Skip to content
NEW: Martech Stack Builder on your phone →

Privacy Policy

Last updated: September 25, 2026

1. Introduction

Martech Stack Builder ("we," "our," or "us") is operated by Martech Therapy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application at app.martechstackbuilder.com and our marketing website at martechstackbuilder.com (collectively, the "Service").

Your account is a Martech Therapy account. The same email signs you in to Martech Stack Builder and to the Martech Cookbook at martechcookbook.com. Each site keeps its own data: this policy covers what Stack Builder stores, and the cookbook's data is covered by its privacy notice. Deleting your account removes it from both sites; if you only want your Stack Builder data removed, say so in your request.

By using the Service, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide

  • Account Information: When you create an account, we collect your email address, name, and optionally your company name.
  • Authentication Data: If you sign in using Google OAuth, we receive your basic profile information (name, email, profile picture) from Google.
  • User Content: Diagrams, configurations, and other content you create within the Service, including vendor contracts you upload on the Enterprise plan.
  • Payment Information: If you subscribe to a paid plan, payment processing is handled by Stripe. We do not store your full credit card details.
  • Communications: When you contact us for support or consultation requests.

2.2 Information Collected Automatically

  • Usage Data: We collect information about how you interact with the Service, including pages visited, features used, and actions taken. What we collect depends on your answer to our cookie banner; see section 4.1.
  • Device Information: Browser type, operating system, device type, and screen resolution.
  • Log Data: IP address, access times, and referring URLs.
  • Cookies and Similar Technologies: We use cookies and local storage to keep you signed in and remember your preferences. Analytics cookies are used only if you accept them; see section 4.1.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Process transactions and manage your subscription
  • Send you updates, security alerts, and support messages
  • Respond to your comments, questions, and requests
  • Analyze usage patterns to improve user experience
  • Detect, prevent, and address technical issues
  • Comply with legal obligations

4. Analytics and Third-Party Services

We use the following third-party services:

  • Supabase: Database, sign-in, file storage and server functions. Your account data and content are stored on Supabase in the EU (Stockholm).
  • Hostinger: The virtual server that runs the app, this website and our automation server.
  • OpenAI: Processes the content you send to AI features: the stack you are analysing and, on Enterprise with your workspace’s consent, contract text. OpenAI does not use this data to train its models. Details are on our security page.
  • PostHog: Product analytics, error tracking and, in the app only, screen recording. Hosted in PostHog’s EU region. What it collects depends on your cookie choice; see section 4.1.
  • Postmark: Sends our emails (notifications, invitations, and product updates you opted into). Postmark receives your email address and the message.
  • Stripe: Payment processing. Stripe handles card data under PCI DSS; we never see your full card number.
  • Slack: Only if your workspace connects Slack: notifications, and answers to /msb ask, which can quote your contracts.
  • Bird Eats Bug: Only when you send a bug report from the app: the screen recording, console and network log you choose to send.
  • Ghost: Only if you subscribe to the Martech Therapy newsletter: your name and email.
  • Google: If you sign in with Google, Google shares your name, email and profile picture with us, and Google’s Privacy Policy applies to the data it collects.

4.1 Analytics, cookies and screen recording

We use PostHog to understand how this website and the app are used. On your first visit we ask whether you accept analytics cookies. You can change your answer at any time with the Cookie settings link at the bottom of this website and of the app.

Before you answer, and if you decline:

  • PostHog stores nothing on your device: no cookie, no local storage. It counts visits using an identifier held in the page’s memory, which is gone when you close the tab.
  • We record the pages you view and what you click, with your browser type, device type and screen size, and the country derived from your IP address. PostHog discards the IP address itself.
  • These events are not linked to your account, even if you are signed in, and nothing is recorded on screen.
  • If you decline, we also delete any PostHog cookie or storage an earlier visit left behind.

If you accept:

  • PostHog sets a first-party cookie and local storage entry so it can recognise you across visits and across www.martechstackbuilder.com and app.martechstackbuilder.com. It lasts up to one year.
  • If you are signed in, your usage is linked to your account using an internal user ID and your email address.
  • In the app only, a visitor’s first session, before they sign in or save anything, may be recorded as a screen recording so we can see where new visitors get stuck. Everything typed into fields is hidden, as are contracts, AI chat, comments and stack names. Recording stops as soon as you sign in. This website never records the screen.

We store your answer in a cookie named msb_analytics_consent for 6 months, so we do not ask on every visit. That cookie is necessary to respect your choice and holds nothing else.

The legal basis for analytics cookies and screen recording is your consent. The count of visits made without cookies relies on our legitimate interest in knowing how the Service is used; you can object by contacting us.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information in the following circumstances:

  • Service Providers: With the suppliers listed in section 4, who perform services on our behalf.
  • Legal Requirements: If required by law or in response to valid requests by public authorities.
  • Business Transfers: In connection with a merger, acquisition, or sale of assets.
  • With Your Consent: When you explicitly agree to share information.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. You can request deletion of your account and associated data at any time by contacting us.

Diagrams and content you create are retained until you delete them or close your account. Deleted content can remain in our daily database backups for up to 7 days, after which the backup that held it is discarded.

PostHog keeps analytics events for up to 1 year and screen recordings for 30 days, then deletes them.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

  • Encryption of data in transit (TLS)
  • Encryption of data at rest (AES-256), plus a separate encryption key per workspace for uploaded contracts
  • Row-level security on every database table, and an automated test suite that attacks workspace isolation for contracts
  • Optional two-factor authentication, which Enterprise workspaces can require
  • An audit log of access to contract data, written by our servers

However, no method of transmission over the Internet is 100% secure. While we strive to protect your data, we cannot guarantee its absolute security.

8. Your Rights

Depending on your location, you may have the following rights:

  • Access: Request a copy of your personal data
  • Correction: Request correction of inaccurate data
  • Deletion: Request deletion of your data
  • Portability: Request a copy of your data in a portable format
  • Opt-out: Opt out of marketing communications

To exercise these rights, please contact us at privacy@martechtherapy.com.

9. International Data Transfers

Your account and content are stored in the EU. Some suppliers in section 4 process data in the United States (OpenAI, Postmark, Stripe and, depending on your Slack plan, Slack). Their published data processing terms cover these transfers with the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

10. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

12. Contact Us

If you have questions about this Privacy Policy, please contact us: