Privacy Policy

This Privacy Policy of ShortStack.com (the "Policy") is hereby made effective as of September 2026, by Pancake Laboratories Inc., a Nevada corporation ("Pancake" or "We"), and, without waiving or otherwise releasing any right or obligation under any prior privacy policy or similar document or agreement of ShortStack.com ("ShortStack"), hereby amend and restate any such prior privacy policy.

When you open an account with ShortStack and use the ShortStack application, you will provide certain information to Pancake and, during your use of ShortStack, Pancake will learn, collect and use certain additional information about you for various purposes, as more fully set forth in this Policy. Pancake does not sell your Personal Information. Pancake does Share information about visitors to its marketing website, and about account holders signed in to the ShortStack application, with advertising partners, as described under Sale and Sharing of Personal Information below, and you may opt out of that Sharing at any time. Pancake does not disclose the personal data that you collect from your own audiences through ShortStack campaigns ("User Collected Information") to any third party except as necessary to provide the Services to you, as described in this Policy and in our Data Processing Addendum. Pancake's use of your Personal Information as a ShortStack account holder, and of information collected from visitors to our marketing website, is described in the sections that follow.

Beginning when you register for ShortStack, Pancake will learn, collect and use certain personal data and information about you and, as you use ShortStack will continue to learn, collect and use additional personal data and information (all such personal data and information is collectively referred to herein as, "Personal Information"). By providing Pancake with this information, you acknowledge that it will be collected, used, disclosed, transferred to the United States and stored by Pancake as described in our Terms and Conditions and in this Policy, on the lawful bases set out below.

Information Collected Upon Registration

In order to become a user of ShortStack, you must provide us with Personal Information, including, without limitation, name, email address, and, for any subscription account, for any subscription account, payment card details are collected directly by our payment provider and exchanged for a token that represents your card. Pancake never receives or stores your full card number; we store only the token and limited descriptive details such as the name on the card, the last four digits, and the expiration date, and tokens are excluded from our logs. Without providing Personal Information, you cannot create a ShortStack account. At the time of registration or when you choose to use certain ShortStack services, Pancake may collect certain other Personal Information from you including, without limitation, demographic information, such as location, age or gender. Pancake may request or collect Personal Information from you during any registration process which Pancake may use to provide or improve ShortStack or may use as is otherwise provided herein. Pancake may store Personal Information, and it may be included in databases owned and maintained by Pancake's affiliates, agents or service providers.

Information Collected While Using ShortStack

When you use and interact with ShortStack, Pancake also receives and stores additional Personal Information, which information may or may not be personally identifying information. Such information includes, without limitation, your internet protocol address, browser types, domain name, and other statistical data involving your use of ShortStack and/or our services. Such information is collected passively using various technologies or may be provided by you through communications with ShortStack or Pancake.

Information Collected By Pancake's Use of "Cookies"

A cookie is a small piece of information stored on your device when you access ShortStack. We use cookies in three ways. Strictly necessary cookies keep the platform working — signing you in, maintaining your session, and protecting against abuse. Analytics cookies help us understand how ShortStack and our marketing website are used so that we can measure and improve them. Advertising and targeting cookies, set by us and by our advertising partners on our marketing website, are used to measure campaigns and to show you relevant advertising on other sites; these involve Sharing as described under Sale and Sharing of Personal Information.

Where you visit from the European Economic Area, the United Kingdom, or Switzerland, analytics, advertising and targeting cookies are set only with your consent. You can change your choices at any time through our cookie preferences, and you may opt out of advertising Sharing as described under Your right to opt out. For security purposes and to ensure the availability of ShortStack, Pancake also uses software programs to monitor network traffic, to identify unauthorized attempts to upload or change information, or otherwise cause damage to ShortStack or Pancake.

Based on how the internet operates, when you visit ShortStack we automatically receive the uniform resource locator of the prior webpage that you were on and of the webpage where you go after ShortStack. Pancake also receives the internet protocol address of your computer, the type of operating system and web browser you are using, your location, date and time of your access, pages viewed on ShortStack and other information related to your visit to ShortStack. Learn more about our Cookie Policy at /cookie-policy/.

Information Provided Voluntarily When Interacting with Support

Pancake also collects information when you interact with ShortStack's customer service in order to assist you and to improve the operation of ShortStack. This includes any interactions with our team via our support site, chat support, email, and documentation, and our blog. Information shared with support may include personal information, such as your name, email address, credit card information (e.g., name on credit card, last four digits of credit card number or expiration date), an entrant or subscriber's name/email address, etc.

Information You Collect In ShortStack Lists and Display in ShortStack Campaigns and Emails

Upon the creation of a collection of data within your ShortStack lists, the uploading of a new list to ShortStack, the upload of a list to ShortStack, or the creation of an email, Pancake has access to the data on those lists, and the information in those emails and on those campaigns.

Campaign and Email Analytics Information

When you use ShortStack to send emails to your own audience, ShortStack records which recipients opened the email and which links they clicked, using a tracking pixel inserted into the message. This processing is carried out on your behalf and on your instructions: you are the controller of that data, the results are made available to you to evaluate the performance of your emails, and you are responsible for providing any notice or obtaining any consent required in your recipients' jurisdictions.

Separately, Pancake records opens and link clicks in the emails Pancake sends to you as an account holder — including service notifications, reports, and marketing emails — in order to understand whether our communications are useful and to improve them. You may opt out of marketing emails at any time using the unsubscribe link in any such email; service and account notifications are necessary to provide the Services and are not subject to opt-out.

