Privacy policy

Last updated: 25 October 2026

The short version: reading this site needs no account, we tell you exactly what runs in your browser, and you can switch measurement off at any time from Your Privacy Choices in the footer of every page.

1. Who we are

Stackdrop (“Stackdrop”, “we”, “us”) builds the internal software companies run on: internal tools, AI in production, workflow automation and systems of record. This policy explains how we handle personal data when you visit stackdrop.co (the “Website”), contact us, subscribe to our newsletter, or work with us as a client, partner or supplier.

For that data, Stackdrop is the data controller under the EU General Data Protection Regulation (“GDPR”) and Greek Law 4624/2019.

2. Scope of this policy

This policy covers personal data about:

• Website visitors who read our pages, blog and customer stories.
• People who contact us through a form, by email or by phone, and newsletter subscribers.
• Client and partner contacts, meaning the people who scope, sign, manage or pay for an engagement with us, including people who join calls with us.
• Job applicants who apply through careers.stackdrop.co or contact us about a role.
• Suppliers, meaning the people we deal with when buying goods or services.

When we act as a processor.In a discovery sprint, build engagement, embedded engineering or governance retainer, we may access personal data held in a client’s own systems (for example SAP, Salesforce, Snowflake or Retool apps). We handle that data only on the client’s instructions, as a processor under our Data Processing Agreement. The client is the controller and its own privacy notice applies. If you are an employee or customer of one of our clients, please send privacy requests to that client.

What this policy does not cover. Our products meetso.ai and bringboard.com have their own privacy policies for their users. Third-party websites we link to are governed by their own policies.

3. Personal data we collect

Reading the Website requires no account. We collect business-related data only, and we ask that you do not send us special categories of data (such as health or political opinions).

3.1 Data you give us

3.2 Data collected automatically while you browse

Five things process data while you browse:

• Hosting. Vercel processes technical request data (IP address, user agent, requested URL) to serve pages and protect against abuse.
• Performance measurement. Vercel Speed Insights collects anonymous page-timing metrics (Core Web Vitals). It sets no cookies.
• Error monitoring. When a page breaks, Sentry receives the error, the URL and browser metadata so we can fix it. Cookies and identifying headers are stripped before the report is sent.
• Session replay.While analytics consent is granted (section 5), PostHog records how a visit moves through the site: pages, scrolling, clicks and the shape of the page, so we can see where the site is confusing. Everything you type into a form is masked before it leaves your browser, and the confirmation that echoes your details back is masked too. The recording carries no name, account or cookie; it lives in your browser’s session storage and is forgotten when the tab closes. Nothing is recorded in the admin, and nothing is recorded on the invoice verification page.
• Analytics and advertising measurement. Google Analytics 4, loaded through Google Tag Manager, and the LinkedIn Insight Tag for our LinkedIn campaigns. Your consent choice governs these (section 5).

We also read the country code our host derives from your IP address, only to apply the right consent rules (section 5.3).

3.3 Data from other sources

• Your organisation or colleagues, when they name you as a contact on an engagement.
• Partners and referrers who introduce you to us.
• Google and LinkedIn, which report aggregated campaign performance to us.
• Public professional sources, such as company websites and LinkedIn profiles, which we use to find and verify the work contact details of prospective clients. We do not buy contact data from data brokers or list providers.

4. How we use personal data and our legal bases

We use personal data only where Article 6 GDPR gives us a legal basis. Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for that assessment.

You can withdraw consent at any time, without affecting processing that happened before.

5. Cookies, local storage and consent

5.1 What we store in your browser

Strictly necessary. These two are set regardless of your choice, because they make the choice work:

Measurement and advertising. Set by Google once the matching consent signal is granted:

The Google lifetimes are Google’s own defaults. The LinkedIn Insight Tag sets its own cookies under linkedin.com while advertising consent is in place; LinkedIn documents them in its own cookie policy.

Your light or dark theme preference is not a cookie. It lives in your browser’s local storage under the key theme and is never sent to a server.

Session replay (section 3.2) sets no cookie. While analytics consent is granted it keeps a random session identifier in your browser’s session storage, which the browser clears when the tab closes.

5.2 How consent works where you are

Google Tag Manager loads for every visitor. What changes by region is what its tags may do, set through four Google Consent Mode signals: analytics storage, ad storage, ad user data and ad personalization.

• EEA, UK and Switzerland.All four start denied. Nothing is stored on your device and no identifiers are collected until you accept. Google’s tags still send cookieless pings with no identifiers, which show us aggregate campaign performance without tracking you.
• Everywhere else. All four start granted, so measurement and advertising cookies are set on your first page view. The banner says so plainly, and opting out takes one tap.

If we cannot tell where you are, we apply the stricter EEA rules. Accepting grants all four signals; declining or opting out denies all four. There is no hidden middle setting.

5.3 How we know which rules apply

Before the page is served, we read the country code our host derives from your IP address and store only that two-letter code in sd_country. We never store or log the IP address for this purpose, and never send it to a third-party geolocation service.

5.4 Change or withdraw your choice

Your Privacy Choices, in the footer of every page, reopens the banner with your current choice selected. Withdrawing consent:

• denies all four signals, so no further data is collected; and
• deletes the Google analytics and advertising cookies already on this browser (_ga, _ga_*, _gid, _gcl_*), because denying a signal alone does not remove what is already stored.

Withdrawing is exactly as easy as consenting. We remember your choice for 180 days, then ask again, and we also ask again if what we are asking about changes.

