Privacy policy
Last updated: 29 October 2026
We collect as little as we can, keep it for as short as we can, and never sell it or use it for advertising. This page explains what we handle when you visit this website, apply, ask to upgrade from your dashboard, request a feed key or contact us, and how we treat your organisation's data when it uses Stackat.
Who we are
Stackat is a service of PROGREX SOFTWARE d.o.o., Šetalište 150. brigade Hrvatske vojske 8, 10147 Zagreb, Croatia, OIB 56146016945 ("we"). We are the controller for the personal data described on this page. Privacy questions: info@progrex.dev.
What we collect and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Your application: name, work email, company, role, where your code is hosted, number of repositories, what hurts (optional) | Decide on and answer your application | Steps before a contract (Art. 6(1)(b) GDPR) | The email is erased as soon as we answer (invite or decline). Everything else is deleted 12 months after you applied. |
| An upgrade request from your dashboard: name, work email, company, a note (optional), and which organisation it is for | Answer it: agree a price and invoice your organisation | Steps before a contract (Art. 6(1)(b) GDPR) | The email is erased as soon as we answer. Everything else is deleted 12 months after you sent it. |
| Survey answers (survey.html), and your role and email only if you give them | Understand how teams handle upgrades; reply to you if you left an email | Consent: you choose to answer (Art. 6(1)(a)); you can withdraw it by writing to us | 12 months after you answered |
| A salted hash of your network address when you apply (never the address itself) | Limit applications to 3 an hour per network, against abuse | Legitimate interest (Art. 6(1)(f)) | With the application |
| Feed key requests: name, email, organisation, intended use | Issue and manage your key | Contract (Art. 6(1)(b)) | While the key is active, then 12 months |
| Emails you send us | Answer you | Steps before a contract / legitimate interest | As long as needed to answer, at most 12 months after the last message |
| Business contact details of customers | Run the agreement; invoices once billing starts | Contract (Art. 6(1)(b)); legal obligation for invoices (Art. 6(1)(c)) | The agreement's term; invoices as tax law requires |
| Technical data when you load the site or send a form: IP address, time, page, browser | Deliver the site, stop abuse and attacks | Legitimate interest (Art. 6(1)(f)) | Short-lived logs at our hosting and network providers |
We do not sell personal data, use it for advertising or build profiles. Nothing is decided about you automatically.
Cookies and analytics
This website sets no cookies, stores nothing in your browser and runs no third-party trackers or advertising. Fonts and images are served from stackat.dev itself, so loading a page sends nothing to anyone else. If we measure visits, we use a self-hosted, cookieless tool (Umami) that counts page views without storing IP addresses or identifying you.
When you send the application form or the survey, it goes to our server through Cloudflare, which protects it from attacks.
Cloudflare may set a strictly necessary security cookie there (such as __cf_bm, kept for up to 30 minutes) to tell
people from bots, and the form may show a Cloudflare Turnstile check. Neither is used to track you, and as strictly necessary
security measures they need no consent.
When your organisation uses Stackat
When your organisation installs the Stackat GitHub App, we process data in its repositories on its behalf: your organisation is the controller and we are its processor, under our Data Processing Agreement. In short:
- Stackat only touches what you define: each repository's infrastructure files (YAML, Terraform, HCL) at its latest commit,
narrowed further by
scan:in.stackat.yml. They are held in memory while they are scanned and gone when the scan finishes; application code stays on GitHub. We keep only the scan result: tool names, versions, and the file and line where each is pinned. We never keep your code. - Organisation, repository and user names are replaced by pseudonyms everywhere they are stored, logged or shown.
- No customer data ever reaches an AI model. The model only reads public release notes.
- Comments addressed to Stackat in its issues are stored to improve accuracy.
The complete list, item by item, is on what we collect.
Who else handles data
Service providers that run parts of Stackat for us, bound by data processing terms:
| Provider | What for | Personal data | Location |
|---|---|---|---|
| Amazon Web Services (Amplify Hosting) | Serves this website | Technical data of visits | EU (Frankfurt) |
| Cloudflare | DNS, network protection and secure access to our server; bot check on the form | Technical data of requests to our server | Global network |
| Slack | Notifies us of new applications, upgrade requests and installations | Application details except your email; pseudonyms | USA |
| GitHub | Where your organisation's repositories live and where Stackat posts issues | What your organisation keeps there | Your organisation's choice |
| Healthchecks.io | Watches that our services are running, and gives the status line at the foot of the home page | Your browser's network address when it asks for the status (no cookies) | EU (Latvia) |
| Google (Calendar) | Booking a demo, if you choose to: the booking page opens on Google's site | The name and email you enter there, and the time you pick | EU and USA |
Our own server is in Croatia (EU), and backups are encrypted before they leave it. Where a provider is in the USA, the transfer relies on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Your rights
You can ask us for access to your data, correction, deletion, restriction or a copy, and object to processing based on legitimate interest. Email info@progrex.dev; we answer within a month. You may also complain to the Croatian data protection authority, AZOP.
Changes
We post changes here with a new date, and email customers about material ones.