Privacy Policy

This Privacy Policy of ShortStack.com (the “Policy”) is hereby made effective as of July 2026, by Pancake Laboratories, Inc., a Nevada corporation (“Pancake” or “We”), and, without waiving or otherwise releasing any right or obligation under any prior privacy policy or similar document or agreement of ShortStack.com (“ShortStack”), hereby amend and restate any such prior privacy policy.

By using or accessing ShortStack, you thereby (i) agree and acknowledge that you have read and understood this Policy, and (ii) acknowledge and consent to the learning, collection and use of your Personal Information (as hereinafter defined) as described in this Policy. If you do not agree with any portion of this Policy, you are prohibited from using or accessing ShortStack.

When you open an account with ShortStack and use the ShortStack application, you will provide certain information to Pancake and, during your use of ShortStack, Pancake will learn, collect and use certain additional information about you for various purposes, as more fully set forth in this Policy. Even though Pancake will learn, collect and use information about you, Pancake will not lease, sell, share or otherwise provide your Personal Information (as hereinafter defined) to any third party without your consent, except as provided herein.

Beginning when you register for ShortStack, Pancake will learn, collect and use certain personal data and information about you and, as you use ShortStack will continue to learn, collect and use additional personal data and information (all such personal data and information is collectively referred to herein as, “Personal Information”). By providing Pancake with this information, you consent to this information being collected, used, disclosed, transferred to the United States and stored by Pancake, as described in our Terms and Conditions and in this Policy.

Information Collected Upon Registration

In order to become a user of ShortStack, you must provide us with Personal Information, including, without limitation, name, email address, and, for any subscription account, billing and credit card information. Without providing Personal Information, you cannot create a ShortStack account. At the time of registration or when you choose to use certain ShortStack services, Pancake may collect certain other Personal Information from you including, without limitation, demographic information, such as location, age or gender. Pancake may request or collect Personal Information from you during any registration process which Pancake may use to provide or improve ShortStack or may use as is otherwise provided herein. Pancake may store Personal Information, and it may be included in databases owned and maintained by Pancake’s affiliates, agents or service providers.

Information Collected While Using ShortStack

When you use and interact with ShortStack, Pancake also receives and stores additional Personal Information, which information may or may not be personally identifying information. Such information includes, without limitation, your internet protocol address, browser types, domain name, and other statistical data involving your use of ShortStack and/or our services. Such information is collected passively using various technologies or may be provided by you through communications with ShortStack or Pancake.

Information Collected By Pancake’s Use of “Cookies”

A cookie is a piece of information that ShortStack gives to your computer when you access ShortStack. Cookies are used by Pancake to track your usage of ShortStack, trends on the usage of ShortStack and to improve ShortStack and analyze and assess changes to, successes and failures of ShortStack and portions thereof. For security purposes and to ensure the availability of ShortStack, Pancake also uses software programs to monitor network traffic, to identify unauthorized attempts to upload or change information, or otherwise cause damage to ShortStack or Pancake.

Based on how the internet operates, when you visit ShortStack we automatically receive the uniform resource locator of the prior webpage that you were on and of the webpage where you go after ShortStack. Pancake also receives the internet protocol address of your computer, the type of operating system and web browser you are using, your location, date and time of your access, pages viewed on ShortStack and other information related to your visit to ShortStack. Learn more about our Cookie Policy at /cookie-policy/.

Information Provided Voluntarily When Interacting with Support

Pancake also collects information when you interact with ShortStack’s customer service in order to assist you and to improve the operation of ShortStack. This includes any interactions with our team via our support site, chat support, email, and documentation, and our blog. Information shared with support may include personal information, such as your name, email address, credit card information (e.g., name on credit card, last four digits of credit card number or expiration date), an entrant or subscriber’s name/email address, etc.

Information You Collect In ShortStack Lists and Display in ShortStack Campaigns and Emails

Upon the creation of a collection of data within your ShortStack lists, the uploading of a new list to ShortStack, the upload of a list to ShortStack, or the creation of an email, Pancake has access to the data on those lists, and the information in those emails and on those campaigns.

