1. What AIIStack processes

• Account details such as user ID, name, email address, avatar, and authentication/session records.
• Private workspace data such as memberships, watchlists, alerts, reports, invites, and integrations.
• Company claims, correction evidence, company requests, and communications you submit.
• Account-erasure request references, account IDs, receipt dates and withdrawal status.
• Billing customer/subscription identifiers, status, and event records; not complete card details.
• Allowlisted product events, security logs, request metadata, and provider/job health needed to operate the service.
• Public company/source material used to produce attributed market intelligence.

2. Why it is used

Data is used to authenticate users, isolate workspaces, deliver requested intelligence, administer subscriptions, prevent abuse, troubleshoot failures, measure product activation using minimized event properties, review corrections, and meet applicable obligations. Paid status is not used to change public rankings or editorial outcomes.

3. Service providers

AIIStack uses service providers for hosting, authentication/database operations, payments, email, rate-limiting, and configured AI processing. The current code has integration boundaries for Supabase, Stripe, Resend, Upstash, OpenAI, GitHub, and Hacker News/Algolia. A production processor list, locations, agreements, and international-transfer basis must be confirmed before launch. AIIStack does not sell private workspace data or payment details.

4. AI and source processing

Versioned AI visibility prompts and review-only enrichment can send prompts or source material to the configured AI provider. Private customer content must not be added to those flows unless a separate, reviewed tenant-isolation and data-use contract is implemented. Provider/model identifiers and bounded usage counters are retained for reproducibility and cost control.

5. Cookies and analytics

Essential cookies support authentication and security. Non-essential Google Analytics and advertising scripts are disabled in the current application because a consent manager has not been implemented. See the Cookie Policy for the current technical state.

6. Retention, security, and requests

Access controls, row-level security, bounded provider requests, and server-only secrets are used to protect data. No system is risk-free. A reviewed retention/deletion schedule, backup handling, and complete account deletion flow remain required before monetization. To request access, correction, or deletion, contact contact@aiistack.com. The response and rights available depend on applicable law and verified identity.

Signed-in users can also record or withdraw an erasure request in Account privacy. A recorded request awaits review; it does not immediately delete data or cancel a subscription.

7. Changes and contact

Material revisions should be published with a real revision date and notice where required. Questions can also be submitted through the contact page.