Privacy Policy

When a library uses Stacks, the library is the data controller for the roster and schedule information it enters — staff and volunteer records, shifts, time off, and related notes. Stacks acts as a data processor, handling that information on the library's behalf and under its instructions.

If you're a staff member or volunteer with questions about your information, contact your library administrator first — they decide what is collected and how it is used.

• Information libraries provide. To run a schedule, administrators enter records about their people: names, email addresses, phone numbers, role (staff or volunteer), home location, training/eligibility flags, shifts, time off, and notes.
• Account and sign-in information. When someone is invited to log in, we process their email address and authentication details to create and secure their account.
• Usage information. We use privacy-respecting product analytics to understand how the Service is used and improve it. We do not send names or email addresses to our analytics; it processes pseudonymous identifiers, feature events, and standard technical data (such as browser type and approximate region). Our website does not currently load third-party advertising trackers.
• Diagnostics. We use error monitoring to detect and fix problems, which may include technical details about an error and the page where it occurred.
• Communications.We send transactional emails (invitations and notifications you've opted into) through our email provider.
• Free resources you request. If you ask us to email you a free resource (like our schedule template), we store the email address you give us and whether you opted into hearing about future updates. We email you the resource you asked for; we only send anything further if you checked the opt-in box, and every such email includes a way to unsubscribe. We never sell or share this list.
• Billing. When a library subscribes, payments are processed by our payment provider. We receive limited billing details (such as a customer identifier and subscription status); we do not store full payment-card numbers.

We use the information above to:

• provide, operate, and secure the Service;
• send the notifications a library configures and respond to support requests;
• process subscriptions and billing;
• detect, prevent, and address abuse, security issues, and technical problems; and
• understand usage and improve the product.

Our legal bases, where applicable, are performing our contract with the library, our legitimate interests in operating and improving the Service, and consent where the law requires it.

We do notsell personal information, and we do not share it for advertising. We share information only with service providers (“sub-processors”) that help us run the Service, each bound to protect it:

We may also disclose information if required by law or to protect rights and safety. A current sub-processor list and a Data Processing Addendum (DPA) are available to library customers on request.

We keep a library's data while its account is active. After an account closes, we keep the data for up to 30 days (so it can be exported or the closure reversed) and then delete it, except where we must keep limited records for legal or accounting reasons.

Libraries can access, correct, and export their data at any time from within the Service (Settings → Data export). To delete an account and its data, email us at support@stacksforlibraries.com from the account owner's address — we'll confirm and complete the deletion within 30 days (except limited records we must keep for legal or accounting reasons). If you're a staff member or volunteer, contact your library administrator to access or correct your record.

Depending on where you live, you may have additional rights under applicable privacy laws. Contact us and we'll honor those rights or route the request to the controlling library.

Stacks is a workforce tool for libraries; we do not direct it to children or knowingly collect information from children. Libraries that schedule minors (for example, teen volunteers) are responsible for obtaining any consents their policies or the law require.

We protect data with access controls and tenant isolation (each library's data is segregated), encryption in transit (TLS), and encryption at rest provided by our database host. No method is perfectly secure, but we work to protect your information and to fix issues quickly.

We operate in the United States, and our providers store data in the United States. If you access the Service from elsewhere, you consent to processing in the United States.

We'll update this policy as the Service evolves and post the new version here with a revised date. We'll communicate material changes to library account administrators.

Questions about this policy or your data? Email support@stacksforlibraries.com.