Pancake processes your Personal Information on one or more of the following lawful bases, depending on the specific context and purpose of the processing:

• Contractual Necessity: Processing that is necessary for the performance of our contract with you, including to provide, maintain, and improve ShortStack, to manage your account, and to process billing and payments.
• Consent: Processing based on your informed consent, such as when you opt in to receive marketing communications, or when you provide Personal Information voluntarily. You may withdraw your consent at any time by contacting us at support@shortstack.com or by using the unsubscribe mechanism in any marketing email.
• Legitimate Interests: Processing that is necessary for our legitimate business interests, including to improve and develop ShortStack, to detect and prevent fraud, and to ensure the security of our platform, provided that such interests are not overridden by your rights and freedoms.
• Legal Obligation: Processing that is necessary for compliance with a legal obligation to which Pancake is subject.
• Consent (cookies and advertising): Where you visit our marketing website from the European Economic Area, the United Kingdom, or Switzerland, we set analytics, advertising and targeting cookies, and disclose information to advertising partners, only where you have given consent through our cookie banner. You may withdraw that consent at any time through our cookie preferences. We do not rely on legitimate interests for advertising or targeting.

Pancake uses your Personal Information in connection with the operation, development and improvement of ShortStack, the operation and billing of your ShortStack account, and for other uses consistent with this Policy and the lawful bases described above. Pancake may use your Personal Information for purposes related to the operation, improvement, and billing of ShortStack, including the development of additional services and products by Pancake or its affiliates, and to communicate with you regarding ShortStack, your account, updates to our services (such as temporary outages or permanent changes), product releases, or other services or products offered by Pancake. Regarding billing and payment, Personal Information you provide to Pancake will be used to send billing-related notices via email. When contacting Pancake for customer support, in order to answer your questions, Pancake may use your personal information, such as email address, name and billing information; and other account-related data. Please be aware that you are responsible for the payment of any fees or costs incurred by you in connection with receipt of communications from Pancake, including data, internet, cellular carrier or other similar fees.

Pancake recognizes the importance of the privacy of its users and does not share or otherwise provide Personal Information to third parties, except as provided herein. Pancake will not disclose or provide your Personal Information to any third party except:

• as otherwise described in this Policy;
• as otherwise required by law or to comply with legal process, including, but not limited to, civil and criminal subpoenas, court orders or other compulsory disclosures;
• as reasonably necessary to respond to claims of a violation of the rights of third parties, whether or not the third party is a user, individual, entity or government agency;
• for purposes related to the operation, improvement, and billing of ShortStack, including to manage your ShortStack account, subscription and other billing purposes, to respond to your inquiries, to allow outside vendors to perform services required by ShortStack, and to otherwise manage and operate ShortStack and develop new services and products;
• as reasonably necessary to enforce the Terms and Conditions of Service and Use of ShortStack.com (the "Terms and Conditions");
• as reasonably necessary to detect, prevent and address fraud and other illegal activity and to prevent death or imminent bodily harm; or
• as reasonably necessary to protect the rights and property of Pancake or its officers, directors, shareholders, employees or agents; or
• to advertising partners and analytics providers in connection with visits to our marketing website and signed-in use of the ShortStack application, as described under Restrictions on Use of Personal Information and Sale and Sharing of Personal Information, subject to the opt-out rights described in those sections.

Pancake does not Sell or Share (as those terms are defined under applicable data protection laws, including the California Privacy Rights Act) any personal data that you collect from your own audiences through ShortStack campaigns. Such data is processed solely on your instructions as described in our Data Processing Addendum, is not disclosed for advertising purposes, and is not combined with personal data Pancake receives from any other source.

Separately, Pancake uses advertising services on its own marketing website and within the ShortStack application. Information about visitors to that website and about account holders signed in to the application — including online identifiers, browsing activity, and, on a subscription purchase or upgrade, the amount of the transaction — may be disclosed to advertising partners for cross-context behavioral advertising, which constitutes "Sharing" under the California Privacy Rights Act. Pancake does not Sell Personal Information for monetary consideration. You may opt out of this Sharing at any time through our cookie preferences, or by transmitting a Global Privacy Control signal, which we honor. We process opt-out preference signals, including Global Privacy Control, as a valid request to opt out of Sharing.

In addition, with respect to personal data that you collect from your own audiences through ShortStack campaigns, Pancake will not: (a) retain, use, disclose, or otherwise process that data for any purpose other than the specific business purposes of performing the ShortStack Services; (b) retain, use, disclose, or otherwise process that data outside of the direct business relationship between Pancake and you; or (c) combine that data with personal information that Pancake receives from or on behalf of another person or that Pancake collects from its own interactions with individuals, except to the extent necessary to perform the Services.

Pancake may provide aggregated or de-identified data about the usage of ShortStack to third parties, including prospective advertisers or investors. Aggregated or de-identified data is data that does not identify you and cannot reasonably be used to identify you. Pancake will not attempt to re-identify such data and will not permit any third party to do so. Aggregated and de-identified data is not Personal Information, and its disclosure is not a Sale or Share.

Pancake may post, email and use any testimonials that you have provided about ShortStack, and Pancake may post and email examples of content you have created through ShortStack, in connection with the marketing and promotion of ShortStack. Testimonials and other marketing, promotions and advertisements may include obfuscated Personal Information (such as first name and general location) that you have provided to Pancake. Furthermore, Personal Information you provide to Pancake may be used to send you information, advertisements and promotional material via email. You are able to unsubscribe from these emails via the "unsubscribe" link at the bottom of each email communication.