Campaign and Email Analytics Information

When you use ShortStack to send emails, we track information about who has opened the emails and clicked the links. This is done through the use of a tracking pixel that is automatically inserted into the emails that are sent. This information is used to allow you (the ShortStack user) to evaluate the performance of the emails you send.

Pancake processes your Personal Information on one or more of the following lawful bases, depending on the specific context and purpose of the processing:

• Contractual Necessity: Processing that is necessary for the performance of our contract with you, including to provide, maintain, and improve ShortStack, to manage your account, and to process billing and payments.
• Consent: Processing based on your informed consent, such as when you opt in to receive marketing communications, or when you provide Personal Information voluntarily. You may withdraw your consent at any time by contacting us at support@shortstack.com or by using the unsubscribe mechanism in any marketing email.
• Legitimate Interests: Processing that is necessary for our legitimate business interests, including to improve and develop ShortStack, to detect and prevent fraud, and to ensure the security of our platform, provided that such interests are not overridden by your rights and freedoms.
• Legal Obligation: Processing that is necessary for compliance with a legal obligation to which Pancake is subject.

Pancake uses your Personal Information in connection with the operation, development and improvement of ShortStack, the operation and billing of your ShortStack account, and for other uses consistent with this Policy and the lawful bases described above. Pancake may use your Personal Information for purposes related to the operation, improvement, and billing of ShortStack, including the development of additional services and products by Pancake or its affiliates, and to communicate with you regarding ShortStack, your account, updates to our services (such as temporary outages or permanent changes), product releases, or other services or products offered by Pancake. Regarding billing and payment, Personal Information you provide to Pancake will be used to send billing-related notices via email. When contacting Pancake for customer support, in order to answer your questions, Pancake may use your personal information, such as email address, name and billing information; and other account-related data. Please be aware that you are responsible for the payment of any fees or costs incurred by you in connection with receipt of communications from Pancake, including data, internet, cellular carrier or other similar fees.

Pancake recognizes the importance of the privacy of its users and does not share or otherwise provide Personal Information to third parties, except as provided herein. Pancake will not disclose or provide your Personal Information to any third party except:

• as otherwise described in this Policy;
• as otherwise required by law or to comply with legal process, including, but not limited to, civil and criminal subpoenas, court orders or other compulsory disclosures;
• as reasonably necessary to respond to claims of a violation of the rights of third parties, whether or not the third party is a user, individual, entity or government agency;
• for purposes related to the operation, improvement, and billing of ShortStack, including to manage your ShortStack account, subscription and other billing purposes, to respond to your inquiries, to allow outside vendors to perform services required by ShortStack, and to otherwise manage and operate ShortStack and develop new services and products;
• as reasonably necessary to enforce the Terms and Conditions of Service and Use of ShortStack.com (the “Terms and Conditions”);
• as reasonably necessary to detect, prevent and address fraud and other illegal activity and to prevent death or imminent bodily harm; or
• as reasonably necessary to protect the rights and property of Pancake or its officers, directors, shareholders, employees or agents.

Pancake does not Sell or Share your Personal Information (as those terms are defined under applicable data protection laws, including the California Privacy Rights Act). In addition, Pancake will not: (a) retain, use, disclose, or otherwise process your Personal Information for any purpose other than the specific business purposes of performing the ShortStack Services; (b) retain, use, disclose, or otherwise process your Personal Information outside of the direct business relationship between Pancake and you; or (c) combine your Personal Information with personal information that Pancake receives from or on behalf of another person or that Pancake collects from its own interactions with individuals, except to the extent necessary to perform the Services.

Pancake may provide aggregated anonymous data about the usage of ShortStack to third parties for purposes that we deem, in our sole discretion, to be appropriate, including, without limitation, to prospective advertisers or investors.

Pancake may post, email and use any testimonials that you have provided about ShortStack, and Pancake may post and email examples of content you have created through ShortStack, in connection with the marketing and promotion of ShortStack. Testimonials and other marketing, promotions and advertisements may include obfuscated Personal Information (such as first name and general location) that you have provided to Pancake. Furthermore, Personal Information you provide to Pancake may be used to send you information, advertisements and promotional material via email. You are able to unsubscribe from these emails via the “unsubscribe” link at the bottom of each email communication.

