Last updated: September 29, 2026
This Privacy Policy explains how Stack&Find collects, uses, shares and protects personal information when you use the website stackandfind.com and its related services (the "Platform"). It also explains your rights and how to exercise them.
Stack&Find is operated by MAKEITFLOW AGENCY G.P., a general partnership having its head office at 1599 rue du Sud, CP 41, Cowansville (Québec) J2K 3H1, Canada ("Stack&Find", "we", "us" or "our"). We are responsible for the personal information described in this policy.
Capitalized terms not defined here (such as Business, Expert, Profile, Contact Request and Review) have the meaning given in our Terms of Use.
1. Person in charge of the protection of personal information
Our person in charge of the protection of personal information is:
Jason Keenan, Partner
Stack&Find (MAKEITFLOW AGENCY G.P.)
1599 rue du Sud, CP 41, Cowansville (Québec) J2K 3H1, Canada
Email: privacy@stackandfind.com
You may contact this person with any question, request or complaint about your personal information.
2. Scope of this policy
2.1. This policy applies to personal information we collect through the Platform, including from Visitors, Businesses and Experts.
2.2. When a Business sends a Contact Request, the Expert who receives it becomes responsible for how it uses that information. Experts, including booking tools they use, have their own privacy practices, and this policy does not govern them.
2.3. MAKEITFLOW also appears on the Platform as an Expert. Contact Requests sent to the MAKEITFLOW Profile are handled by MAKEITFLOW in its capacity as an Expert, under the privacy policy published at makeitflow.ca.
3. Personal information we collect
| Category | Examples | Who it concerns |
|---|---|---|
| Account information | Name, email address, password (stored in encrypted form), account type, language preference | Businesses and Experts |
| Expert Profile information | Name or agency name, logo or photo, description, software stack, services, languages, city and country, website, Booking Link | Experts (published on the Platform) |
| Verification information | Certifications, partner statuses, supporting documents or links, business registration details | Experts |
| Business information | Company name, role, software stack, needs | Businesses |
| Contact Requests | Name, email address, company, software stack, message content, Expert selected, date | Businesses |
| Reviews | Rating, comments, reviewer name as displayed, date, Expert responses | Businesses and Experts |
| Billing information | Name, email address, billing address, plan, payment status, invoices, last four digits and type of card (full card numbers are processed by Stripe, not stored by us) | Pro Plan Experts |
| Communications | Emails and messages you send us, newsletter subscription and consent records | All Users |
| Technical information | IP address, browser and device type, pages visited, dates and times of access, error and security logs | All Users |
We only collect the information necessary for the purposes described in this policy. We do not ask for sensitive information (such as health information), and we ask you not to include it in Contact Requests, Profiles or Reviews.
4. How we collect personal information
- Directly from you, when you create an account, complete a Profile, submit an application, send a Contact Request, post a Review, subscribe to our newsletter or contact us.
- Automatically, through our servers and essential technologies when you use the Platform (see section 11).
- From third parties, such as Stripe (payment status) and public sources used to verify Expert certifications and partner statuses (for example, software vendors' public partner directories).
5. Why we use personal information
We use personal information only for the purposes below. If you are in the European Economic Area, the United Kingdom or Switzerland, the table also shows the legal basis we rely on under the GDPR.
| Purpose | GDPR legal basis |
|---|---|
| Create and manage accounts, and authenticate Users | Performance of a contract |
| Review Expert applications and verify certifications and partner statuses | Performance of a contract; legitimate interest in keeping the directory reliable |
| Publish Expert Profiles and match Businesses with Experts based on their software stack | Performance of a contract |
| Transmit Contact Requests to the Expert selected by the Business | Performance of a contract, at the Business's request |
| Publish, moderate and respond to Reviews | Legitimate interest in providing honest, useful information to Businesses |
| Process Pro Plan subscriptions, issue invoices and keep accounting records | Performance of a contract; legal obligation |
| Send service messages (account, Contact Requests, Reviews, billing) | Performance of a contract |
| Send newsletters and marketing emails | Consent |
| Measure advertising performance and track conversions from Google Ads campaigns | Consent (or legitimate interest where applicable under local law) |
| Maintain the security of the Platform, prevent fraud, spam and abuse | Legitimate interest |
| Answer your questions and requests, including privacy requests | Legal obligation; legitimate interest |
| Comply with the law and defend our rights | Legal obligation; legitimate interest |
If we want to use your personal information for a new purpose, we will ask for your consent first, unless the law allows us to do so without it.
6. Information that is public
6.1. Expert Profiles are public. Anyone can see them, and search engines may index them. Experts control what they include in their Profile, other than verification badges that we add.
6.2. Reviews are public and display the reviewer's name in the form shown when the Review is submitted.
6.3. An Expert's direct contact details are not displayed to Businesses. Contact Requests are not public.
7. Who we share personal information with
We do not sell or rent personal information. We share it only in the following cases.
7.1. With Experts. When a Business sends a Contact Request, we transmit its content to the Expert selected by the Business.
7.2. With our service providers. We use the service providers below to operate the Platform. They may access personal information only to perform services for us, under written agreements that require them to protect it and not use it for their own purposes.
| Provider | Purpose | Location of data |
|---|---|---|
| Lovable Cloud | Website hosting, application infrastructure, database, user authentication and file storage | United States |
| Stripe | Payment processing and invoicing for the Pro Plan | United States and Canada |
| Google LLC | Advertising conversion measurement, campaign performance tracking, and related analytics (Google Ads) | United States |
7.3. Professional advisers. We may share information with our lawyers, accountants and auditors, who are bound by confidentiality.
7.4. Legal requirements. We may disclose information where required by law, a court order or a competent authority, or where necessary to protect the rights, safety or property of Users, the public or Stack&Find.