Pancake may disclose your Personal Information to a third party as part of a sale of the assets of Pancake, as the result of a change in control of the company, or in connection with an investment in Pancake by a third party. Any third party to which Pancake transfers or sells Pancake's assets may continue to use your Personal Information, provided that such use remains subject to this Policy or to a successor privacy policy that affords a level of protection at least equivalent to this Policy. With respect to personal data received in reliance on the Data Privacy Framework, any such party must continue to apply the DPF Principles to that personal data or provide a level of protection at least equivalent to that required by the DPF Principles; if it will not agree to do so, Pancake will not transfer that personal data to it. See Your Choices for Limiting the Use and Disclosure of Your Personal Data.

Pancake notifies all customers of any change to the subprocessor list — including the addition or replacement of a subprocessor — in-app and by email before the change takes effect. No sign-up is required. Where a change must be made immediately to maintain the security, integrity, or availability of the Services, or to comply with a legal obligation, we will notify customers as soon as reasonably practicable after the change rather than before it, and the objection process described below applies from the date of that notice. A current list is maintained at /subprocessors/.

Among other functions of ShortStack, you may create a webpage that collects certain information from customers and other persons that visit your webpage. Should you create any webpage or form that collects personal information or other information related to any person or party visiting that page ("User Collected Information") or import a list of User Collected Information to ShortStack that was compiled outside of ShortStack, you represent and warrant to Pancake that any and all User Collected Information has been collected in accordance with any applicable laws, rules or regulation and not in violation of any privacy or similar rights of such persons or parties.

Prohibition on Sensitive Data

You may not provide (or cause to be provided) any Sensitive Data to Pancake for processing through ShortStack. "Sensitive Data" includes, without limitation: (a) special categories of personal data as defined in Article 9 of the GDPR (e.g., data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation); (b) personal data relating to criminal convictions and offenses; (c) "Sensitive Personal Information" as defined under the California Privacy Rights Act; (d) social security numbers, tax file numbers, passport numbers, or driver's license numbers; (e) credit or debit card numbers (other than as required for billing purposes); (f) account passwords; or (g) any similar category under other applicable data protection laws. Pancake will have no liability for any Sensitive Data provided in violation of this restriction. If Pancake becomes aware that Sensitive Data has been submitted to or is being processed through ShortStack, Pancake reserves the right, but has no obligation, to delete such data and/or notify the applicable customer. Pancake has no obligation to actively screen or monitor for the presence of Sensitive Data. For further details, please refer to the Sensitive Data provisions of the Data Processing Addendum.

As a part of ShortStack, Pancake may store such User Collected Information, but asserts, and you hereby agree and acknowledge, that Pancake has no right, title or interest in or to such information, has not determined the content, purpose, or means of such collection, and has no responsibility or obligation with respect to the legal compliance of your collection practices with respect to such information. Pancake will retain User Collected Information we process for our users until the ShortStack user deletes the User Collected Information, deletes their account, or as long as necessary to execute ShortStack-related services. Deletion timelines are described under Data Retention and Deletion. However, Pancake may disclose any User Collected Information in the same manner, and under the same circumstances, as any Personal Information may be disclosed. You hereby indemnify and hold harmless Pancake, and all of its officers, directors, shareholders, employees and agents, with respect to any claim, suit or liability (including attorney's fees and related costs), arising from your User Collected Information.

ShortStack is a platform used by businesses and individuals to create interactive campaigns, forms, and promotions. Pancake does not knowingly collect Personal Information directly from children under the age of 13 (or under the age of 16 for individuals in the European Economic Area, United Kingdom, or Switzerland).

However, Pancake acknowledges that ShortStack users may create publicly accessible campaigns, contests, promotions, or forms that could be accessed or completed by individuals of any age, including children. Pancake does not control the audiences to which its users direct their campaigns, and Pancake has no practical ability to verify the age of individuals who interact with user-created campaigns.

If you use ShortStack to create campaigns, forms, or promotions that may be accessed by children under the age of 13 (or under the applicable age of consent in your jurisdiction), you are solely responsible for compliance with the U.S. Children's Online Privacy Protection Act ("COPPA"), Article 8 of the GDPR, and any other applicable laws governing the collection of personal information from minors. This includes, without limitation, obtaining verifiable parental consent where required by law. Pancake assumes no responsibility for your compliance with such laws.

If Pancake becomes aware that a user's campaign, form, or promotion is collecting personal information from children in violation of COPPA, the GDPR, or other applicable law, Pancake reserves the right to suspend or remove the campaign and/or suspend or terminate the user's ShortStack account, in addition to any other remedies available under the Terms and Conditions.

If we become aware that Personal Information from a child under the applicable age has been submitted directly to Pancake (as opposed to collected by a ShortStack user through a user-created campaign), we will take steps to delete such information as soon as practicable. If you believe that a child has provided Personal Information directly to Pancake, please contact us at support@shortstack.com.

You may update, modify or correct your Personal Information via your account Preferences. Alternatively, you may contact support@shortstack.com for updates, modifications and corrections to your Personal Information, or to request access to your Personal Information.

Retention Of Your Personal Information

You may request deletion of your Personal Information at any time by contacting Pancake in the manner provided on ShortStack. Pancake will endeavor to respond to your request in a timely manner. Once a request to delete a ShortStack user's Personal Information is received, it will be removed from our production systems within thirty (30) days, and from backup and archival systems within a further thirty (30) days. Entries and lists deleted from within a live account are hidden immediately and permanently erased from our production systems thirty (30) days after deletion, with backup copies expiring within a further thirty (30) days. During that thirty (30) day period you may ask us to restore an account you closed in error by contacting support@shortstack.com. Once the period has elapsed the account cannot be restored, including from a backup. You may delete your account within the Preferences section of your ShortStack account. Alternatively, you may contact support@shortstack.com to delete your account.