Pancake may disclose your Personal Information to a third party as part of a sale of the assets of Pancake, as the result of a change in control of the company, or in connection with an investment in Pancake by a third party. Any third party to which Pancake transfers or sells Pancake’s assets may continue to use your Personal Information, provided that such use remains subject to this Policy or to a successor privacy policy that affords a level of protection at least equivalent to this Policy. With respect to personal data received in reliance on the Data Privacy Framework, any such party must continue to apply the DPF Principles to that personal data or provide a level of protection at least equivalent to that required by the DPF Principles; if it will not agree to do so, Pancake will not transfer that personal data to it. See Your Choices for Limiting the Use and Disclosure of Your Personal Data.

Under the General Data Protection Regulation (GDPR), ShortStack is required to provide notifications when updating our subprocessors to those who indicate they would like to receive notifications. Sign up at /subprocessors/ to receive subprocessor notifications.

Among other functions of ShortStack, you may create a webpage that collects certain information from customers and other persons that visit your webpage. Should you create any webpage or form that collects personal information or other information related to any person or party visiting that page (“User Collected Information”) or import a list of User Collected Information to ShortStack that was compiled outside of ShortStack, you represent and warrant to Pancake that any and all User Collected Information has been collected in accordance with any applicable laws, rules or regulation and not in violation of any privacy or similar rights of such persons or parties.

Prohibition on Sensitive Data

You may not provide (or cause to be provided) any Sensitive Data to Pancake for processing through ShortStack. “Sensitive Data” includes, without limitation: (a) special categories of personal data as defined in Article 9 of the GDPR (e.g., data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation); (b) personal data relating to criminal convictions and offenses; (c) “Sensitive Personal Information” as defined under the California Privacy Rights Act; (d) social security numbers, tax file numbers, passport numbers, or driver’s license numbers; (e) credit or debit card numbers (other than as required for billing purposes); (f) account passwords; or (g) any similar category under other applicable data protection laws. Pancake will have no liability for any Sensitive Data provided in violation of this restriction. If Pancake becomes aware that Sensitive Data has been submitted to or is being processed through ShortStack, Pancake reserves the right, but has no obligation, to delete such data and/or notify the applicable customer. Pancake has no obligation to actively screen or monitor for the presence of Sensitive Data. For further details, please refer to Section 2.4 of the Data Processing Addendum.

As a part of ShortStack, Pancake may store such User Collected Information, but asserts, and you hereby agree and acknowledge, that Pancake has no right, title or interest in or to such information, has not participated or been involved in any such collection, and has no responsibility or obligation with respect to the legal compliance of your collection practices with respect to such information. Pancake will retain User Collected Information we process for our users until the ShortStack user deletes the User Collected Information, deletes their account, or as long as necessary to execute ShortStack-related services. However, Pancake may disclose any User Collected Information in the same manner, and under the same circumstances, as any Personal Information may be disclosed. You hereby indemnify and hold harmless Pancake, and all of its officers, directors, shareholders, employees and agents, with respect to any claim, suit or liability (including attorney’s fees and related costs), arising from your User Collected Information.

ShortStack is a platform used by businesses and individuals to create interactive campaigns, forms, and promotions. Pancake does not knowingly collect Personal Information directly from children under the age of 13 (or under the age of 16 for individuals in the European Economic Area, United Kingdom, or Switzerland).

However, Pancake acknowledges that ShortStack users may create publicly accessible campaigns, contests, promotions, or forms that could be accessed or completed by individuals of any age, including children. Pancake does not control the audiences to which its users direct their campaigns, and Pancake has no practical ability to verify the age of individuals who interact with user-created campaigns.

If you use ShortStack to create campaigns, forms, or promotions that may be accessed by children under the age of 13 (or under the applicable age of consent in your jurisdiction), you are solely responsible for compliance with the U.S. Children’s Online Privacy Protection Act (“COPPA”), Article 8 of the GDPR, and any other applicable laws governing the collection of personal information from minors. This includes, without limitation, obtaining verifiable parental consent where required by law. Pancake assumes no responsibility for your compliance with such laws.

