Last updated: July 17, 2026
Stack (yourstack.co) is a platform that lets wellness professionals recommend products from partner brands and earn commission on referred sales. This policy describes what data we collect, why, and how it is handled. It applies to wellness professionals, shoppers, and brand partners, including brands that install our Shopify app.
Account information — when a wellness professional or brand creates an account we collect a name, email address, and password (stored as a secure hash by our authentication provider). Wellness professionals may also add a profile photo and bio.
Payment and payout information — payments are processed by Stripe. We never see or store full card numbers. For payouts, wellness professionals connect a Stripe account; Stripe holds the associated banking details.
Order information — when a shopper buys through Stack checkout we collect the name, email, and shipping address needed to fulfill the order.
Referral click data — when a shopper clicks a product link we log a random click ID, the product, the referring professional, an IP address, and browser user agent. This is used solely to attribute any resulting sale.
Our Shopify app does not read, import, or sync data from a brand’s store. Products featured on Stack are curated by our team from the brand’s publicly available product listings (titles, prices, images, descriptions) — the same information visible to any shopper.
We receive order notifications from the brand’s store so we can attribute sales to referrals. Orders that did not originate from a Stack referral link are discarded immediately and never stored.
For referred orders we retain the order ID, order value, and the referral click it matched — this is the minimum needed to calculate commission.
On brand storefronts, our tracking script stores a referral click ID in the shopper’s browser (cookie and local storage) for up to 30 days so a later purchase can be attributed to the referring professional. It does not track browsing behavior and is not used for advertising.
We share data only with the service providers required to operate the platform: Supabase (database and authentication), Stripe (payments and payouts), Resend (transactional email), Vercel (hosting), and Google (optional sign-in). We do not sell personal data to anyone.
Brands see aggregate statistics about their partnership (clicks, conversions, revenue) but not shopper browsing data.
Order and commission records are retained as required for accounting and tax purposes. Referral click logs are retained for attribution and fraud prevention.
You can delete your account from your dashboard at any time. To request deletion of other personal data, or to exercise rights under GDPR/CCPA (access, correction, portability, deletion), contact us at the email below. We honor Shopify’s customer data deletion requests automatically through Shopify’s mandatory privacy webhooks.
For any privacy question or request, email joshberman3@gmail.com. We will respond within 30 days.