European Union (EU) General Data Protection Regulation ("GDPR")

For our users living or doing business in the EU, Pancake is subject to the GDPR.

Where Pancake acts as a controller of your personal data — for example, information about you as a ShortStack account holder, information you provide when contacting us, and information collected about visitors to our marketing website — you have the right to:

• request access to the personal data we hold about you, and a copy of it;
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data;
• request that we restrict the processing of your personal data;
• object to processing carried out on the basis of our legitimate interests, and to object at any time to processing for direct marketing;
• receive your personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible; and
• withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact support@shortstack.com. There is no charge. We will respond within one month; where a request is complex or where we have received a number of requests, we may extend that period by up to two further months and will tell you within the first month if we do. We may ask for information reasonably necessary to confirm your identity.

Where Pancake processes personal data on behalf of a ShortStack customer — for example, entries and contact details collected through that customer's campaign — that customer is the controller and is responsible for responding to your request. If you contact us about such data, we will promptly notify the relevant customer and assist them in responding.

EU and UK Representatives

Pancake has appointed representatives under Article 27 of the GDPR and Article 27 of the UK GDPR:

• European Union: Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria.
• United Kingdom: Prighter Ltd, 20 Mortlake High Street, London SW14 8JN, United Kingdom.

You may contact either representative directly on any matter relating to our processing of your personal data, in the language of your choice. You may also raise a request online at prighter.com/q/19222412132. Please quote reference ID-19222412132 in any correspondence with a representative. Contacting a representative does not replace your right to contact us at support@shortstack.com or to lodge a complaint with your supervisory authority.

Lodging a Complaint with a Supervisory Authority

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the right to lodge a complaint about our processing of your personal data with the supervisory authority in your country of residence, your place of work, or the place where the alleged infringement occurred. Exercising this right does not affect any other remedy available to you.

This statutory right is separate from, and is not part of, the recourse mechanism available under the Data Privacy Framework. For personal data that Pancake received in reliance on the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. Data Privacy Framework, the independent recourse mechanism designated in Pancake's certification is the ICDR-AAA Independent Review Mechanism, as described under DPF Complaint Resolution.

United Kingdom General Data Protection Regulation ("UK GDPR")

For our users living or doing business in the United Kingdom, Pancake is subject to the UK GDPR and the UK Data Protection Act 2018. The rights and response times described under the GDPR section above apply equally to personal data subject to the UK GDPR.

Swiss Federal Act on Data Protection ("nFADP")

For our users living or doing business in Switzerland, Pancake is subject to the Swiss Federal Act on Data Protection of 25 September 2020 and its implementing ordinances. The rights and response times described under the GDPR section above apply equally to personal data subject to the nFADP.

California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CPA")

For our users living or doing business in California, Pancake is subject to the CPA.

Other U.S. State Privacy Rights

A number of U.S. states have comprehensive privacy laws that may apply depending on where you live and on whether Pancake meets the applicability thresholds in your state. Without conceding that any particular law applies, Pancake extends the following rights to residents of U.S. states with comprehensive privacy laws: the right to confirm whether we process your personal data and to access it; the right to correct inaccuracies; the right to delete personal data; the right to obtain a copy in a portable format; and the right to opt out of processing for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions producing legal or similarly significant effects.

To exercise these rights, contact support@shortstack.com, or use our cookie preferences, or transmit a Global Privacy Control signal, to opt out of targeted advertising. We honor Global Privacy Control signals. We will not discriminate against you for exercising these rights. Where your state provides a right to appeal a decision on a request, you may appeal by replying to our response or by contacting support@shortstack.com, and we will respond within the period your state's law allows.

Nevada Privacy Law

For our users living or doing business in Nevada, Pancake is subject to the Nevada Privacy Law.

Canadian Personal Information Protection and Electronic Documents Act ("PIPEDA")

For our users living or doing business in Canada, Pancake is subject to PIPEDA.

Brazilian General Data Protection Law ("LGPD")

For our users living or doing business in Brazil, Pancake is subject to the Lei Geral de Proteção de Dados (LGPD), Federal Law No. 13,709/2018.

Australian Privacy Act of 1988 ("Australian Privacy Act")

For our users living or doing business in Australia, Pancake is subject to the Australian Privacy Act.

If we received your personal data in reliance on the Data Privacy Framework, additional rights and recourse mechanisms apply — see Data Privacy Framework (DPF).

For our users living or doing business in California, Pancake is subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (collectively, the "CPA").

Sale and Sharing of Personal Information

Pancake does not Sell Personal Information for monetary consideration.

Pancake does not Share the personal data you collect from your own audiences through ShortStack campaigns. With respect to that data, Pancake acts as a Service Provider and processes it solely for the business purpose of providing the Services.

Pancake does Share information about visitors to its marketing website, and about account holders signed in to the ShortStack application — including online identifiers, device information, browsing activity, and, on a registration, subscription purchase or upgrade, the amount of the transaction — with advertising partners for cross-context behavioral advertising. Categories of information Shared: identifiers, internet or other electronic network activity information, and commercial information. Categories of third parties: advertising networks and analytics providers.