If Pancake becomes aware that a user’s campaign, form, or promotion is collecting personal information from children in violation of COPPA, the GDPR, or other applicable law, Pancake reserves the right to suspend or remove the campaign and/or suspend or terminate the user’s ShortStack account, in addition to any other remedies available under the Terms and Conditions.

If we become aware that Personal Information from a child under the applicable age has been submitted directly to Pancake (as opposed to collected by a ShortStack user through a user-created campaign), we will take steps to delete such information as soon as practicable. If you believe that a child has provided Personal Information directly to Pancake, please contact us at support@shortstack.com.

You may update, modify or correct your Personal Information via your account Preferences. Alternatively, you may contact support@shortstack.com for updates, modifications and corrections to your Personal Information, or to request access to your Personal Information.

Retention Of Your Personal Information

You may request deletion of your Personal Information at any time by contacting Pancake in the manner provided on ShortStack. Pancake will endeavor to respond to your request in a timely manner. Once a request to delete a ShortStack user’s Personal Information is received, it will be removed from our active systems within thirty (30) days, and from backup and archival systems within a commercially reasonable period thereafter. You may delete your account within the Preferences section of your ShortStack account. Alternatively, you may contact support@shortstack.com to delete your account.

European Union (EU) General Data Protection Regulation (“GDPR”)

For our users living or doing business in the EU, Pancake is subject to the GDPR.

United Kingdom General Data Protection Regulation (“UK GDPR”)

For our users living or doing business in the United Kingdom, Pancake is subject to the UK GDPR and the UK Data Protection Act 2018.

Swiss Federal Act on Data Protection (“nFADP”)

For our users living or doing business in Switzerland, Pancake is subject to the Swiss Federal Act on Data Protection of 25 September 2020 and its implementing ordinances.

California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CPA”)

For our users living or doing business in California, Pancake is subject to the CPA.

Nevada Privacy Law

For our users living or doing business in Nevada, Pancake is subject to the Nevada Privacy Law.

Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”)

For our users living or doing business in Canada, Pancake is subject to PIPEDA.

Brazilian General Data Protection Law (“LGPD”)

For our users living or doing business in Brazil, Pancake is subject to the Lei Geral de Proteção de Dados (LGPD), Federal Law No. 13,709/2018.

Australian Privacy Act of 1988 (“Australian Privacy Act”)

For our users living or doing business in Australia, Pancake is subject to the Australian Privacy Act.

If we received your personal data in reliance on the Data Privacy Framework, additional rights and recourse mechanisms apply — see Data Privacy Framework (DPF).

If we received your personal data in reliance on the Data Privacy Framework, additional rights and recourse mechanisms apply — see Data Privacy Framework (DPF).

If we received your personal data in reliance on the Data Privacy Framework, additional rights and recourse mechanisms apply — see Data Privacy Framework (DPF).

If we received your personal data in reliance on the Data Privacy Framework, additional rights and recourse mechanisms apply — see Data Privacy Framework (DPF).

If we received your personal data in reliance on the Data Privacy Framework, additional rights and recourse mechanisms apply — see Data Privacy Framework (DPF).

For our users living or doing business in California, Pancake is subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (collectively, the “CPA”).

Pancake Does Not Sell or Share Your Personal Information

Pancake does not Sell or Share (as those terms are defined under the CPA) your Personal Information or any Personal Information you collect while using our services to any third party.

Right to Know and Right to Access Personal Information Collected

The CPA gives California residents the right to learn more about the types of data Pancake collects. To learn more, please visit the What Information We Learn, Collect and Use section above. Pancake collects this information to further the business purposes described in section How We Use Your Personal Information. Users living or doing business in California have the right to request their Personal Information collected in the last 12 months. This can be done by contacting support@shortstack.com.

Right to Correct Inaccurate Personal Information

California residents have the right to request correction of inaccurate Personal Information that Pancake holds about them. You may submit a correction request by contacting support@shortstack.com or by modifying your information via your account Preferences.

