Privacy Statement

About this statement

This Privacy Statement explains how StitchOps, Inc. ("StitchOps", "we", "us") collects and uses personal information when you visit www.stitchops.io, contact us, or sign in to StitchOps as a user. It also explains, in summary, how we handle the data our customers process with StitchOps, which is governed by our Data Processing Addendum at https://www.stitchops.io/legal/dpa.

1. Our role

(a) Controller. We decide how to use the personal information we collect directly: from visitors to our website, from people who contact us or attend our events, and about the people who hold StitchOps accounts. Sections 2 through 4 cover this information.

(b) Processor. When a customer uses StitchOps to automate its own systems, the customer decides what data is processed and why. We process that data only on the customer's instructions, under our agreement and Data Processing Addendum with the customer. Section 5 summarizes this. If your information is in a customer's systems, please contact that customer about it.

2. Website visitors

(a) Information you give us. When you fill in a form, book a call, or email us, we receive what you provide, such as your name, work email, company, role, and message.

(b) Analytics. We use PostHog to understand how visitors use our website, such as pages viewed, referring page, device, and browser. We run PostHog without cookies, keep its data in memory for the visit only, and route it through our own domain. It respects your browser's Do Not Track setting.

(c) Company identification. We use Snitcher to identify the companies that visit our website, based on information such as IP address, so our team can understand which organizations are interested in StitchOps.

(d) Visitor identification. We use RB2B, which may identify individual visitors to our website from the United States and provide us with business profile information, such as name, job title, company, and professional profile, so our team can follow up with people who show interest.

(e) Booking. When you book a call, the booking is handled by Cal.com, which receives the details you enter.

(f) Server logs. Our hosting provider records technical information such as IP address, browser, and the pages requested, for security and reliability.

3. People who contact us

We use the information you send us to respond, to provide the information or demonstration you asked for, and to follow up about StitchOps. We keep it in our email, customer relationship, and collaboration tools. You can ask us to stop contacting you at any time.

4. StitchOps account holders

(a) Account information. Name, work email, organization, role in the workspace, authentication identifiers from our identity provider or your organization's single sign on, and billing contact details.

(b) Usage information. Sign in events, administrative actions, and how you use the StitchOps console, used to provide, secure, support, and improve the service.

(c) AI assistant connectors. When you connect StitchOps to an AI assistant such as Claude, ChatGPT, or Microsoft Copilot, we receive the assistant's tool calls, your identity, and your workspace, and we return the tool results. Whatever a tool returns becomes visible to the assistant and its provider under that provider's own terms. Tools that would return a stored credential value are not available to assistants. We do not receive your conversation with the assistant beyond the tool calls. You can disconnect an assistant at any time from its settings.

5. Customer data we process for customers

(a) Where it stays. The StitchOps Digital Worker runs on the customer's own infrastructure. Screen content, field values, and the personal information workflows handle stay there, unless the customer configures a workflow to send them to StitchOps. Our cloud service stores workflow definitions, account details, and execution metadata such as status, timing, and errors.

(b) AI. AI features are optional and use the customer's own AI provider by default. We do not use customer data to train AI models.

(c) Credentials. Credentials stay in the customer's own credential vault by default and are never sent to an AI model.

(d) Details. The Data Processing Addendum, the subprocessor list at https://www.stitchops.io/legal/subprocessors, and the AI disclosure at https://www.stitchops.io/legal/ai describe this processing in full.

6. How we use personal information

We use the information in Sections 2 through 4 to run, secure, and improve our website and service; to authenticate users and keep workspaces separate; to respond to inquiries and provide support; to market StitchOps to businesses, including following up with interested visitors; to bill customers; and to comply with law and enforce our terms.

7. Who we share it with

(a) Service providers that host, analyze, and support our website and service, including Amazon Web Services, PostHog, Snitcher, RB2B, Cal.com, our identity provider, our email and collaboration tools, and our payment processor. They may use the information only to provide their services to us. Providers that process customer data are listed at https://www.stitchops.io/legal/subprocessors.

(b) Professional advisers and authorities, when needed to comply with law, protect rights and safety, or enforce our agreements.

(c) A buyer or successor, in a merger, acquisition, or sale of assets, subject to this Statement.

We do not sell personal information.

8. Where it is stored

We store personal information in the United States. If you are outside the United States, your information is transferred there. Where the law requires, we rely on the Standard Contractual Clauses or another approved mechanism for those transfers.

9. How long we keep it

(a) Website analytics in PostHog are kept for the visit only, in memory.

(b) Inquiries and marketing records are kept while we have a business relationship or reason to contact you, and deleted on request.

(c) Account information is kept for the life of the account and deleted with the workspace.

(d) Workflow execution telemetry is kept for 90 days. Audit logs are kept for at least one year. Encrypted backups rotate within 35 days.

10. Security

We encrypt information in transit and at rest. Digital Workers connect outbound only, every request to our service is scoped to one workspace, and access to production systems is limited to named personnel using multifactor authentication and is logged. Our cloud service is covered by a SOC 2 Type 2 examination with HIPAA and GDPR Article 5 attestations, performed by Sensiba LLP. Report a security concern to security@stitchops.io.

11. Your rights and choices

(a) Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict how we use it, to opt out of marketing, and to complain to a data protection authority. We will not discriminate against you for using these rights.

(b) To make a request, email privacy@stitchops.io. We will verify your identity and respond within the time the law allows, and within 30 days for deletion requests. If the request concerns data we process for a customer, we will refer you to that customer.

(c) Visitors in the European Union, the United Kingdom, and Switzerland can contact us about their rights at privacy@stitchops.io.

(d) You can object to, or opt out of, our use of your information for website analytics, company and visitor identification, or marketing by emailing privacy@stitchops.io, and you can unsubscribe from marketing emails at any time.

(e) You can block cookies and similar technologies in your browser, and turn on Do Not Track to stop PostHog analytics.

12. Children

Our website and service are for businesses. They are not directed to children, and we do not knowingly collect information from anyone under 16.

13. Changes

We will post changes on this page with a new version and effective date, and keep prior versions at https://www.stitchops.io/legal/archive. For material changes affecting account holders, we will notify workspace administrators by email before the change takes effect.

14. Contact

StitchOps, Inc., 2707 Arapahoe Avenue #180, Boulder, CO 80302. Data Protection Officer: Kyle Harris, privacy@stitchops.io.