Privacy

Short version

StageTile hosts a public profile page for you. We keep only the data you give us plus what we need to run the service. We don't sell your data. We don't run behavioural tracking. Our analytics count aggregate origin document requests without analytics cookies or individual tracking.

Who is responsible

StageTile is operated by Angel J. Haro (the operator). Questions about your data or this policy go to privacy@stagetile.com.

What becomes public

Staging publishes your profile, services, links, photo and any contact details you entered. Anyone can view a staged page without signing in, and others may copy, cache or index it. Public phone, email and WhatsApp fields are optional. Unstaging removes public access but keeps your draft on the server. Disabling search indexing does not make a staged URL private or recall existing copies.

What we collect and why

• Account + login: email and unique ID from your OAuth provider (Google or GitHub). Legal basis: contract and pre-contractual measures (GDPR Art. 6(1)(b)). StageTile never sees or stores your OAuth provider password.
• Profile content: handle, display name, title, bio, contact fields, services, links, page settings, and stored photo references. You enter this; we store it. Legal basis: contract.
• Cookies: first-party cookies for your session, sign-in security, and the dashboard appearance you choose for the browser session. No tracking. Details, names, purposes, lifetimes and controls are in the Cookie Policy. Security processing serves the legitimate interest of protecting accounts. This notice does not assert a universal consent exemption.
• Aggregate analytics: daily counts of eligible successful public-page documents prepared at our server. Repeated requests, bots and prefetches may count; delivery to a person is not established. This is not a count of people or unique visitors. No device, country, referrer or click tracking, user IDs, or cross-site profiles are collected for this metric. Coverage can be incomplete or unavailable. We do not use Umami in this release. Legal basis: Art. 6(1)(f) legitimate interest.
• Operational and security records: server operation logs help run the service and investigate problems. Legal basis: Art. 6(1)(f) legitimate interest in reliability and security. This release does not send errors to Sentry.
• Payments: this release has no paid plans and does not process payments or send billing data to Stripe.

Recipients and infrastructure

The operator manages the application, database and photo storage. Self-hosted MinIO is storage software, not a separate company receiving your photos. Hosting, backup, monitoring and email suppliers may process information needed for those functions. Google and GitHub are independent sign-in providers and process your visits under their own policies. StageTile does not sell personal data or share it with advertising networks.

Ask privacy@stagetile.com for the current operator-approved supplier list, locations and data-processing arrangements. This notice does not present unverified supplier identities or regions as established facts.

International transfers

Provider locations and any transfer safeguards depend on the operator's actual hosting and supplier arrangements. Contact the privacy address for the applicable details and how to obtain safeguards. We do not claim that an unverified adequacy decision, certification or contract covers every transfer.

How long we keep your data

StageTile keeps your data until you delete your account. There is no automatic purge on inactivity. Account deletion removes your profile, services, links, page settings, sign-in identities and active sessions, and retires your page handle. Origin analytics are removed with the account. Stored photo cleanup is queued separately; deletion of a database reference does not mean the stored object has already been erased. Cleanup failures remain queued for retry.

Aggregate origin analytics are retained for the current UTC day and the previous 89 days, a 90-day retention window. Scheduled cleanup can be delayed by service failures.

Deletion limits and backups

Retired handles have no automatic expiry, to prevent another account reusing an established page address. The photo-cleanup queue keeps the account identifier until managed storage cleanup succeeds; failed work stays queued. Operational logs, report correspondence and security records can have separate retention based on their operational or legal purpose.

Deleting live account data does not individually rewrite existing backup archives or erase copies held by other people. Backups expire under the operator's rotation. This release does not provide automatic suppression of erased accounts during a restore, so the operator must reapply deletion decisions before restored data is used. Ask the privacy contact about backup retention or a reappearing deleted page.

Your rights (EU / UK / similar jurisdictions)

• Access and rectification: the dashboard edits your public profile. Its JSON export is not a complete access report: account, sign-in, correspondence and relevant operational records may also concern you. Email the privacy contact for access or corrections beyond the dashboard, including if you cannot sign in.
• Erasure (GDPR Art. 17): use Delete account in Account settings. Recent authentication is required; an unsuccessful request is shown as a failure rather than reported as completed.
• Data portability (GDPR Art. 20): Export data returns JSON with your profile, services, links, page settings and available public photo URLs. Download any photo you want to keep before deleting the account. An export may be partial when a photo URL is unavailable.
• Objection, restriction, automated decision-making: email privacy@stagetile.com. StageTile does not perform automated decision-making.
• Complaint: you can lodge a complaint with your local data-protection authority. EU users can find theirs at edpb.europa.eu.

Privacy requests and complaints

Send requests or complaints to privacy@stagetile.com. Describe the page or account and what you need. We may ask for proportionate ownership information. Requests are normally free; applicable response deadlines and any permitted extension still apply. We investigate privacy complaints and communicate the outcome. Where UK complaint rules apply, acknowledgement is due within 30 days; rights requests normally have a one-calendar-month response period under EU and UK rules.

Children's information

Accounts are offered only to adults who are at least 18, or the higher age of majority required by the Terms. Do not create an account for a child. To report an underage account or a child's personal information on someone else's page, email privacy@stagetile.com with the page URL and concern. Our policy is to investigate, stop disallowed underage account use and remove improperly held children's data, subject to required legal preservation.

Tracking preferences

StageTile does not run advertising or cross-site tracking and does not change that behavior in response to a Do Not Track header. Public-page analytics are aggregate server counters, not a profile of a visitor.

Security

StageTile uses HTTPS in production, Google or GitHub OAuth/OIDC sign-in, server-validated CSRF tokens and same-origin checks for authenticated changes, session cookies with SameSite=Lax, and a Content Security Policy. Sign-in and session cookies are HttpOnly and Secure in production. Public pages do not load the dashboard's client runtime.

Changes

StageTile updates this policy as the service evolves. Material changes get an in-app notice or an email before they take effect.