Right to Limit Use and Disclosure of Sensitive Personal Information

The CPA gives California residents the right to limit the use and disclosure of Sensitive Personal Information. As described under “User Collected Information” above, Pancake does not process Sensitive Data except as required for billing purposes.

Cookie Policy

Pancake does use cookies on our website. You can learn more about our Cookie Policy at /cookie-policy/.

Accuracy and Access To Your Personal Information

As per the CPA, if you believe that Personal Information Pancake holds about you is inaccurate, you may modify or correct your Personal Information via your account Preferences or by contacting Pancake at support@shortstack.com.

Deleting Your Personal Information

The CPA gives California residents and those doing business in California the right to delete Personal Information collected by Pancake. You may delete your account within the account Preference section of your ShortStack account. Alternatively, you may contact support@shortstack.com to request the deletion of your Personal Information. Please note, if your Personal Information is scheduled for deletion, but you wish to exercise your right to receive your Personal Information collected within the last 12 months, then you must make this request within 7 days of requesting your account be deleted.

Non-Discrimination

Pancake will not discriminate against you for exercising any of your rights under the CPA. We will not deny you services, charge you different prices or rates, provide you a different level or quality of services, or suggest that you will receive a different price or rate or a different level or quality of services for exercising your rights.

For our users living or doing business in Australia, Pancake is subject to the Australian Privacy Act of 1988 (“Australian Privacy Act”).

Pancake’s Use of Personal Information for Direct Marketing

Pancake will not use your Personal Information for the purpose of direct marketing unless you have consented to its use; you can reasonably expect to receive direct marketing from our team; or we believe you to be interested in receiving the marketing emails despite not having obtained your consent. You may opt out of email marketing materials through an unsubscribe mechanism in the email or by contacting us directly at support@shortstack.com. However, opting out of direct marketing messages will not prevent you from receiving non-marketing system emails, such as system alerts and account-related messages.

Server Location

Our servers are located in the United States. You can learn more about our data security and privacy practices in our FAQs.

Accuracy And Access Of Your Personal Information

As per the Australian Privacy Act, if you believe that Personal Information Pancake holds about you is inaccurate, you may update, modify or correct your Personal Information via your account Preferences or contact support@shortstack.com to update, modify or correct your Personal Information.

For our users living or doing business in Brazil, Pancake is subject to the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados — LGPD), Federal Law No. 13,709/2018.

Under the LGPD, Brazilian data subjects have the right to: confirmation of the existence of processing; access to their data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary or excessive data; portability of data to another service provider; deletion of personal data processed with consent; information about public and private entities with which Pancake has shared data; information about the possibility of denying consent and the consequences of such denial; and revocation of consent.

To exercise any of these rights, please contact us at support@shortstack.com. Pancake will respond to LGPD data subject requests in accordance with the timelines established by applicable law.

Pancake Laboratories Inc. provides a Data Processing Addendum (DPA), which customers can view and download at /data-processing/. The DPA is incorporated into the Terms and Conditions by reference.

Pancake implements and maintains technical, physical, administrative, and organizational measures designed to protect Personal Information against theft, unauthorized or unlawful acquisition, access, or processing, accidental loss, destruction, alteration, or damage. For information regarding Pancake’s specific security practices, controls, and certifications, please refer to our Security FAQs at /security-faqs/ or contact support@shortstack.com to request a copy of our Comprehensive Security Documentation, subject to applicable confidentiality obligations.

In the event of a security breach affecting your Personal Information or the information of individuals on your ShortStack lists, Pancake will notify you without undue delay on both the nature of the breach and the actions taken to address it. Pancake’s notice will include, to the extent reasonably available: (a) the dates and times of the breach; (b) the facts underlying the discovery of the breach; (c) a description of the Personal Information involved; and (d) the measures planned or underway to remedy or mitigate the vulnerability giving rise to the breach.

Pancake will cooperate with affected users and take commercially reasonable steps to assist in complying with any obligations under applicable data protection laws, including any obligation to notify a supervisory authority or communicate a breach to affected individuals.

