Privacy Policy
This policy explains how Stanch collects and uses personal data when you visit stanch.ai, ask us for a demo or otherwise contact us, and when you use the Stanch console as a member of a customer’s team. It also explains the different role we play for the data our product processes for our customers.
In short
- Stanch is sold to organisations. On employees’ work computers, the customer organisation decides what Stanch checks and is responsible for that data; we process it on its instructions. If that is you, read Stanch on your work computer.
- For this website, demo requests, business contacts and console accounts, we decide how personal data is used, and this policy applies.
- We do not sell personal data or use it for advertising. This website sets no cookies, and analytics runs only if you allow it.
- The Stanch service is hosted in the European Union, in Germany.
- Questions or requests: contact@stanch.ai.
1. Who we are
Stanch (“Stanch”, “we”, “us”) is responsible for the personal data described in this policy. You can reach us about privacy at contact@stanch.ai.
This policy covers our website, our sales and business contacts, and the accounts of people who use the Stanch console. It does not cover the data that our product processes for customers on their employees’ devices; section 2 explains why.
2. Our two roles
When we act for our customers. Customers install the Stanch agent and browser extension on the work computers they manage and choose what Stanch checks. For the data this produces (security events, device records and any evidence the customer chooses to keep), the customer is the controller and Stanch is its processor: we process that data only on the customer’s instructions and under our Data Processing Addendum. Under Israeli law, the customer is the database controller and Stanch is a holder; under California law, Stanch is the customer’s service provider. Questions about that data are best sent to the employer or organisation concerned; if you send them to us, we will pass them on and help the customer answer. Stanch on your work computer describes this processing in plain terms.
When we decide. For the personal data in section 3 (website visitors, demo requests, business contacts and the people who use the console), Stanch is the controller.
3. The personal data we collect
When you visit this website
- Technical data. Like every website, ours receives your IP address and the information your browser sends (browser type, device type, the page requested). Our hosting provider, Cloudflare, processes it to deliver and protect the site. We do not keep server logs of our own.
- Analytics, only if you allow it. With your consent, Cloudflare Web Analytics counts visits and pages viewed. It sets no cookies and does not follow you across other websites. See our Cookie Policy.
- Choices kept in your browser. Your cookie choice and any accessibility settings are stored in your own browser and never sent to us.
When you ask for a demo or contact us
- Your first name, last name and work email, and whether you agreed to receive updates from us.
- Cloudflare Turnstile checks signals from your browser to confirm that the request is not automated. To stop the form being flooded, we count requests per IP address in ten-minute windows, under a keyed one-way hash of the address (never the address itself); a count is deleted once it is a day old.
- Your request is stored in our database at Cloudflare, and our team is told of it in our Slack workspace.
- What you write to us, and our replies, when you email us or speak with our team.
When you use the Stanch console
The console (app.stanch.ai) is used by the people a customer invites, such as its security, IT and compliance staff. For them we process:
- Account data: name, work email, job title if given, role, the organisation you belong to and your notification settings.
- Sign-in data: your password, stored only as a one-way hash; your two-step verification secret, stored encrypted; passkeys you register (their public keys only). If you sign in through Google, Microsoft or your organisation’s identity provider, we receive the identifier, name and email address that provider shares with us.
- Session and security data: for each sign-in session, the IP address, browser (user agent), time of last activity and how you verified. Sessions last at most 12 hours.
- Activity records: the console’s audit log records who changed what and when (for example a policy, a setting or a user’s role), with the person’s email address. Your organisation’s administrators can read it.
- Stanch Agent conversations, only if your organisation turns on this optional assistant: your questions and its answers, visible to you alone.
- Support: what you tell us when you ask for help.
Customers and business contacts
The names, work contact details and roles of the people we deal with at customers, prospects, suppliers and partners, and the contracts, orders and invoices we exchange with them.
We do not ask for sensitive data such as health information about you. Please do not send it to us.
4. How we use personal data, and our legal bases
Where the EU or UK General Data Protection Regulation (GDPR) applies, we rely on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Delivering this website and keeping it secure | Our legitimate interest in running a working, secure website |
| Website analytics | Your consent, which you can withdraw at any time |
| Answering demo requests and other enquiries, and following up | Steps you ask us to take before a contract, and our legitimate interest in answering business enquiries |
| Sending you updates about Stanch | Your consent (the box on the demo form, or another opt-in), which you can withdraw at any time |
| Providing console accounts and the Stanch service to the customer you work for | Performance of our contract with that customer, and our legitimate interest in providing the service its users rely on |
| Security: authenticating users, preventing misuse and keeping audit records | Our legitimate interest, and our customers’, in a secure service; legal obligations where they apply |
| Service messages such as invitations, sign-in and security notices and the alerts your organisation sets up | Performance of our contract with the customer, and our legitimate interest in operating the service |
| Improving the service, using counts and measurements rather than individual profiles | Our legitimate interest in improving our product |
| Keeping business records, meeting legal duties and handling disputes | Legal obligation, and our legitimate interest in protecting our rights |
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object at any time (section 9).
