Privacy policy
This is a draft prepared from the current Stally implementation. It is not a final approved privacy policy. Retention, backup, deletion, international transfer, and legal-basis details require legal and operational review.
Last updated: August 17, 2026
Stally is a product operated by Inclusif Life SL. This draft explains the information Stally processes when customers use the dashboard, accessibility services, and AWS Marketplace account setup.
Information Stally processes
Account and contact information
Stally processes account identifiers, name, company, email address, optional contact information, account status, and authentication identifiers needed to create and operate an account.
AWS Marketplace information
For Marketplace customers, Stally processes AWS customer, account, product, license, agreement, entitlement, expiration, and registration information needed to verify and maintain the subscription. Stally also processes the contact details submitted during account setup.
Stally does not collect credit-card or bank-account information during AWS Marketplace fulfillment. AWS Marketplace manages billing for those contracts.
Domains and website monitoring
Stally processes monitored hostnames, URLs, sitemap information, rendered page content, page resources, accessibility findings, scan status, errors, timing information, declarations, and related evidence needed to provide website monitoring and accessibility services.
Documents and reports
Stally may process uploaded PDFs, document metadata, versions, checksums, accessibility findings, remediation instructions, remediated outputs, certifications, manual audit information, and uploaded audit reports.
Video information
Stally may process page URLs, source video URLs, player identifiers, transcription status, captions, and transcripts when customers use video accessibility features.
Usage and diagnostic information
Stally processes product events, browser and request diagnostics, errors, logs, internal identifiers, and account context for service operation, analytics, support, security, and troubleshooting. Diagnostic services may receive a user ID, email address, domain context, and error information.
How Stally uses information
Stally uses information to authenticate users, provision accounts, verify AWS Marketplace entitlements, provide accessibility monitoring and processing, manage subscriptions, generate findings and reports, provide support, diagnose failures, secure the service, and understand product usage.
Storage and hosting
The current implementation uses PostgreSQL for application records, Cloudflare R2 for files and generated artifacts, Cloudflare KV for selected mappings, Cloudflare Workers for application services, and AWS Cognito for authentication.
Storage regions, replication details, and encryption-at-rest key management require infrastructure confirmation before this policy is approved.
Service providers and sharing
Stally uses service providers to operate specific parts of the service. Providers identified in the current implementation include:
- Cloudflare for application delivery, processing, object storage, key-value storage, and related infrastructure
- AWS for Cognito authentication and AWS Marketplace fulfillment
- PostHog for product analytics and diagnostics
- Sentry for error monitoring and diagnostics
- Slack for internal Marketplace account-setup notifications
- Anthropic for supported document-remediation workflows
- Stripe for billing services used by customers who do not purchase through AWS Marketplace
- Configured accessibility, PDF, crawling, signing, and transcription processors
The final policy must verify the legal entity, purpose, processing location, retention terms, and subprocessor status of each provider before publication.
Stally does not sell customer content. A complete legal statement about personal-information sale or sharing requires review under the laws applicable to Stally and its customers.
Retention
The implementation stores account, subscription, domain, scan, document, video, diagnostic, and activity records for service operation. It does not currently define a complete public retention schedule for every category.
The final policy must specify retention periods for account data, Marketplace records, scans and snapshots, documents, videos, support records, analytics, security records, and backups.
Backups
Backup frequency, backup retention, restoration testing, and the treatment of deletion requests in backups require operational confirmation. No backup schedule is promised by this draft.
Deletion
Customers can request account or personal-data deletion by emailing [email protected]. Stally may need to verify the requester's identity before acting on a request.
The current service includes operator-assisted account deletion and customer actions for removing selected resources. Some activity records, AWS Marketplace records, object-storage artifacts, processor records, and backups may require separate retention or deletion handling.
The final policy and terms must define the completion timeframe, legal-retention exceptions, backup expiration, subprocessor deletion, and customer confirmation process.
International processing
Stally's providers may process information in multiple jurisdictions. The applicable transfer locations and safeguards require legal verification before this policy is approved.
Customer choices and rights
Customers may request access, correction, deletion, or other applicable privacy rights by emailing [email protected]. The available rights depend on the applicable law and the relationship between Stally, the customer organization, and individual users.
Contact
For privacy questions or requests, email [email protected].
For security-sensitive reports, follow the security reporting process.