Pancake will process Personal Information for the duration of your use of ShortStack. Following termination or expiration of your ShortStack account, Pancake will delete your Personal Information from active systems within thirty (30) days, and from backup and archival systems within a commercially reasonable period thereafter, except as otherwise required by applicable law.

Within seven (7) days of account termination, you may request that Pancake: (a) return a complete copy of your Personal Information in a commonly used machine-readable format; and/or (b) delete all copies of your Personal Information processed by Pancake and its subprocessors. To make such a request, contact support@shortstack.com.

Pancake may retain Personal Information to the extent and for such period as required by applicable laws, provided that Pancake will ensure the confidentiality of all such data and will only process it as necessary for the purposes specified in the applicable law. Upon expiration of any applicable legal retention period, Pancake will delete or destroy all remaining Personal Information from active systems within thirty (30) days, and from backup and archival systems within a commercially reasonable period thereafter.

ShortStack complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. ShortStack has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles with regard to the processing of personal data received from the European Union, the United Kingdom, and Switzerland in reliance on the applicable DPF frameworks. If there is any conflict between the terms in this Policy and the DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Pancake Laboratories Inc. complies with the DPF Principles for all onward transfers of personal information from the EU, the United Kingdom, and Switzerland, including the onward transfer liability provisions. Pancake Laboratories Inc. shall not be held liable for third-party service providers processing personal information in violation of DPF Principles, unless it is proven that Pancake Laboratories Inc. is solely responsible for the third-party service providers’ action in violation of the Principles.

With respect to personal information received or transferred pursuant to the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Pancake Laboratories Inc. is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain situations, Pancake Laboratories Inc. may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Your Choices for Limiting the Use and Disclosure of Your Personal Data

Where we have received your personal data in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF, we offer you the opportunity to choose (opt out) whether your personal data is:

• disclosed to a third party; or
• used for a purpose that is materially different from the purpose for which it was originally collected or that you subsequently authorized.

To exercise either choice, email us at support@shortstack.com with “DPF – Choice Request” in the subject line, or use the unsubscribe link at the bottom of any marketing email. There is no charge for making a request, and you do not need a ShortStack account to make one. We will confirm receipt and act on your request without undue delay and in any event within thirty (30) days. Where a request is complex, or where we have received a number of requests, we may extend that period by up to a further thirty (30) days; if we do, we will tell you within the initial thirty (30) day period and explain why.

We do not need to offer you this choice when we disclose personal data to a third party that acts as our agent, performing tasks on our behalf and under our instructions. In every such case we enter into a written contract with that agent requiring it to provide at least the same level of protection as the DPF Principles require. The agents and subprocessors we currently use are listed at /subprocessors/.

ShortStack cannot be provided without these agents — they host the platform, deliver email, and process payments — so there is no way to continue using the Services while excluding them.

Where a ShortStack customer objects, on reasonable grounds relating to data protection, to a new subprocessor we propose to add, the customer’s remedy is set out in the Subprocessors section of this Policy and in Section 5 of the Data Processing Addendum: we will work together in good faith toward a mutually acceptable resolution, and if we cannot reach one, either party may terminate the affected Service. There is no objection right in respect of subprocessors already in use at the time a customer subscribes.

If you are an individual rather than a ShortStack customer — for example, someone who entered a campaign built with ShortStack — the objection right described above belongs to the ShortStack customer, not to you. You may instead ask us to delete your personal data, and where that data was collected by a ShortStack customer we will refer your request to them.

This choice also does not apply to a transfer of personal data that occurs as part of a merger, acquisition, sale of all or substantially all of our assets, change of control, or investment in Pancake by a third party. Where personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF is transferred in any such transaction, Pancake will require the acquiring or receiving party, as a condition of the transfer, either to continue to apply the DPF Principles to that personal data or to provide a level of protection at least equivalent to that required by the DPF Principles. If the acquiring or receiving party will not agree to do so, Pancake will not transfer that personal data to it. We will update this Policy to identify the acquiring or receiving party prior to, or promptly following, any such transfer.

