How we handle your data.

The tools (Variance Analyzer, CFO Board Narrative Generator)

When you use a tool, your inputs go to Anthropic to generate the result. ExecStack doesn't store them, log them, or see them — our API routes pass them straight through without writing to any database. Files you upload are parsed in your browser; only the extracted text leaves your machine. One exception: when you upload a file to the Board Narrative tool's data extractor, the file passes through our server in memory to be read — it's not logged, stored, or written to disk.

Anthropic's handling is at trust.anthropic.com.

The Discovery Flow (“Just Ask”)

When you submit a request through Just Ask, we keep more than the tool routes do — because we need it to reply, scope the build, and send what we built back to you. This section walks through what's stored, where, and for how long.

What we keep

We store the text you wrote, the AI reply you saw, any sample input/output files you uploaded (or the descriptions you wrote if you used “describe instead”), your answers to the 6 follow-up questions, and your email address when you provide it. We also store a hashed version of your IP address and a signed session cookie identifier — both used to resume your request if you come back, and to spot abuse.

Where it lives

Everything text-based goes into our Supabase database. Files go into a private Supabase Storage bucket — service-role access only, no public URLs, nobody outside our server can read them. Your inputs travel through Anthropic when our AI processes them; Anthropic's handling is at the link above.

For how long

Three retention windows, all enforced by a daily automated job:

• In-progress sessions — if you start a request but don't finish, we delete the row and any uploaded files within 7 days.
• Uploaded files — even on completed sessions, files are deleted at 90 days maximum.
• Completed lead records — kept for 36 months, then deleted. B2B sales cycles are long; this window balances that with the privacy commitment.

The PII scanner

Before anything you type or upload leaves your browser, we scan it for patterns that look like personal data about other people — Social Security numbers, names, emails, salary or medical-code columns, and similar. The scan runs entirely on your machine; no API calls, no data transit. It's a heuristic, so we sometimes flag things that aren't actually sensitive — that's why we show you what was removed and let you restore the original. If we spot something, we redact it and tell you exactly what we removed.

IP hashing

We never store your raw IP address. Before writing anything to the database, we hash it with a private salt that lives only on our server. The hash drives rate limiting and bot-detection; it can't be reversed back to your IP without the salt.

Signed session cookie

When you start a request we set a small cookie in your browser. It carries an opaque session identifier signed with a server-side secret (HMAC-SHA256), is httpOnly and SameSite=Lax, and expires in 7 days. We use it to resume your session if you return. Nothing in the cookie tells us who you are — just that this browser started a session here. Rotating our server secret invalidates every existing cookie cleanly.

Nudge emails

If you start a request and provide your email but don't finish, we'll send you one reminder so you can pick up where you left off. We send this once, never again, and never share your email with anyone outside our processors listed below.

Account portal

If we've built a custom tool for you, you sign in at /my-stack. Your email and an authentication session cookie are stored in Supabase. We don't track what you do inside the portal.

Who handles your data

Six companies process some part of your data when you use ExecStack:

• Vercel — hosts the site and runs the API. Includes basic page analytics: pageviews and approximate country, with no individual identifiers stored.
• Anthropic — runs the AI behind every tool.
• Upstash — runs the rate limiter that prevents abuse of our public tools. Sees an IP-derived key for each request; doesn't see content.
• Supabase — our database and file storage. Holds Discovery Flow records, account data, and uploaded sample files in a private bucket.
• Resend — sends transactional emails — confirmations, nudges, bot-check messages, and Discovery Flow notifications.
• Cloudflare Turnstile — invisible bot check that fires on the submission form starting with your second submission in 24 hours. Turnstile sees an opaque challenge token from your browser, not your form contents.

Your rights

Email build@execstack.ai to:

• See what we've stored about you
• Delete it
• Correct it
• Export it

We aim to respond within a few business days.

Enterprise deployment

For organizations with strict data governance — finance, healthcare, defense — we deploy private versions of our tools inside your existing AWS, Azure, or GCP environment. Your data never leaves your infrastructure. Email build@execstack.ai to talk it through.