Privacy Policy

Stillport (“Stillport,” “we,” “us”) provides an AI “fleet” that connects to the tools a business already uses — such as Shopify, Google Analytics, Search Console, Gmail, Meta, Stripe, and GitHub or Bitbucket — mostly read-only, and drafts work (email replies, social posts, ad analyses, pull requests) that the business owner reviews and approves in Clearance. Nothing sails without clearance: nothing sends, posts, merges, or spends without the owner’s explicit approval.

This Privacy Policy explains what personal and business data we process, why, and the rights you have. It applies to the Stillport application and marketing site at stillport.ai.

We collect and process three broad categories of data:

• Account data. The information needed to create and secure your account — your email address (verified at signup), authentication details, workspace and business profile, and the goals and standing orders you give your fleet.
• Connected-source data. When you connect a source, your fleet reads business and analytics data on your behalf through that provider’s API — for example order and store data, web and search analytics, email content you ask it to draft replies to, ad performance, payment summaries, and code repositories. Access is scoped read-only or draft-only wherever the provider supports it.
• Usage & telemetry. Operational logs and diagnostics generated as you use the service — requests, errors, feature usage, and similar records used to run, secure, and improve the product.

We use the data above to:

• operate and secure the service and your account;
• read your connected sources on your behalf and draft work — briefings, replies, posts, analyses, and pull requests — for you to approve in Clearance;
• turn your corrections into standing orders that live in your tenant and improve the drafts your fleet produces for you;
• send service and account communications (such as email verification and important notices);
• diagnose problems, prevent abuse, and meet legal obligations.

These are core promises, not marketing lines. They hold by default and are non-negotiable:

• Your data is never used to train models. Your data and the learnings your fleet builds stay private to your tenant.
• Per-tenant isolation. Your data is private to your tenant and is not shared with other customers. Standing orders live in your tenant alone.
• We do not sell your data. We do not sell personal or business data, and we do not share it for third-party advertising.
• Human-in-the-loop by design. Stillport drafts; you approve. Nothing acts against a connected source without your clearance.

We rely on third parties to deliver the service. These fall into two groups, and we share only what each needs to do its job:

• Sources you connect. The providers you authorize (for example Shopify, Google Analytics, Search Console, Gmail, Meta, Stripe, GitHub, and Bitbucket). Your fleet accesses them under the scopes you grant — read-only or draft-only — and their own terms and privacy policies govern the data held on their side.
• Infrastructure & operations. Providers that host and run the service, such as cloud infrastructure (e.g. DigitalOcean) and transactional email (e.g. AWS SES for signup verification). We also use model providers to generate drafts; as stated above, your data is not used to train models.

The specific providers in use may change as the product evolves. We will keep this list honest and current.

We keep account and connected-source data for as long as your account is active and as needed to provide the service. When you disconnect a source, we delete its stored access tokens. When you close your account, we delete or anonymize your data within a reasonable period, except where we must retain limited records to meet legal, security, or accounting obligations. You can export your data before you leave.

We take security seriously and apply least-privilege access throughout: OAuth scopes are read-only or draft-only (for example, mail scopes allow reading and composing drafts but never sending). Data is isolated per tenant, access to production is restricted, and tokens are stored securely. No system is perfectly secure, but we work to protect your data commensurate with its sensitivity and to respond quickly if something goes wrong.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Within the product you can view your connected sources, disconnect them, export your data, and delete your account. To make any other request, contact us at privacy@stillport.ai. We will not discriminate against you for exercising these rights.

We use cookies and similar technologies that are necessary to run the service — for example to keep you signed in and to remember preferences such as your theme. We aim to keep cookie use minimal and functional rather than tracking you across the web.

Stillport is a business tool and is not directed to children. It is not intended for use by anyone under the age of 16 (or the minimum age required in your jurisdiction), and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.

We and our processors may store and process data in countries other than the one you live in. Where data is transferred across borders, we rely on appropriate safeguards to protect it consistent with this policy and applicable law.

We may update this policy as the product and our practices evolve. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Continued use of the service after an update means you accept the revised policy.

Questions about this policy or your data? Write to privacy@stillport.ai.

This document is a draft prepared by Stillport and has not yet been reviewed by legal counsel. It does not constitute legal advice.