For sensitive information — personal data specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or information specifying an individual’s sex life — we will obtain your affirmative express consent (opt in) before disclosing it to a third party or using it for a purpose other than the one for which it was originally collected or subsequently authorized by you. We also treat as sensitive any personal data we receive from a third party where that third party identifies and treats it as sensitive. Separately, and as described in Prohibition on Sensitive Data, ShortStack is not intended for the collection of sensitive information and users are prohibited from submitting it through the Services; the commitment in this paragraph applies to any sensitive information that Pancake nonetheless receives or holds.

Your Right to Access Your Personal Data

Where we hold personal data about you that we received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, or the Swiss-U.S. DPF, you have the right to access that personal data, and to have it corrected, amended, or deleted where it is inaccurate or has been processed in violation of the DPF Principles.

To make a request, email us at support@shortstack.com with “DPF – Access Request” in the subject line. There is no charge. We will respond without undue delay and in any event within thirty (30) days. Where a request is complex, or where we have received a number of requests, we may extend that period by up to a further thirty (30) days; if we do, we will tell you within the initial thirty (30) day period and explain why. We may ask you for information reasonably necessary to confirm your identity before we act on the request.

Where a request results in the deletion of your personal data, the timelines described in Data Retention and Deletion apply. Any extension described above applies only to the time we may take to respond to a request, and not to the deletion itself.

We may limit or deny access where the burden or expense of providing it would be disproportionate to the risks to your privacy in the case in question, or where the rights of persons other than you would be violated. If we limit or deny a request, we will tell you why and explain how you can challenge that decision.

The response commitment described above applies to personal data that Pancake holds as a controller — that is, information about you as a ShortStack account holder, or as a person who has contacted us directly.

Where we process personal data on behalf of a ShortStack customer — for example, entries, contact details, and other information that a customer collects from its own audience through a ShortStack campaign — we act as a processor on that customer’s instructions, and that customer, rather than Pancake, is responsible for responding to your request. If you contact us about that data, we will promptly notify the relevant customer of your request and will assist them in responding to you as required under our Data Processing Addendum. Because the timing of any response is determined by that customer, the thirty (30) day commitment described above does not apply to such requests. If you tell us which campaign or brand you submitted your information to, we will identify the relevant customer for you where we are reasonably able to do so.

Under the GDPR and UK GDPR, you (the ShortStack customer) are considered a Data Controller, while ShortStack is the Data Processor. ShortStack’s Data Privacy Framework certification, together with the Standard Contractual Clauses (including the UK Addendum for UK transfers) incorporated in the Data Processing Addendum, provide the legal mechanisms for the transfer of personal data from the EU, UK, and Switzerland to the United States (where ShortStack’s servers are located). The DPA is available at /data-processing/.

Data Protection Officer

Pancake has appointed a data protection officer, who can be reached at support@shortstack.com.

Platform Security

Check out our Security FAQs page at /security-faqs/ for more specific information on platform security.

Pancake engages third-party subprocessors to assist in providing the ShortStack Services. A current list of subprocessors is maintained at /subprocessors/. Pancake notifies all customers of any change to the subprocessor list in-app and by email before the change takes effect.

If a ShortStack customer objects to Pancake’s use of a new subprocessor, the customer may notify Pancake in writing (via email to support@shortstack.com) within fifteen (15) business days after receipt of Pancake’s notice. Objections must be based on reasonable grounds relating to data protection. If Pancake and the customer are unable to resolve such objection, either party may terminate the applicable service. For full details, please refer to Section 5 of the Data Processing Addendum.

In compliance with the DPF Principles, Pancake Laboratories Inc. commits to resolve complaints about our collection or use of your personal information. Individuals in the European Union, the United Kingdom, and Switzerland with inquiries or complaints regarding our DPF policy should first contact Pancake Laboratories Inc. at: support@shortstack.com.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, ShortStack commits to refer unresolved complaints concerning our handling of personal data received in reliance on the DPF to the ICDR-AAA, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.adr.org/ for more information or to file a complaint. The services of ICDR-AAA are provided at no cost to you.