Our advertising partners, and their role. The advertising partners we use for this purpose are Meta Platforms, Inc. and LinkedIn Corporation. Where you are in the European Economic Area, the United Kingdom or Switzerland, Pancake and Meta act as joint controllers for the targeting and delivery of advertising based on this information, as set out in Meta's Business Tools Terms; for the matching and measurement that precedes it, Meta acts as our processor, and for its own subsequent purposes Meta acts as an independent controller. You may exercise your data protection rights in respect of that joint processing against either Pancake or Meta. Meta's own disclosures describe the information it receives and how it uses it. The same analysis applies to LinkedIn Corporation in respect of its Insight Tag.

Where the opt-out controls operate. The cookie preference controls and Global Privacy Control handling described in this Policy operate on our marketing website. To opt out of Sharing in connection with your signed-in use of the ShortStack application, contact support@shortstack.com and we will give effect to your request.

Campaign entrants are not affected by the above. This Sharing concerns our own marketing website and application only. Where you submit information to a ShortStack campaign operated by one of our customers, Pancake does not Share that information with advertising partners, and does not act as a joint controller with any advertising partner in respect of it. If the customer operating that campaign has enabled its own advertising or analytics tags, the customer — not Pancake — determines that processing, and the customer's own privacy notice governs it.

Your right to opt out. You may opt out of this Sharing at any time by declining the Targeting category in our cookie preferences, or by transmitting a Global Privacy Control signal, which we process as a valid opt-out request. We honor Global Privacy Control signals. We will not discriminate against you for exercising this right.

Right to Know and Right to Access Personal Information Collected

The CPA gives California residents the right to learn more about the types of data Pancake collects. To learn more, please visit the What Information We Learn, Collect and Use section above. Pancake collects this information to further the business purposes described in section How We Use Your Personal Information. California residents have the right to request the specific pieces of personal information we have collected about them, together with the categories of personal information, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclosed it. This right is not limited to the preceding twelve (12) months, except where responding beyond that period would be impossible or would involve disproportionate effort, in which case we will tell you. To make a request, contact support@shortstack.com.

Categories of Personal Information We Collect

How Long We Keep Personal Information

We retain each category of personal information only as long as needed for the purposes described above:

• Account and profile information, and commercial information: for the duration of your account, and thereafter as described under Data Retention and Deletion.
• Application and network logs: thirty (30) days. These logs record request paths, IP addresses and request parameters, so information submitted through a campaign form may appear in them. They are deleted automatically on expiry.
• Visitor activity records attached to a campaign entry: erased immediately when the entry is deleted.
• Dormant free accounts: where an account has no paid subscription and has not been accessed for eighteen (18) months, the account and all associated data are deleted, as described in our Terms and Conditions.
• Billing and invoice records: for the period required by our tax and financial record-keeping obligations, as described under Data Retention and Deletion.
• Support correspondence: support tickets are deleted two (2) years after the ticket was last updated, and files attached to a support ticket are deleted ninety (90) days after the ticket was last updated. We keep tickets for that period to maintain a record of our support relationship with you — including without limitation to respond to and evidence account, billing and cancellation requests, to answer later questions about an earlier interaction, to improve our support and our documentation, and to establish, exercise or defend legal claims. Where retention is required in connection with an actual or anticipated legal claim, or by law, the applicable records are retained until that matter is resolved.

Where a category is retained for a limited period, personal information in that category is no longer available once the period has elapsed, including in response to a request to know. Where we respond to a request and a category is no longer held, we will tell you so rather than returning an incomplete response without explanation.

Authorized Agents

You may use an authorized agent to submit a request on your behalf. We will require written permission signed by you authorizing the agent to act, and we may require you to verify your own identity directly with us before we act on the request.

How We Verify Requests

Before acting on a request to know, correct, or delete, we will verify your identity. For account holders we will normally do so by confirming control of the email address on the account. Where a request concerns sensitive or high-volume personal information, we may ask for additional information. We will not act on a request we cannot reasonably verify, and we will tell you why.

Right to Correct Inaccurate Personal Information

California residents have the right to request correction of inaccurate Personal Information that Pancake holds about them. You may submit a correction request by contacting support@shortstack.com or by modifying your information via your account Preferences.

Right to Limit Use and Disclosure of Sensitive Personal Information

The CPA gives California residents the right to limit the use and disclosure of Sensitive Personal Information. The only Sensitive Personal Information Pancake processes is your account log-in credentials, which are used solely to authenticate you. Passwords are stored only as salted one-way hashes, are never used for any other purpose, are not disclosed to any third party, and are not used to infer characteristics about you. Because Pancake does not use or disclose Sensitive Personal Information for any purpose beyond those permitted under the CPA, no separate right to limit applies. Payment card numbers are never received or stored by Pancake; see Information Collected Upon Registration.

Cookie Policy

Pancake does use cookies on our website. You can learn more about our Cookie Policy at /cookie-policy/.

Deleting Your Personal Information

The CPA gives California residents and those doing business in California the right to delete Personal Information collected by Pancake. You may delete your account within the account Preference section of your ShortStack account. Alternatively, you may contact support@shortstack.com to request the deletion of your Personal Information. Please note, if your Personal Information is scheduled for deletion, but you wish to exercise your right to receive a copy of it, then you must make this request within 7 days of requesting your account be deleted.

Non-Discrimination

Pancake will not discriminate against you for exercising any of your rights under the CPA. We will not deny you services, charge you different prices or rates, provide you a different level or quality of services, or suggest that you will receive a different price or rate or a different level or quality of services for exercising your rights.

For our users living or doing business in Australia, Pancake is subject to the Australian Privacy Act of 1988 ("Australian Privacy Act").

