Privacy policy

This describes what personal data doublestack handles, why, and what your rights are. Written to be read, not filed.

For some of the data we handle, doublestack is the controller. For some, your employer is the controller and we’re the processor. We explain which is which below. Contact for any data question: privacy@doublestack.app.

What we collect

When you sign up:

• Your name
• Your email address
• Your profile picture, if your Microsoft account has one

When you use doublestack:

• The arguments, comparisons, buyer profiles, and notes you create
• Buyer profiles and context extracted from your inbox (see next section)
• A tone-of-voice profile for you, refreshed periodically
• Basic usage data: which features you use, when, from what device
• Support conversations, if you contact us

Reading your inbox

doublestack reads email from the Microsoft 365 inbox connected to your account. This is how we build buyer profiles, surface context for the next conversation, and learn how you write. Without it, the product can’t do what it’s there to do.

Here’s exactly what happens.

What we read.

When you connect your account, we read a window of recent messages so the product is useful from day one. From then on, we read incoming emails and the outgoing emails you send through doublestack.

How we decide what’s a buyer.

Each email is sent to a language model that looks at the sender and the content. If the sender is a newsletter, an automated system, an internal colleague, or anything else that doesn’t look like a buyer, we record that classification and skip future emails from that sender. The classification refreshes from time to time. If the sender looks like a buyer or prospect, we extract context into a buyer profile.

What we store.

• The sender’s identifier, stored as a hash, with their classification (newsletter, colleague, buyer, etc.)
• Buyer profiles and the context we extract for them, including buyer names, email addresses, and the notes and signals relevant to a sales conversation
• Your tone-of-voice profile, refreshed periodically

What we don’t keep.

The email itself. We don’t keep subject lines, bodies, and attachments as a record. We don’t index them. We don’t train models on them. We store them only temporarily and encrypted. Recipients of an email aren’t stored unless they become a buyer.

Your tone-of-voice profile is the one place email text is kept longer. It holds excerpts of your own sent emails and your signature, encrypted, until the profile is refreshed or your account is deleted.

Sending.

doublestack can send emails on your behalf, but only when you click send. The product doesn’t send anything autonomously.

Buyer profiles are shared within your team. Other doublestack users at your dealership who share your Microsoft 365 tenant can see the buyer profiles and notes, so a colleague can pick up a conversation you’ve been having. This is the same model as a shared CRM. Email content, your inbox, and your tone-of-voice profile are not shared. Only buyer profiles and notes.

What we don’t do

• We don’t use cookies for tracking or advertising.
• We don’t sell your data to anyone.
• We don’t share your data with advertisers.
• We don’t train AI models on your data or your customers’ data.
• We don’t read your content to improve our own product unless you’ve told us we can.

Why we have it

When you sign up directly as a doublestack customer, we are the controller for your name, email, profile picture, usage data, and support conversations. We process this on these legal bases:

• To deliver the service (contract): your name, email, and the content you create in doublestack.
• To run our business (legitimate interest): usage analytics to understand what works, support conversations to help you.
• To comply with the law (legal obligation): tax records, accounting, responding to lawful requests from authorities.

We use your email address to send you service messages (renewals, security notices, important changes). We don’t send marketing emails to customer accounts.

Who we share it with

A short list, and every one of them is a processor acting under contract with us. The current list, with what each one does and where it runs, is on the Sub-processors page. That page is generated from our supplier register, so it cannot fall behind: this one deliberately does not keep its own copy.

Where a processor is outside the EU, we rely on the transfer safeguard recorded in its data processing agreement. Write to privacy@doublestack.app and we will tell you which safeguard applies to which processor.

How long we keep it

• Active account: as long as you have an account with us.
• After you cancel: account data is kept for 30 days after the term ends, then deleted.
• Accounting records: kept for five years, as Danish law requires.
• Support conversations: kept for two years, then deleted.

Your rights under GDPR

You can:

• See what data we have about you
• Correct anything that’s wrong
• Delete your data (subject to legal retention requirements)
• Get a copy in a portable format
• Object to processing
• Complain to Datatilsynet (the Danish Data Protection Authority) at datatilsynet.dk

To exercise any of these, write to privacy@doublestack.app. We respond within 30 days, usually much faster.

Security

We take security seriously. The short version: encrypted in transit and at rest, EU-based hosting, access on a need-to-know basis.

Children

doublestack is a B2B product. We don’t knowingly collect data from anyone under 16. If you think we have, tell us at privacy@doublestack.app and we’ll delete it.

Contact

For anything related to your data: privacy@doublestack.app.

You also have the right to lodge a complaint with Datatilsynet, the Danish supervisory authority.