Data Protection Authorities

You may also contact the data protection authority in your jurisdiction: your national or regional data protection authority in the European Union, the Information Commissioner’s Office (ICO) in the United Kingdom, or the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland. Where such an authority has authority to hear your claim, we commit to cooperate with it and to comply with the advice it gives. You may also raise the matter through your data protection authority to the U.S. Department of Commerce, which will use best efforts to resolve it at no cost to you.

U.S. Federal Trade Commission

With respect to personal data received or transferred pursuant to the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Pancake Laboratories Inc. is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.

Binding Arbitration

Under certain conditions, you may invoke binding arbitration for any residual claim that has not been resolved by the other recourse mechanisms described above. The claim would be heard by the “EU-U.S. Data Privacy Framework Panel” or, for personal data received under the Swiss-U.S. DPF, the “Swiss-U.S. Data Privacy Framework Panel” — an arbitral panel of one or three arbitrators, as agreed by the parties. This right, and the procedures that govern it, are set out in Annex I to the DPF Principles.

Before invoking arbitration, you must first: (1) raise the claimed violation directly with us and give us an opportunity to resolve it; (2) use the independent recourse mechanism described above (ICDR-AAA), at no cost to you; and (3) raise the issue through your data protection authority to the U.S. Department of Commerce and allow the Department an opportunity to use best efforts to resolve it, at no cost to you.

Arbitration is not available if the same claimed violation has previously been subject to binding arbitration, was the subject of a final judgment entered in a court action to which you were a party, or was previously settled by the parties.

To invoke arbitration, deliver a written notice to us at support@shortstack.com, or by mail to Pancake Laboratories, Inc., 518 Pyramid Way, Sparks, Nevada 89431, USA. The notice must contain a summary of the steps you have taken to resolve the claim, a description of the alleged violation, and — at your option — any supporting documents and materials and/or a discussion of the law relating to the claim.

What the panel can award. The panel has the authority to impose individual-specific, non-monetary equitable relief — such as access to, correction, deletion, or return of the personal data in question — that is necessary to remedy the violation of the Principles with respect to you. These are the only remedies available: no damages, costs, fees, or other remedies may be awarded, and each party bears its own attorney’s fees.

How arbitration works. The arbitration takes place in the United States. You may choose to participate by video or telephone at no cost to you; in-person participation is not required. The language of the arbitration is English unless the parties agree otherwise, and interpretation and translation will be provided at no cost to you upon a reasoned request. Materials submitted to the arbitrators are treated confidentially and used only in connection with the arbitration. Arbitrations should be completed within 90 days of the delivery of your notice to us, unless the parties agree otherwise. Arbitrators’ fees are met from a fund administered by the ICDR-AAA to which participating organizations contribute.

Pancake Laboratories Inc. is obligated to arbitrate claims and to follow the terms set forth in Annex I to the DPF Principles, provided that you have invoked binding arbitration by delivering notice to us and following the procedures and subject to the conditions set forth in Annex I. Full details are available at https://www.dataprivacyframework.gov/.

ShortStack may from time to time incorporate artificial intelligence or machine learning features into its Services. Where such features process Personal Information, Pancake will do so in accordance with this Policy and the Data Processing Addendum.

Pancake will not use your Personal Information to develop, train, or improve artificial intelligence or machine learning models, whether those models are operated by Pancake or by a third party, without your affirmative express consent. Using your Personal Information for model development or training would be a purpose materially different from the purposes for which it was collected, and Pancake will not do so on an opt-out basis.

Pancake may use aggregated or de-identified data to develop, train, and improve artificial intelligence and machine learning features. Aggregated or de-identified data is data that does not identify you and cannot reasonably be used to identify you. Pancake will not attempt to re-identify such data, and will not permit any third party to do so.

If ShortStack introduces AI-powered features that involve new categories of data processing, Pancake will update this Policy prior to or concurrent with the launch of such features.

If any provision of this Policy is found by a court of competent jurisdiction or arbitrator to be illegal, void, or unenforceable, the unenforceable provision will be modified so as to render it enforceable and effective to the maximum extent possible in order to effect the intention of the provision; and if a court or arbitrator finds the modified provision invalid, illegal, void or unenforceable, the validity, legality and enforceability of the remaining provisions of this Policy will not be affected in any way.