LEGAL · GDPR PACK v1.1
Privacy Policy
Last updated: 23 October 2026
1. Controller
SankPower SIA, registered in Riga, Latvia (European Union), operating as Quietstack Automation. Contact for all privacy matters: hello@quietstack-team.com.
2. What we collect and why
- Demo request form: Shopify store URL, work email and (optionally) your stated support pain point. Purpose: preparing and sending your demo plan and replying to you. Legal basis: steps taken at your request prior to a contract (Art. 6(1)(b) GDPR). If all delivery channels fail, the request is kept only in our technical event logs (below) so it is not lost.
- Public sandbox demo: we do not store conversation content. Your message is processed transiently to produce an answer (deterministic gates, and for some questions an LLM API call) and is then discarded. Legal basis: legitimate interest in demonstrating our service (Art. 6(1)(f)).
- Technical event logs: request metadata (timestamp, route, status code, delivery channel status; hosting request logs may include your IP address) kept for up to 30 days for security and debugging. IP addresses used for rate limiting are held in memory for about one minute and not written to our logs. Legal basis: legitimate interest (Art. 6(1)(f)).
3. Retention
- Demo request data: until the enquiry is closed and for up to 12 months afterwards, unless a contract follows.
- Sandbox conversation content: not stored.
- Technical event logs: 30 days.
4. Sub-processors
| SUB-PROCESSOR | PURPOSE | LOCATION | TRANSFER BASIS |
|---|---|---|---|
| Vercel Inc. | Website hosting, serverless functions, technical event logs | USA / EU edge | Provider DPA (SCCs) |
| Notion Labs, Inc. | Lead record storage (store URL, email, stated pain point) | USA | Provider DPA (SCCs) |
| LLM API provider (Anthropic) | Generating sandbox demo answers; message processed transiently | USA | Provider DPA (SCCs) |
| Telegram (Telegram Messenger Inc.) | Internal notification of new demo requests to our team | Global | Provider terms |
| Upstash, Inc. | Rate-limit and duplicate-ticket counters (hashed keys, no message content) | Region chosen at setup | Provider DPA (SCCs) |
5. Your rights
You can request access, rectification, erasure, restriction, portability, or object to processing by emailing hello@quietstack-team.com. You may also lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija) or your local supervisory authority.
6. Cookies
This site does not use advertising or analytics cookies. Fonts are loaded from Google Fonts.