Pancake's Use of Personal Information for Direct Marketing

Pancake will not use your Personal Information for the purpose of direct marketing unless you have consented to its use; you can reasonably expect to receive direct marketing from our team; or we believe you to be interested in receiving the marketing emails despite not having obtained your consent. You may opt out of email marketing materials through an unsubscribe mechanism in the email or by contacting us directly at support@shortstack.com. However, opting out of direct marketing messages will not prevent you from receiving non-marketing system emails, such as system alerts and account-related messages.

Server Location

Our servers are located in the United States. You can learn more about our data security and privacy practices in our Security FAQs.

Accuracy And Access Of Your Personal Information

As per the Australian Privacy Act, if you believe that Personal Information Pancake holds about you is inaccurate, you may update, modify or correct your Personal Information via your account Preferences or contact support@shortstack.com to update, modify or correct your Personal Information.

For our users living or doing business in Brazil, Pancake is subject to the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados — LGPD), Federal Law No. 13,709/2018.

Under the LGPD, Brazilian data subjects have the right to: confirmation of the existence of processing; access to their data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary or excessive data; portability of data to another service provider; deletion of personal data processed with consent; information about public and private entities with which Pancake has shared data; information about the possibility of denying consent and the consequences of such denial; and revocation of consent.

To exercise any of these rights, please contact us at support@shortstack.com. Pancake will respond to LGPD data subject requests in accordance with the timelines established by applicable law.

Pancake Laboratories Inc. provides a Data Processing Addendum (DPA), which customers can view and download at /data-processing/. The DPA is incorporated into the Terms and Conditions by reference.

Pancake implements and maintains technical, physical, administrative, and organizational measures designed to protect Personal Information against theft, unauthorized or unlawful acquisition, access, or processing, accidental loss, destruction, alteration, or damage. For information regarding Pancake's specific security practices, controls, and certifications, please contact support@shortstack.com to request a copy of our Comprehensive Security Documentation, subject to applicable confidentiality obligations. A general overview is also published in our Security FAQs at /security-faqs/; that overview is provided for information only and the Comprehensive Security Documentation governs in the event of any inconsistency.

In the event of a security breach affecting your Personal Information or the information of individuals on your ShortStack lists, Pancake will notify you without undue delay, and in any event within forty-eight (48) hours of becoming aware of the breach, on both the nature of the breach and the actions taken to address it. Pancake's notice will include, to the extent reasonably available: (a) the dates and times of the breach; (b) the facts underlying the discovery of the breach; (c) a description of the Personal Information involved; and (d) the measures planned or underway to remedy or mitigate the vulnerability giving rise to the breach.

Pancake will cooperate with affected users and take commercially reasonable steps to assist in complying with any obligations under applicable data protection laws, including any obligation to notify a supervisory authority or communicate a breach to affected individuals.

Pancake will process Personal Information for the duration of your use of ShortStack. Where you choose to delete your ShortStack account, Pancake will delete your Personal Information from its production systems thirty (30) days after closure. During those thirty (30) days you may ask us to restore the account by contacting support@shortstack.com. Where Pancake terminates an account — for example following disablement for non-payment or for a policy violation — deletion completes ninety (90) days after disablement, as described in our Terms and Conditions. In either case, copies held in backup and archival systems expire on their own retention schedules within a further thirty (30) days. The same two-stage schedule applies to entries, lists and files uploaded by entrants that you delete from within a live account. Such copies are not used to restore deleted data, except where retention is required by applicable law.

Separately from the timelines above, operational logs generated in the course of providing the Services may contain data submitted through campaigns. These logs are retained for thirty (30) days and are then deleted automatically. They are not used to restore deleted data and cannot be selectively purged before they expire.

Support correspondence is retained separately from the timelines above. Support tickets are deleted two (2) years after the ticket was last updated, and files attached to a support ticket are deleted ninety (90) days after the ticket was last updated. Pancake keeps tickets for that period to maintain a record of our support relationship with you — including without limitation to respond to and evidence account, billing and cancellation requests, to answer later questions about an earlier interaction, to improve our support and our documentation, and to establish, exercise or defend legal claims. Where retention is required in connection with an actual or anticipated legal claim, or by law, the applicable records are retained until that matter is resolved.

Pancake retains records of your subscription, invoices, payments, and usage, together with the aggregate usage counts underlying any charges, independently of the personal data processed on your behalf. These records are retained following deletion of your account for the purpose of substantiating charges, resolving billing disputes, and meeting Pancake's financial and tax record-keeping obligations, and are held by Pancake's billing provider as identified on our Subprocessors page. Where retention is required to comply with a legal obligation, that retention continues notwithstanding a request for deletion.

Within seven (7) days of account termination, you may request that Pancake: (a) return a complete copy of your Personal Information in a commonly used machine-readable format; and/or (b) delete all copies of your Personal Information processed by Pancake and its subprocessors. To make such a request, contact support@shortstack.com.

Pancake may retain Personal Information to the extent and for such period as required by applicable laws, provided that Pancake will ensure the confidentiality of all such data and will only process it as necessary for the purposes specified in the applicable law. Upon expiration of any applicable legal retention period, Pancake will delete or destroy all remaining Personal Information from active systems within thirty (30) days, and from backup and archival systems within a commercially reasonable period thereafter.

