Stashiro

Effective August 2, 2026

Privacy Policy

This policy explains what personal data Stashiro processes, why it is processed, and the rights available to users.

1. Controller

Stashiro is operated by Corsi Davide Orso, an Italian sole proprietorship operated by Davide Corsi. Italian VAT number: 03032600995. Registered address: Via Santorre De Rossi Di Santarosa 12, INT 2, 16167 Genova, Italy. Privacy requests can be sent to corsidavide@orso.studio or through the published contact channel.

2. Data we process

  • Account data, such as name, email, avatar, auth identifiers, and sign-in metadata.
  • Billing data, such as selected plan, subscription status, Stripe customer and subscription identifiers, invoices, payment status, first name, last name, billing email, billing address, checkout consent records, withdrawal requests, and electronic receipt delivery status.
  • Workspace data, such as boards, notes, text, links, uploaded files, audio recordings, drawings, maps, AI prompts and outputs, invite roles, presence, and collaboration metadata.
  • Link and preview data, such as saved URLs, page titles, thumbnails, embed metadata, shopping or travel preview details, and map or location information you choose to add.
  • Usage, entitlement, analytics, and security data, such as device, browser, IP-derived logs, page views, feature interactions, rate limits, storage usage, AI credit usage, errors, traces, and service diagnostics.
  • Extension data, such as the active tab URL you choose to save, page titles and preview image URLs, selected text you confirm, screenshot areas you explicitly capture, the selected board, retry status, authentication sync state, and account-scoped local extension cache.
  • Support communications and feedback you choose to send.

We receive this data from you, your device and browser, authentication and payment providers, people who invite you to a shared workspace, authorized connected apps, and the public pages you ask Stashiro to save or preview.

4. Purposes and legal bases

  • Contract: create and secure accounts, store and sync cloud boards, enable collaboration, process requested previews and AI features, provide support, manage subscriptions, and enforce plan limits.
  • Legitimate interests: prevent abuse and fraud, maintain service security and reliability, diagnose failures, protect legal claims, and improve Stashiro using proportionate operational information.
  • Legal obligation: retain and process information required for tax, accounting, payment, consumer, security, and regulatory duties.
  • Consent: use optional analytics storage or another optional feature where applicable law requires permission. Consent can be withdrawn at any time without affecting earlier lawful processing.

Account, authentication, workspace, and required billing data must be provided when needed to deliver the requested service. Without it, we may be unable to create an account, store cloud boards, collaborate, provide paid features, or complete checkout. Optional analytics and voluntary feedback are not required to use core product features.

5. Local boards

Guest boards may be stored locally in your browser. Stashiro does not automatically import local boards into cloud storage after sign-in. Transfer to cloud should happen only when you explicitly request it.

6. Processors and third parties

Stashiro uses service providers for hosting, authentication, databases, file storage, payments, email, maps, AI features, link previews, diagnostics, analytics, and support. They receive only the data needed for the service they provide.

Payment providers process billing and payment information; authentication providers process identity and session data; hosting, storage, and database providers process cloud boards and uploaded files; email providers deliver requested transactional confirmations; AI providers process content submitted to an AI feature; and diagnostics or analytics providers process limited device, account, error, performance, and usage data for their stated purpose.

Third-party websites you save, open, embed, or preview may process data under their own policies when content loads or you interact with it. This can include social platforms, video providers, shopping sites, travel sites, map providers, and websites opened from board links.

Stashiro's browser extension use and transfer of user data follows the Chrome Web Store User Data Policy, including the Limited Use requirements. Extension data is used only to provide and improve user-facing Stashiro features, is not sold, and is not used for advertising or unrelated profiling.

7. AI features and data use

When you use AI features, Stashiro may process and send the selected prompt, board context, files, screenshots, links, metadata, and generated outputs to AI providers only as needed to provide the requested feature, generate or edit board content, enforce usage limits, prevent abuse, maintain security, debug failures, and support your account.

AI providers may process prompts, context, and outputs under their own service terms. You should not submit sensitive personal data, confidential business data, or regulated data to AI features unless you have the rights and consents needed to do so.

8. International transfers

Some providers may process data outside the European Economic Area. Where the GDPR requires a transfer mechanism, transfers rely on an adequacy decision, contractual safeguards such as the European Commission's Standard Contractual Clauses, or another mechanism permitted by law. Contact us for information about safeguards that apply to your data.

9. Retention

Personal data is kept only for as long as needed for the purposes described in this policy. The period depends on the type of data, account and subscription status, applicable legal obligations, disputes, security and fraud risks, and provider backup cycles.

Guest boards remain in your browser until you delete them, clear browser storage, or transfer them to cloud storage. Account deletion can be started from Account settings, subject to data that must or may be retained under applicable law or for legal claims, security, or fraud prevention.

Deleted data may remain temporarily in restricted backups and provider caches until their normal rotation. Limited billing, tax, payment, checkout consent, withdrawal, security, and deletion-safety records may be kept only while required by their applicable obligation, dispute, or risk. Withdrawal records are assigned a retention review date and are deleted after review unless a continuing obligation or documented legal hold requires a later review.

10. Your rights

Depending on your location, you may have rights to access, correct, delete, export, restrict, object to processing, withdraw consent, and complain to a supervisory authority. We may need to verify your identity before responding.

Send a request to corsidavide@orso.studio. Requests are handled as required by applicable law.

Signed-in users can use Account settings to download an account export or request account deletion. These controls do not limit rights available under applicable law.

You may withdraw optional analytics consent through Cookie settings and object to processing based on legitimate interests by contacting us. You may also complain to a competent supervisory authority, including the Italian Data Protection Authority.

11. Security

Stashiro uses technical and organizational measures appropriate to the risks of processing. No online service can guarantee absolute security. Suspected security or privacy incidents can be reported to corsidavide@orso.studio.

12. Children

Stashiro is not intended for children under 16. If you believe a child has provided personal data without appropriate permission, contact us so we can take appropriate action.