5.5 Global Privacy Control

If your browser or extension sends Global Privacy Control (GPC), we deny the three advertising signals (ad storage, ad user data, ad personalization) on every page load, in every region, and delete advertising cookies already set. Analytics stays governed by your own choice. We do not store the GPC signal: it is read fresh on each page load and does not overwrite a choice you made.

6. Newsletter and marketing

Newsletter. We send new articles and the odd thing we built, only when something is worth reading, and only with your consent. The signup records your consent and the time you gave it. You can withdraw at any time by writing to hello@stackdrop.co; we then stop sending and mark your consent as withdrawn.

Business outreach. We may contact people whose role is relevant to our services at their work email address, based on our legitimate interests. Every such message tells you how to opt out, and we keep a minimal record of opt-outs so we do not contact you again.

Advertising. We run Google Ads and LinkedIn Ads campaigns. Measuring them relies on the cookies and consent signals in section 5.

Service messages, such as engagement updates, invoices and security notices, are not marketing and continue while we work together.

7. Who we share data with

We do not sell personal data for money. We share it only with the parties below, and only as far as needed.

Some data stays on our own systems. Form submissions go to Twenty, an open-source CRM we host ourselves, so they are not shared with a CRM vendor. Twenty and our website database run on our own infrastructure in Frankfurt, Germany (EU). Invoicing runs on an internal tool, so billing data is not shared with an invoicing vendor either.

Our service providers act on our instructions under data processing terms that meet Article 28 GDPR. For some advertising and measurement, Google and LinkedIn also act as independent controllers under their own privacy policies.

8. International data transfers

We are based in Greece, and our CRM and website database are hosted in Frankfurt, Germany, inside the EU. Sentry stores our error reports in its EU data region, and PostHog stores session replays in its EU cloud, also in Frankfurt. Google, LinkedIn and Vercel are US-headquartered and may process data outside the European Economic Area (EEA). When data leaves the EEA, we rely on:

• the EU-U.S. Data Privacy Framework, for recipients certified under it;
• the European Commission’s Standard Contractual Clauses, with the UK Addendum for UK data; or
• another mechanism under Chapter V GDPR.

You can ask us for a copy of the relevant safeguards.

9. How long we keep data

We keep personal data only as long as the purpose needs, then delete or anonymise it. Longer periods apply where the law requires or a legal claim is pending.

The IP address used to derive your country code is not stored or logged for that purpose.

10. How we protect data

We collect as little as we can and design the Website to keep it that way: error reports are stripped of cookies and identifying headers, session replay runs only with analytics consent and masks every form field, the IP address is not kept for geolocation, and form data stays in a CRM we host ourselves.

Other measures include:

• encryption in transit (TLS) and, where supported, at rest;
• access limited to the people who need it, with multi-factor authentication on company accounts;
• data processing terms and security review for every service provider;
• confidentiality obligations for everyone who works with us;
• regular backups and a documented incident response plan.

No system is completely secure. If a breach is likely to put your rights at risk, we will notify the Hellenic Data Protection Authority within 72 hours where required, and tell you without undue delay where the risk is high.

11. Your rights

For anything cookie- or advertising-related, the fastest route is Your Privacy Choices in the footer: it takes effect immediately, in your browser. For everything else, write to hello@stackdrop.co.

Under the GDPR and UK GDPR you have these rights, subject to the conditions in the law:

We may need to confirm your identity first. We reply within one month, or tell you within that month if a complex request needs up to two more. Requests are free. If your request concerns data we handle for a client (section 2), we pass it to that client.

Complaints. You can complain to a supervisory authority where you live or work. Ours is the Hellenic Data Protection Authority, Kifissias 1-3, 115 23 Athens, Greece, www.dpa.gr. We would welcome the chance to put things right first.

12. US residents: Do Not Sell or Share My Personal Information

We do not sell personal information for money. We do run Google Ads and LinkedIn Ads campaigns, and while the advertising signals are granted, the measurement in section 5 can count as “sharing” personal information for cross-context behavioral advertising under several US state privacy laws.

To opt out, open Your Privacy Choices and choose to opt out. The advertising signals are denied and the advertising cookies on this browser are deleted. We also honor Global Privacy Control as a valid opt-out, without asking you to click anything (section 5.5).

Where a US state privacy law applies to us, you can also ask to know, access, correct or delete the personal information we hold about you, and we will not treat you differently for doing so. The categories we collect are those in section 3: identifiers, professional information, commercial information and internet activity. Send requests, yourself or through an authorized agent, to hello@stackdrop.co. If we turn a request down, reply with “Appeal” in the subject line and we will review it.

13. Other important information

Children.The Website is for businesses and professionals and is not directed at anyone under 18. We do not knowingly collect children’s data; if you think we have, contact us and we will delete it.

Automated decisions. We make no decisions with legal or similarly significant effects about you based solely on automated processing.

AI tools. We do not use third-party AI tools on personal data. Call transcripts and summaries are produced by meetso, our own product.

Links. We link to other sites, including GitHub, LinkedIn, X and Reddit. Their privacy practices are their own.

14. Changes and contact

Changes. We update this policy whenever what the Website or our practices actually do changes, and change the date at the top. If a change affects how we use data you already gave us, we will tell you before it takes effect.

Contact. Questions about this policy or your data:

• Email: hello@stackdrop.co
• Phone: GR +30 210 220 3188 · US +1 415 230 2984 · UK +44 20 3996 8806
• Post: STACKDROP EE, Troon 26, Athina 118 51, Greece