7.5. Business transaction. If all or part of the Platform is sold, merged or otherwise transferred, personal information may be communicated to the other party, under an agreement that limits its use to the transaction and requires its protection, as permitted by law.
8. Storage and transfers outside Québec
8.1. Our Platform and database are hosted in the United States. This means your personal information is stored and processed outside Québec and outside Canada.
8.2. Before communicating personal information outside Québec, we assessed the privacy-related factors, including the sensitivity of the information, the purposes of its use, the protection measures in place and the legal framework of the United States. We entered into written agreements with our service providers that require adequate protection of the information.
8.3. While in the United States, personal information may be subject to the laws of that country, including laws that allow authorities to access it.
8.4. For personal information originating from the European Economic Area, the United Kingdom or Switzerland, transfers rely on the adequacy decision in favour of Canada where applicable, the EU-U.S. Data Privacy Framework where our provider is certified, or standard contractual clauses approved by the European Commission.
9. How long we keep personal information
| Information | Retention period |
|---|---|
| Account information | While the account is active, then deleted or anonymized within 90 days after closure |
| Expert Profile | Removed from public display within a reasonable time after closure or revocation, then deleted within 90 days |
| Verification information | For as long as the Profile is published; for refused applications, 12 months after the decision |
| Contact Requests | 24 months after they are sent |
| Reviews | While the Expert's Profile is published, unless removed earlier |
| Billing and accounting records | 6 years after the end of the fiscal year to which they relate, as required by tax laws |
| Newsletter subscription | Until you unsubscribe; consent records kept 3 years after to demonstrate compliance |
| Technical and security logs | 12 months |
When the purpose for which information was collected has been achieved, we destroy it or anonymize it, subject to any retention period required by law.
10. Security
10.1. We take reasonable security measures appropriate to the sensitivity of the information, including encryption of data in transit, encrypted storage of passwords, database access rules that limit each User to their own data, restricted internal access on a need-to-know basis, and payment processing through Stripe, a PCI-DSS certified provider.
10.2. No method of transmission or storage is completely secure. If a confidentiality incident presents a risk of serious injury, we will notify the Commission d'accès à l'information du Québec and the persons concerned, and, where applicable, other competent authorities within the time limits required by law. We keep a register of confidentiality incidents.
11. Cookies and similar technologies
11.1. The Platform uses technologies necessary for its operation and performance measurement:
- Essential cookies: storing your login session in your browser so you stay signed in, remembering your language preference, and security cookies set by Stripe on payment pages to process payments securely and prevent fraud.
- Advertising and conversion measurement cookies: we use the Google tag (Google Ads) to measure the effectiveness of our advertising campaigns and track when a visitor completes specific actions (such as submitting an Expert application). These cookies (such as
_gcl_auand_gcl_aw) allow Google to attribute conversions to advertisements.
11.2. Where required by applicable law (including in Québec under Law 25, and in the European Economic Area and the United Kingdom under the GDPR and ePrivacy Directive), non-essential advertising and tracking technologies are activated only with your prior consent. You can withdraw your consent at any time using the Cookie settings link at the bottom of every page, opt out of personalized ads via Google Ads Settings, or manage your cookie preferences in your browser.
11.3. You can block or delete cookies in your browser settings, but some parts of the Platform, such as signing in or completing forms, may no longer function properly.
12. Your rights
12.1. In Québec and Canada, you have the right to:
- be informed of the personal information we hold about you and access it;
- have inaccurate, incomplete or ambiguous information corrected;
- withdraw your consent to the use or communication of your information, subject to legal or contractual restrictions;
- ask us to stop disseminating your information, or to de-index any hyperlink attached to your name, where the conditions set out by law are met;
- receive the computerized personal information you provided to us in a structured, commonly used technological format, and have it transferred to another organization.
12.2. In the European Economic Area, the United Kingdom and Switzerland, you also have the right to request the erasure of your data, restrict or object to its processing (including processing based on our legitimate interests), and withdraw your consent at any time, without affecting processing already carried out.
12.3. In the United States, residents of certain states may have similar rights under state law. We will respond to requests from any User, wherever they live.
12.4. How to exercise your rights. Send your request to privacy@stackandfind.com. We may ask you to confirm your identity before responding, to protect your information. We will respond within thirty (30) days of receiving your request, or within any shorter period required by the law that applies to you. Requests are free of charge, unless they are manifestly excessive.
12.5. Complaints. If you are not satisfied with our response, you may file a complaint with the Commission d'accès à l'information du Québec, the Office of the Privacy Commissioner of Canada, or, if you are in Europe, the data protection authority of your country of residence.
13. Newsletters and marketing emails
We send newsletters and marketing emails only to people who have given their consent. Each message identifies Stack&Find and includes an unsubscribe link. You may unsubscribe at any time, and we will process your request within 10 business days. Service messages related to your account will continue to be sent while your account is active.
14. Automated decisions
The Platform displays Experts based on filters such as software stack and location. We do not make decisions about you based exclusively on automated processing of your personal information.
15. Minors
The Platform is intended for professional use by persons aged 18 or older. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us and we will delete it.
16. Changes to this policy
We may update this policy from time to time. The "Last updated" date shows the latest version. For material changes, we will notify account holders by email and post a notice on the Platform before the change takes effect.
17. Language
This policy is available in French and in English. In case of any discrepancy between the two versions, the French version prevails.
18. Contact us
Stack&Find (MAKEITFLOW AGENCY G.P.)
Attention: Person in charge of the protection of personal information
1599 rue du Sud, CP 41
Cowansville (Québec) J2K 3H1
Canada
Email: privacy@stackandfind.com