Spinstack Privacy Policy

Last updated: July 22 2025

DocMap Inc. ("Spinstack," "we," "us," or "our") respects your privacy. This Policy explains how we collect, use, disclose, and protect Personal Data when you:

visit spinstack.dev or any sub‑domain (the "Site");
create a Spinstack account or Stripe Connect account;
upload code, data, or other content ("Seller Content"); or
call an API hosted on the Spinstack platform.

"Personal Data" means any information that identifies or relates to an identifiable individual.

1. Data We Collect

Category	Examples	Source
Account & Contact	Name, email, address, password hash	You
Business & Compliance	EIN, company name, beneficial‑owner info, government ID	You / Stripe
Payment & Payout	Last 4 of card, bank routing & acct numbers, Stripe transaction IDs, fees, dispute data	Stripe
Usage & Logs	IP address, API keys, request/response metadata, telemetry (CPU‑seconds, storage GB)	Automatic
Device & Cookies	Browser type, OS, referring URL, cookies, analytics events	Automatic
Seller Content	Code, data, files you upload and any personal data contained therein	You / End Users

We do not knowingly collect data from children under 13.

Purpose	Basis
Provide, secure, and maintain the Platform; authenticate users; operate APIs	Contract
Process payments, subscriptions, Usage Fees, refunds, and chargebacks via Stripe	Contract
Measure usage and calculate fees	Legitimate business purpose
Communicate with you about your account, updates, or security issues	Legitimate business purpose / Contract
Comply with legal obligations (tax, KYC/AML, sanctions screening)	Legal obligation
Improve and debug the Platform; develop new features (aggregated or de‑identified data only)	Legitimate business purpose

3. Sharing & Disclosure

We share Personal Data only with:

Service Providers / Sub‑processors – e.g., Stripe (payments), cloud hosting (Fly.io, AWS, GCP, Render), databases (Supabase), analytics, error‑tracking, AI model vendors (OpenAI, Anthropic, Google).
Corporate Affiliates or Successors – in connection with a merger, acquisition, or sale of assets.
Authorities or Third Parties – if required by law, court order, or to protect rights, safety, or property.

We do not sell Personal Data and do not permit third‑party advertising cookies.

4. International Transfers

DocMap Inc. is based in the United States.

Special Note to International Users. Spinstack is hosted in the United States and is primarily intended for users located in the United States. If you access the Site or Platform from the European Economic Area (EEA), the United Kingdom, or any other region with laws or regulations governing personal‑data collection, use, and disclosure that differ from United States laws, you acknowledge and agree that your personal data will be transferred to and processed in the United States. By continuing to use the Site or Platform, you consent to this transfer, processing, and storage of your personal data in the United States.

5. Security

We use industry‑standard safeguards. No method is 100% secure; you are responsible for safeguarding your API keys and passwords.

6. Data Retention

Active accounts: We retain Personal Data for as long as your account is active plus 30 days, and backups for up to 90 days.
Legal or compliance data: Retained as required by law (e.g., tax, AML).
Seller Content: May be deleted within 90 days after you remove it; build artifacts may persist in cache for maintenance.

7. Your Rights

Depending on your location, you may have the right to:

Access, correct, or delete Personal Data
Port data to another service
Object to or restrict certain processing
Opt‑out of "sale" or "sharing" under the California Consumer Privacy Act/California Privacy Rights Act (we do not sell data)
Lodge a complaint with a supervisory authority

Email ty_pham-swann@spinstack.dev to exercise any right. We may verify your identity before responding.

8. Cookies

We use only essential cookies and first‑party analytics (no cross‑site tracking). You can disable cookies in your browser, but the Platform may not function properly.

9. Third‑Party Links & Seller Content

APIs you build on Spinstack may independently collect or process personal data. You are solely responsible for providing your own privacy disclosures to End Users and for complying with applicable data‑protection laws.

10. Changes to This Policy

We will post any changes on this page and, for material changes, provide 30 days' notice via email or dashboard. Continued use of the Platform after the effective date constitutes acceptance.

11. Contact Us

DocMap Inc. (d/b/a Spinstack)
Email: ty.phamswann@spinstack.dev

Last updated: July 22 2025