications

Where notification is legally required, FullStak will notify affected individuals, organizations, or regulators within applicable timeframes.

Notification methods may include email, in-product messages, written notices, or other legally permitted methods.

20.4 User Responsibilities

Users should protect their account credentials, enable available security features, maintain secure devices, and promptly report suspected unauthorized activity.

20.5 Reporting Security Concerns

Suspected security vulnerabilities or unauthorized account access may be reported to:

[Verified security contact address]

[Before publication: Confirm the security contact, incident-response ownership, and whether a vulnerability-disclosure policy is available.]

21. Third-Party Websites and Services

FullStak may contain links to third-party websites, applications, integrations, and services.

Third parties may collect or process personal information under their own privacy policies.

FullStak is not responsible for independent third-party privacy practices, except to the extent FullStak has obligations concerning its selection, integration, disclosure, or processing of personal information through those providers.

Users should review the privacy notices of external services before authorizing connections or submitting information.

22. Changes to This Privacy Policy

22.1 Policy Updates

FullStak may update this Privacy Policy to reflect changes in its Services, data practices, technologies, legal obligations, or business operations.

22.2 Notice of Material Changes

Where required by law, FullStak will provide appropriate notice before material changes take effect.

Notice may be provided through the website, account email, in-product notifications, or another legally permitted method.

22.3 Consent for New Processing

Where applicable law requires consent for a new processing purpose, FullStak will obtain the necessary consent before beginning that processing.

22.4 Previous Versions

FullStak may retain prior versions of this Privacy Policy to document historical disclosures and support compliance obligations.

22.5 Effective Date

The effective date and last-updated date will appear at the beginning of the published Policy.

The date must reflect the actual approved version, rather than a historical placeholder.

23. Contact Information

For questions, requests, or concerns about this Privacy Policy or FullStak's handling of personal information, contact:

FullStak Privacy Team

Email: support@fullstak.com

Website: https://fullstak.com

Legal entity: FullStak

Mailing address: [Verified business mailing address]

Privacy officer or designated contact: [If applicable]

EU/UK representative: [If legally required]

Data Protection Officer: [If legally required]

FullStak will respond to privacy inquiries in accordance with applicable law.

24. Privacy Policy Acceptance and Relationship to Other Agreements

24.1 Relationship to Terms of Service

This Privacy Policy describes FullStak's personal information practices.

The FullStak Terms of Service govern contractual use of the Services.

Additional product-specific privacy notices or data-processing agreements may apply to particular Services.

24.2 Business and Organization Accounts

When FullStak processes personal information on behalf of a Business or Enterprise customer, the organization may act as the data controller or business responsible for determining the purposes and means of processing.

FullStak may act as a service provider or processor, depending on the applicable arrangement.

The organization's own privacy practices and notices may also govern its collection and use of personal information.

24.3 User Choices and Permissions

Users may grant permissions to connect applications, access files, process communications, use AI features, or synchronize external accounts.

Such permissions govern the applicable feature to the extent described in the interface and this Policy.

Providing a permission does not waive statutory privacy rights.

24.4 Policy Acknowledgment

FullStak may record acknowledgment of the applicable Privacy Policy version as part of account registration or other consent processes.

Where specific consent is legally required, FullStak will request that consent separately from general acknowledgment of this Policy.

Effective Date: October 29, 2026

Last Updated: October 29, 2026

Version: 2026-10-29