Privacy Policy

1. Who we are

Stacko is Canadian bookkeeping software for businesses run by one person. In this policy, "Stacko", "we", "us", and "our" refer to the operator of the Stacko services. "You" means the person or organization using Stacko.

If you use Stacko on behalf of a business, you represent that you are authorized to provide personal information and business records to us for that business.

2. Information we collect

Account information, such as email address, authentication identifiers, account status, preferences, feature flags, and support communications.

Receipt and expense information, including uploaded receipt images or PDFs, vendor names, dates, amounts, tax fields, payment methods, notes, categories, business/personal labels, file metadata, and derived OCR outputs.

Bank connection information, if you choose to connect a bank or card account through Plaid, including account name, type, subtype, masked account-number fragments, institution information, transaction dates, descriptions, amounts, pending or posted status, merchant or category information, account balances and credit limits as last reported by your bank, and connection metadata. We do not receive or store your online banking username or password.

Waitlist information, if you join the waitlist: your email address, the campaign or website that brought you to stacko.ca (such as UTM tags and the referring site), and a one-way hash of your IP address that we use to limit abuse.

Usage, device, and log information, such as pages viewed, the features you use and the buttons you select, browser and device type, IP address, approximate location inferred from IP address, the referring site, timestamps, error details, and security events.

Billing information if paid plans are enabled, such as plan, subscription status, payment processor customer IDs, invoices, and payment metadata. We do not intend to store full payment card numbers on Stacko systems.

Communications information, such as emails you send us, product feedback, support requests, survey responses, and messages related to account administration.

3. How we use information

To provide, secure, operate, troubleshoot, and improve Stacko.

To authenticate users, maintain sessions, enforce limits, provide support, and administer accounts.

To extract receipt data, categorize expenses, detect duplicates, calculate summaries, generate exports, and connect receipt data to tax-related insights.

To populate your transaction review inbox, match bank or card transactions to receipts, identify missing receipts, show the balances your connected accounts last reported and how they changed over time, and help you organize expense records. Stacko bank connections are read-only and are not used to initiate payments, transfer money, or move funds.

To understand how people find and use stacko.ca and the app, such as which pages are viewed, where the waitlist form is completed or abandoned, which features are used, and where errors happen, so we can fix problems and improve Stacko.

To monitor abuse, investigate security incidents, prevent fraud, enforce our Terms, and protect Stacko, users, and third parties.

To send service messages, account notices, security alerts, product updates, support communications, and, where permitted, marketing communications. You may opt out of marketing emails, but not essential service or security messages.

To comply with legal obligations, resolve disputes, and enforce agreements.

4. AI, OCR, and service providers

Stacko uses third-party service providers to operate the product, including infrastructure, authentication, storage, transactional email, hosting, analytics, error monitoring, payments, and AI/OCR processing.

Receipt images and related data may be sent to AI/OCR providers for the purpose of extracting structured receipt information. We do not permit providers to use your documents to train their general-purpose models where our provider settings or agreements allow us to restrict that use.

If you connect a bank or card account, Stacko uses Plaid as a bank-data provider. Plaid handles the bank connection flow, including any bank login or institution step-up verification. Stacko receives read-only account and transaction data from Plaid and stores provider access tokens server-side; those tokens are not exposed to the browser.

We use PostHog for website and product analytics and error reports. On stacko.ca and in the app, PostHog receives the pages you view, the features you use and the buttons you select, how quickly pages load, your browser and device type, approximate location inferred from your IP address, the referring site and campaign tags, and details of errors. In the app, analytics are tied to a random account identifier, not your name or email address. We do not send PostHog your receipts, transactions, amounts, merchant names, notes, or the email address you give the waitlist, and we do not record your screen.

Service providers may process information in Canada, the United States, or other jurisdictions. Information may be subject to the laws of the jurisdiction where it is processed.

5. Disclosure of information

We may disclose information to service providers who process it on our behalf and under contractual or technical restrictions.

We may disclose bank connection information to Plaid and related service providers as needed to connect, maintain, troubleshoot, or revoke bank connections you authorize. We do not sell bank data.

We may disclose information to your authorized users, administrators, accountants, bookkeepers, or collaborators if you choose to use sharing features when they are available.

We may disclose information to comply with law, court orders, valid legal process, regulatory requests, or to protect rights, safety, security, and property.

We may disclose information in connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, subject to appropriate confidentiality protections where practical.

We may disclose aggregated, de-identified, or anonymized information that does not reasonably identify you.

6. Your responsibilities

You are responsible for ensuring that you have the right to upload receipts, business records, personal information, and third-party information to Stacko.

You should not upload highly sensitive information unless it is necessary for your use of Stacko. Receipt images may contain personal information, employee information, payment fragments, addresses, or other details.

You are responsible for reviewing OCR outputs, categories, tax fields, and exports before relying on them.

7. Retention and deletion

We retain information for as long as reasonably necessary to provide Stacko, comply with legal obligations, resolve disputes, enforce agreements, maintain security, and support business operations.

Receipt and account data may remain in backups, logs, archives, and audit records for a limited period after deletion from active systems.

If you disconnect a bank connection, we revoke provider access where supported, delete the stored connection token, and stop future synchronization. Transactions already imported may remain in your Stacko account as financial records until you request their deletion or delete your account, subject to the retention limits described below.

You may request deletion or export of your account information by contacting us. We may need to retain certain information where required or permitted by law, including security, billing, tax, fraud-prevention, audit, or dispute records.

8. Security

We use administrative, technical, and organizational safeguards designed to protect information, including authenticated access controls, row-level database protections, provider security controls, and limited access practices.

No internet service is perfectly secure. You use Stacko with the understanding that security incidents, unauthorized access, data loss, or service interruptions may occur despite reasonable safeguards.

You are responsible for maintaining the security of your login credentials, devices, email account, and any third-party tools connected to Stacko.

9. Access, correction, and choices

You may access and update certain account and receipt information through Stacko.

You may request access, correction, deletion, or export by contacting us. We may need to verify your identity and may decline requests where permitted by law, including requests that affect another person's privacy, security, legal obligations, or legitimate business records.

You may unsubscribe from marketing emails by using the unsubscribe mechanism in those emails. We may still send transactional, security, and account-related messages.

10. Cookies and similar technologies

We may use cookies, local storage, session storage, and similar technologies to keep you signed in, remember preferences, operate security controls, measure product usage, debug issues, and improve the service.

stacko.ca and app.stacko.ca share a first-party analytics cookie set by PostHog. It lets us count visitors and see how people move from the website to the app. The website and app work without it.

Some browser settings may let you block or delete cookies and local storage. Blocking the analytics cookie stops this measurement. Blocking other cookies or local storage may affect authentication, saved drafts, preferences, and product functionality. You can also ask us to stop analytics for your account by contacting us.

11. Children

Stacko is not directed to children and is intended for business users. You may not use Stacko if you are under the age of majority in your province or territory unless a parent, guardian, or authorized business representative accepts responsibility for your use.

12. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be posted with a new effective date. Continued use of Stacko after an update means you accept the updated policy, to the extent permitted by law.

13. Contact

For privacy questions, access requests, correction requests, or complaints, contact us at support@stacko.ca.