Privacy Policy

TechStack ("we," "us," "our") operates Retention IQ and Revenue IQ at retentioniq.io. (Our sister brand, LO Radar at loradar.com, is run by the same company under a separate privacy policy.) This policy explains what we collect, why, how we store and protect it, and the choices you have.

1. Information we collect

We collect four categories of information:

• Account information — name, email, password hash, practice/company name, role.
• Client data you upload — CSV imports of your past-client book. For mortgage professionals this includes borrower name, contact info, loan amount, rate, and origination date. For service businesses this includes patient/client contact info and visit history. You own this data; we process it on your behalf under a data-processing agreement (and, where applicable, a Business Associate Agreement).
• Usage data — which features you use, when, how often. We use this to improve the product and surface relevant recommendations. We never sell or share usage data.
• Website visitor data — on our public marketing site (retentioniq.io) we use the Meta Pixel and Microsoft Clarity. They collect page views, the pages you visit, and device and browser details, so we can measure our advertising and show our ads to people who have visited the site. If you book a walkthrough with us, we also send Meta the fact that a booking happened, together with a one-way hashed version of your email address and phone number, so we can match it to our ads (Meta's Conversions API). These tools do not run inside the Retention IQ application, and we do not send them client data you upload. You can opt out of Meta's ads personalization in your Facebook or Instagram ad settings, or block these tools with your browser's privacy settings or an extension.

2. How we use information

• Operate, maintain, and improve the services.
• Generate outreach drafts, attribution records, and analytics visible to you.
• Send account, billing, and service-critical email.
• Comply with legal obligations.

We do not sell personal data. We do not share your client data with third parties except as required by law or as part of a sub-processor relationship disclosed below.

3. Where your data lives

• Database: Supabase (PostgreSQL), US-East-1, SOC 2 Type II.
• Application hosting: Hostinger VPS, US region.
• Encryption at rest: AES-256.
• Encryption in transit: TLS 1.3.

4. Sub-processors

We use the following sub-processors. All are bound by data-processing agreements.

• Supabase — database, authentication.
• Stripe — payment processing (when billing is active).
• Hostinger — application hosting.
• Meta Platforms and Microsoft — advertising measurement and site analytics on retentioniq.io (Meta Pixel, Clarity). Marketing site only.
• Sentry (planned) — error tracking.

5. HIPAA (medical-practice customers)

Healthcare workflows remain disabled until the customer-specific readiness review is complete. Before PHI moves, the applicable BAA, permitted data flow, minimum-necessary scope, subprocessor agreements, eligible service configurations, retention, access, and incident obligations must be documented. The public BAA is a review template; request contracting materials at legal@techstackconsulting.io.

6. Mortgage loan officers

The TechStack mortgage product is a separate brand — LO Radar at loradar.com — with its own privacy policy, BAA, and mortgage-compliance posture (RESPA, TILA, TCPA, ECOA, Fair Housing). If you are a loan officer, please review LO Radar's privacy policy directly at loradar.com/privacy.

7. Your rights

• Access / export — download your account and client data at any time.
• Correction — update inaccurate information via the app or by contacting us.
• Deletion — request deletion. We retain backups for 30 days after deletion, then purge.
• Portability — export client data as CSV.

California residents: you have additional rights under the CCPA. EU/UK residents: you have rights under GDPR, including the right to lodge a complaint with a supervisory authority.

8. Retention

Active account data is retained while your account is active. Client data uploaded under a BAA is retained for 6 years after you delete or deactivate. Non-BAA data is retained 2 years after deactivation. Payment records are retained 7 years for tax compliance.

9. Security

We use Row-Level Security in Postgres, PKCE auth, TLS 1.3, and AES-256. We log access to sensitive actions. We will notify affected customers within 72 hours of discovering any breach of protected data.

10. Children

Our services are not directed to children under 16. We do not knowingly collect information from children.

11. Changes

When this policy changes materially we will notify you by email and update the "Last updated" date at the top of this page.

12. Contact

TechStack Consulting LLC
5900 Balcones Dr Ste 100
Austin, TX 78731
legal@techstackconsulting.io