Privacy

Who we are

SMB Stack (smb-stack.com) is a directory of software for small businesses, run by SMB Sites. Write to hello@smb-stack.com with any question about this page or your data.

What we collect

• No accounts. Browsing, the quiz and the builder never ask for your name, email, or company.
• Your stack. Quiz answers and the tools you pick live in the page address, so a share link carries them. Your browser also keeps your latest stack in local storage, so “My saved stack” can reopen it. It never leaves your browser.
• Searches. What you type in search goes in the page address, so analytics, if you allow it, records it with the page. We don’t store searches. To decide whether a sponsored result fits you, the search and stack pages read the country your connection comes from, which our host adds to each request; we don’t keep it.
• Published stacks. If you publish a stack, we store what you enter with our database host, Supabase: the title and link name, the name you give (or none), business type, team size, country, description, tool notes and tools. All of that is public on the stack’s page and its share image. Your email, if you give one, is never shown: we use it to send your edit link and to reach you about the leaderboard and rewards we’re building. We keep a scrambled copy (a hash) of your edit link’s key, not the key, and today’s visitor code (below) to limit publishing to five stacks a day. Take a stack down from its edit page, or write to us to delete it.
• Counts for published stacks. We count each published stack’s views, “Make it mine” copies, clicks out to vendors and reports. To count each visitor once a day, we store a code made from your IP address and browser with a key that changes daily. It can’t be turned back into your IP address or linked from one day to the next. Your browser also keeps your edit keys and your setup-checklist ticks in local storage; neither is sent to us except the key, to the stack it belongs to, when you edit.
• Analytics, if you allow it. Google Analytics 4 records the pages you view, how you arrived, your device and browser, and your rough location (country and city). It also records a few actions: which vendor buttons you click, finishing the quiz, copying or sharing a stack’s link, publishing a stack (its business type, team size, country and number of tools, never its title or notes), pressing “Make it mine” on someone else’s stack, and, for vendors, sending a submission or paying for a plan. It does not store your IP address. Advertising features are off.
• Hosting. Vercel serves the site and keeps standard request logs (IP address, browser, page) for security and performance. We use its location headers to decide whether to show the cookie banner, and we don’t store them.
• Vendors. If you send a tool or correction from For vendors, we get your name, email and what you wrote, delivered by email through Resend. If you buy a featured spot or the verified plan, Stripe handles the payment and we keep the subscription and customer ids it gives us, not your card details. Vendors who sign in give us their work email, which we keep with their listing.
• Email to us. Mail you send to hello@smb-stack.com, or a reply to one of our emails, is received and stored by our email provider, Resend. We read it there and use it only to answer you.
• Counts for vendors. We count tool page views and clicks on each tool’s buttons, per tool per day, so verified vendors can see how their listing does. We store only the totals: no IP address, cookie or visitor id.
• Partner links. Some “Visit site” links are partner links. When you click one, PartnerStack records the click so the vendor can credit us. The vendor’s own privacy policy applies on their site.

Cookies

We set no cookies of our own for visitors. Vendors who sign in to manage a listing get one, vendor_session, which keeps them signed in for 30 days. Google Analytics sets two, and only after you accept where we ask:

• _ga: tells visits apart. Lasts 2 years.
• _ga_R5K6RECTK5: keeps the state of a visit. Lasts 2 years.

Your choice is saved in your browser’s local storage, not in a cookie.

When we ask first

Visitors in the UK, the European Union and the rest of the EEA, and California see a banner, and analytics stays off until they accept. Elsewhere, analytics loads without asking. If your browser sends Global Privacy Control, analytics stays off wherever you are.

You can change your choice at any time with “Cookie settings” at the bottom of every page. Declining after accepting turns analytics off and removes its cookies.

Your rights

In the UK and the EU you can ask to see, correct, or delete personal data we hold about you, and object to its use. In California you can ask what we collect and ask us to delete it. We don’t sell personal information or share it for advertising. Write to hello@smb-stack.com; we answer within 30 days.