You are not legally required to give us personal data. Without it, we may not be able to answer you, give you access to the console or provide the service.
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
6. International transfers
The Stanch service is hosted on Google Cloud in Germany, with database backups in the Netherlands. Our team may access personal data from Israel, which the European Commission and the United Kingdom recognise as providing adequate protection for personal data.
Some of our service providers (Cloudflare, Slack, Google Workspace and, if your organisation uses Stanch Agent, Anthropic) process data in the United States and other countries. Where personal data from the European Economic Area, the United Kingdom or Switzerland goes to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses, with the UK International Data Transfer Addendum or the Swiss adaptations where they apply, or on another lawful mechanism. Transfers out of Israel follow the Israeli rules on transfers of data abroad. You can ask us for details at contact@stanch.ai.
7. How long we keep personal data
| Data | How long |
|---|---|
| Demo requests and enquiries | While we are in touch about your request, and then for as long as needed to follow up; we delete the records of enquiries that did not lead to a business relationship when they are no longer needed. |
| Consent to receive updates | Until you withdraw it. We keep a record of your consent and of its withdrawal. |
| Console accounts, sign-in and session records | For as long as the account exists. They are deleted when your organisation removes you or ends its subscription. |
| The console’s audit records | For the period your organisation sets in its retention settings, and in any case until its account is deleted. |
| Stanch Agent conversations | 30 days by default; your organisation can set a shorter period. |
| Customer and business-contact records | For the length of the relationship, then as long as the law requires us to keep business and tax records. |
| Backups of the service | Data deleted from the service remains in encrypted backups until they expire, within 90 days. |
8. How we protect personal data
We protect personal data with technical and organisational measures suited to the risk: encryption in transit and at rest, separation of each customer’s data, access limited to the people who need it, two-step verification and audit logging. Our Security page describes them. No system is perfectly secure; if we learn of a breach that affects your personal data, we will tell you and the authorities where the law requires.
9. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict our use of it, or object to our use of it, including at any time to direct marketing;
- receive the data you gave us in a portable format;
- withdraw consent you gave, without affecting what we did before;
- complain to a data-protection authority.
To use any of these rights, email contact@stanch.ai. We may ask you to confirm your identity first. We answer within one month where the GDPR applies, and within the time the applicable law sets elsewhere. Exercising your rights will not lead to worse treatment.
Israel. Under the Privacy Protection Law, 5741-1981, as amended (including Amendment 13), you may ask to review personal data about you held in a database, ask for it to be corrected or deleted if it is inaccurate, incomplete, unclear or out of date, and ask to be removed from any list used for direct marketing. You may complain to the Privacy Protection Authority.
European Economic Area, United Kingdom and Switzerland. You may complain to the supervisory authority where you live or work, or where you believe your rights were infringed.
If your request concerns data Stanch processes for your employer (section 2), we will pass it to your employer, which decides how to answer, and help it do so.
10. Notice to California residents
This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA).
- What we collect (the last 12 months and today): identifiers such as name, email address and IP address; professional information such as employer and job title; internet activity on this website, only if you allow analytics; and account login credentials, which the CCPA treats as sensitive personal information. Section 3 gives the detail, and section 7 how long we keep each kind.
- Where it comes from: from you, from your browser, from your organisation when it invites you, and from the identity provider you sign in with.
- Why: the business purposes in section 4.
- Who receives it: the service providers and others in section 5, for those business purposes.
- No sale or sharing. We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the last 12 months. We use sensitive personal information only to provide and secure the service.
You have the right to know what personal information we collect, use and disclose; to have it deleted or corrected; and not to be discriminated against for using these rights. To use them, email contact@stanch.ai. We will confirm your identity using the information we already hold, and an authorised agent may act for you with your signed permission.
11. Children
Stanch is a service for organisations and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We may update this policy as our services and the law change. We will publish the new version here with a new “Last updated” date and, if a change is significant, tell customers’ account owners by email before it takes effect.
13. Contact
For any question or request about this policy or your personal data, email contact@stanch.ai.