ShortStack complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. ShortStack has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles with regard to the processing of personal data received from the European Union, the United Kingdom, and Switzerland in reliance on the applicable DPF frameworks. If there is any conflict between the terms in this Policy and the DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Pancake Laboratories Inc. complies with the DPF Principles for all onward transfers of personal information from the EU, the United Kingdom, and Switzerland, including the onward transfer liability provisions. Pancake Laboratories Inc. shall not be held liable for third-party service providers processing personal information in violation of DPF Principles, unless it is proven that Pancake Laboratories Inc. is solely responsible for the third-party service providers' action in violation of the Principles.

With respect to personal information received or transferred pursuant to the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Pancake Laboratories Inc. is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain situations, Pancake Laboratories Inc. may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Your Choices for Limiting the Use and Disclosure of Your Personal Data

Where we have received your personal data in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF, we offer you the opportunity to choose (opt out) whether your personal data is:

• disclosed to a third party; or
• used for a purpose that is materially different from the purpose for which it was originally collected or that you subsequently authorized.

To exercise either choice, email us at support@shortstack.com with "DPF – Choice Request" in the subject line, or use the unsubscribe link at the bottom of any marketing email. There is no charge for making a request, and you do not need a ShortStack account to make one. We will confirm receipt and act on your request without undue delay and in any event within thirty (30) days. Where a request is complex, or where we have received a number of requests, we may extend that period by up to a further thirty (30) days; if we do, we will tell you within the initial thirty (30) day period and explain why.

We do not need to offer you this choice when we disclose personal data to a third party that acts as our agent, performing tasks on our behalf and under our instructions. In every such case we enter into a written contract with that agent requiring it to provide at least the same level of protection as the DPF Principles require. The agents and subprocessors we currently use are listed at /subprocessors/.

ShortStack cannot be provided without these agents — they host the platform, deliver email, and process payments — so there is no way to continue using the Services while excluding them.

Where a ShortStack customer objects, on reasonable grounds relating to data protection, to a new subprocessor we propose to add, the customer's remedy is set out in the Subprocessors section of this Policy and in the Subprocessors section of the Data Processing Addendum: we will work together in good faith toward a mutually acceptable resolution, and if we cannot reach one, either party may terminate the affected Service. There is no objection right in respect of subprocessors already in use at the time a customer subscribes.

If you are an individual rather than a ShortStack customer — for example, someone who entered a campaign built with ShortStack — the objection right described above belongs to the ShortStack customer, not to you. You may instead ask us to delete your personal data, and where that data was collected by a ShortStack customer we will refer your request to them.

This choice also does not apply to a transfer of personal data that occurs as part of a merger, acquisition, sale of all or substantially all of our assets, change of control, or investment in Pancake by a third party. Where personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF is transferred in any such transaction, Pancake will require the acquiring or receiving party, as a condition of the transfer, either to continue to apply the DPF Principles to that personal data or to provide a level of protection at least equivalent to that required by the DPF Principles. If the acquiring or receiving party will not agree to do so, Pancake will not transfer that personal data to it. We will update this Policy to identify the acquiring or receiving party prior to, or promptly following, any such transfer.

For sensitive information — personal data specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or information specifying an individual's sex life — we will obtain your affirmative express consent (opt in) before disclosing it to a third party or using it for a purpose other than the one for which it was originally collected or subsequently authorized by you. We also treat as sensitive any personal data we receive from a third party where that third party identifies and treats it as sensitive. Separately, and as described in Prohibition on Sensitive Data, ShortStack is not intended for the collection of sensitive information and users are prohibited from submitting it through the Services; the commitment in this paragraph applies to any sensitive information that Pancake nonetheless receives or holds.

Your Right to Access Your Personal Data

Where we hold personal data about you that we received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF, you have the right to access that personal data, and to have it corrected, amended, or deleted where it is inaccurate or has been processed in violation of the DPF Principles.

To make a request, email us at support@shortstack.com with "DPF – Access Request" in the subject line. There is no charge. We will respond without undue delay and in any event within thirty (30) days. Where a request is complex, or where we have received a number of requests, we may extend that period by up to a further thirty (30) days; if we do, we will tell you within the initial thirty (30) day period and explain why. We may ask you for information reasonably necessary to confirm your identity before we act on the request.

Where a request results in the deletion of your personal data, the timelines described in Data Retention and Deletion apply. Any extension described above applies only to the time we may take to respond to a request, and not to the deletion itself.

We may limit or deny access where the burden or expense of providing it would be disproportionate to the risks to your privacy in the case in question, or where the rights of persons other than you would be violated. If we limit or deny a request, we will tell you why and explain how you can challenge that decision.

The response commitment described above applies to personal data that Pancake holds as a controller — that is, information about you as a ShortStack account holder, or as a person who has contacted us directly.

Where we process personal data on behalf of a ShortStack customer — for example, entries, contact details, and other information that a customer collects from its own audience through a ShortStack campaign — we act as a processor on that customer's instructions, and that customer, rather than Pancake, is responsible for responding to your request. If you contact us about that data, we will promptly notify the relevant customer of your request and will assist them in responding to you as required under our Data Processing Addendum. Because the timing of any response is determined by that customer, the thirty (30) day commitment described above does not apply to such requests. If you tell us which campaign or brand you submitted your information to, we will identify the relevant customer for you where we are reasonably able to do so.

Under the GDPR and UK GDPR, roles depend on the data in question. For personal data that you collect from your own audiences through ShortStack campaigns, you (the ShortStack customer) are the Data Controller and ShortStack is the Data Processor. For personal data that Pancake processes about you as an account holder — including registration, billing, support, and marketing-website activity — Pancake is the Controller. ShortStack's Data Privacy Framework certification, together with the Standard Contractual Clauses (including the UK Addendum for UK transfers) incorporated in the Data Processing Addendum, provide the legal mechanisms for the transfer of personal data from the EU, UK, and Switzerland to the United States (where ShortStack's servers are located). The DPA is available at /data-processing/.

Data Protection Officer

Pancake has appointed a data protection officer, who can be reached at support@shortstack.com.

Platform Security

Check out our Security FAQs page at /security-faqs/ for more specific information on platform security.

Pancake engages third-party subprocessors to assist in providing the ShortStack Services. A current list of subprocessors is maintained at /subprocessors/. Pancake notifies all customers of any change to the subprocessor list in-app and by email before the change takes effect.

If a ShortStack customer objects to Pancake's use of a new subprocessor, the customer may notify Pancake in writing (via email to support@shortstack.com) within fifteen (15) business days after receipt of Pancake's notice. Objections must be based on reasonable grounds relating to data protection. If Pancake and the customer are unable to resolve such objection, either party may terminate the applicable service. For full details, please refer to the Subprocessor provisions of the Data Processing Addendum.

In compliance with the DPF Principles, Pancake Laboratories Inc. commits to resolve complaints about our collection or use of your personal information. Individuals in the European Union, the United Kingdom, and Switzerland with inquiries or complaints regarding our DPF policy should first contact Pancake Laboratories Inc. at: support@shortstack.com.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, ShortStack commits to refer unresolved complaints concerning our handling of personal data received in reliance on the DPF to the ICDR-AAA, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.adr.org/ for more information or to file a complaint. The services of ICDR-AAA are provided at no cost to you.

U.S. Federal Trade Commission

With respect to personal data received or transferred pursuant to the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Pancake Laboratories Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.

Binding Arbitration

Under certain conditions, you may invoke binding arbitration for any residual claim that has not been resolved by the other recourse mechanisms described above. The claim would be heard by the "EU-U.S. Data Privacy Framework Panel" or, for personal data received under the Swiss-U.S. DPF, the "Swiss-U.S. Data Privacy Framework Panel" — an arbitral panel of one or three arbitrators, as agreed by the parties. This right, and the procedures that govern it, are set out in Annex I to the DPF Principles.

Before invoking arbitration, you must first: (1) raise the claimed violation directly with us and give us an opportunity to resolve it; (2) use the independent recourse mechanism described above (ICDR-AAA), at no cost to you; and (3) raise the issue through your data protection authority to the U.S. Department of Commerce and allow the Department an opportunity to use best efforts to resolve it, at no cost to you.

Arbitration is not available if the same claimed violation has previously been subject to binding arbitration, was the subject of a final judgment entered in a court action to which you were a party, or was previously settled by the parties.

To invoke arbitration, deliver a written notice to us at support@shortstack.com, or by mail to Pancake Laboratories Inc., 518 Pyramid Way, Sparks, Nevada 89431, USA. The notice must contain a summary of the steps you have taken to resolve the claim, a description of the alleged violation, and — at your option — any supporting documents and materials and/or a discussion of the law relating to the claim.

What the panel can award. The panel has the authority to impose individual-specific, non-monetary equitable relief — such as access to, correction, deletion, or return of the personal data in question — that is necessary to remedy the violation of the Principles with respect to you. These are the only remedies available: no damages, costs, fees, or other remedies may be awarded, and each party bears its own attorney's fees.

How arbitration works. The arbitration takes place in the United States. You may choose to participate by video or telephone at no cost to you; in-person participation is not required. The language of the arbitration is English unless the parties agree otherwise, and interpretation and translation will be provided at no cost to you upon a reasoned request. Materials submitted to the arbitrators are treated confidentially and used only in connection with the arbitration. Arbitrations should be completed within 90 days of the delivery of your notice to us, unless the parties agree otherwise. Arbitrators' fees are met from a fund administered by the ICDR-AAA to which participating organizations contribute.

Pancake Laboratories Inc. is obligated to arbitrate claims and to follow the terms set forth in Annex I to the DPF Principles, provided that you have invoked binding arbitration by delivering notice to us and following the procedures and subject to the conditions set forth in Annex I. Full details are available at https://www.dataprivacyframework.gov/.

ShortStack may from time to time incorporate artificial intelligence or machine learning features into its Services. Where such features process Personal Information, Pancake will do so in accordance with this Policy and the Data Processing Addendum.

Pancake will not use your Personal Information to develop, train, or improve artificial intelligence or machine learning models, whether those models are operated by Pancake or by a third party, without your affirmative express consent. Using your Personal Information for model development or training would be a purpose materially different from the purposes for which it was collected, and Pancake will not do so on an opt-out basis.

Pancake may use aggregated or de-identified data to develop, train, and improve artificial intelligence and machine learning features. Aggregated or de-identified data is data that does not identify you and cannot reasonably be used to identify you. Pancake will not attempt to re-identify such data, and will not permit any third party to do so.

If ShortStack introduces AI-powered features that involve new categories of data processing, Pancake will update this Policy prior to or concurrent with the launch of such features.

Pancake does not make decisions about you based solely on automated processing that produce legal effects concerning you or that similarly significantly affect you. If that changes, we will update this Policy before the change takes effect.

If any provision of this Policy is found by a court of competent jurisdiction or arbitrator to be illegal, void, or unenforceable, the unenforceable provision will be modified so as to render it enforceable and effective to the maximum extent possible in order to effect the intention of the provision; and if a court or arbitrator finds the modified provision invalid, illegal, void or unenforceable, the validity, legality and enforceability of the remaining provisions of this Policy will not be affected in any way.