1. Controller
Stashiro is operated by Corsi Davide Orso, an Italian sole proprietorship operated by Davide Corsi. Italian VAT number: 03032600995. Privacy requests can be sent to corsidavide@orso.studio or through the published contact channel.
2. Data we process
- Account data, such as name, email, avatar, auth identifiers, and sign-in metadata.
- Billing data, such as selected plan, subscription status, Stripe customer and subscription identifiers, invoices, payment status, first name, last name, billing email, billing address, and related checkout metadata.
- Workspace data, such as boards, notes, text, links, uploaded files, audio recordings, drawings, maps, AI prompts and outputs, invite roles, presence, and collaboration metadata.
- Link and preview data, such as saved URLs, page titles, thumbnails, embed metadata, shopping or travel preview details, and map or location information you choose to add.
- Usage, entitlement, analytics, and security data, such as device, browser, IP-derived logs, page views, feature interactions, rate limits, storage usage, AI credit usage, errors, traces, and service diagnostics.
- Extension data, such as the active tab URL you choose to save, page titles and preview image URLs, selected text you confirm, screenshot areas you explicitly capture, the selected board, retry status, authentication sync state, and account-scoped local extension cache.
- Support communications and feedback you choose to send.
3. Chrome extension
Stashiro Web Clipper is the Stashiro Chrome extension for saving user-selected content to Stashiro whiteboards. The extension may process authentication information to connect to your Stashiro account and website content you choose to save, such as links, selected text, screenshots, images, page titles, preview image URLs, and page metadata.
Extension data is used only to provide save-to-whiteboard features, keep your selected board and extension preferences in sync, retry saves you request, and secure authenticated access to your Stashiro account. Stashiro Web Clipper does not sell extension data, use it for advertising, or use it to create unrelated browsing profiles.
4. Purposes and legal bases
We process data to provide the service, authenticate users, store and sync boards, process payments, prevent abuse, secure the platform, provide support, manage plan limits, reset AI credits on eligible billing events, meet legal obligations, and improve Stashiro. The legal bases may include performance of a contract, legitimate interests, legal obligations, and consent where required.
5. Local boards
Guest boards may be stored locally in your browser. Stashiro does not automatically import local boards into cloud storage after sign-in. Transfer to cloud should happen only when you explicitly request it.
6. Processors and third parties
Stashiro may use processors and infrastructure providers for hosting, authentication, database, file storage, payments, email, maps, AI features, link previews, and support. These providers process data only as needed for their role.
The provider categories most relevant to browser extension data are sign-in and session services, cloud board database services, file storage services for uploaded screenshots or media, payment processors for paid cloud access, and diagnostics or analytics services when configured. Development tools and build tools are not listed here unless they process user content or personal data.
Stripe processes payment details, billing details, subscriptions, invoices, fraud checks, and payment method information. Stashiro does not store full card numbers. Authentication providers process login sessions and identity data. Storage and database providers process cloud boards and uploaded files. AI providers may process prompts, board context, and generated outputs when you use AI features.
Sentry may process error reports, stack traces, performance traces, release metadata, browser details, and limited account identifiers to help diagnose what broke. PostHog may process page views, feature interactions, session analytics, browser details, and limited account identifiers to understand how the product is used.
Third-party websites you save, open, embed, or preview may process data under their own policies when content loads or you interact with it. This can include social platforms, video providers, shopping sites, travel sites, map providers, and websites opened from board links. Optional analytics or marketing tools should be controlled where consent is required.
Stashiro's browser extension use and transfer of user data follows the Chrome Web Store User Data Policy, including the Limited Use requirements. Extension data is used only to provide and improve user-facing Stashiro features, is not sold, and is not used for advertising or unrelated profiling.
7. AI features and data use
When you use AI features, Stashiro may process and send the selected prompt, board context, files, screenshots, links, metadata, and generated outputs to AI providers only as needed to provide the requested feature, generate or edit board content, enforce usage limits, prevent abuse, maintain security, debug failures, and support your account.
AI providers may process prompts, context, and outputs under their own service terms and data-processing commitments. You should not submit sensitive personal data, confidential business data, or regulated data to AI features unless you have the rights and consents needed to do so.
8. International transfers
Some providers may process data outside your country. Where required, transfers rely on appropriate safeguards such as adequacy decisions, Standard Contractual Clauses, or equivalent lawful mechanisms.
9. Retention
Account, board, billing, and security records are kept for as long as needed to provide Stashiro, comply with law, resolve disputes, prevent abuse, and enforce agreements. You may delete boards and request account deletion, subject to legal retention requirements.
Billing records, invoices, subscription history, and payment-related identifiers may be retained for accounting, tax, chargeback, fraud prevention, and legal purposes. Guest boards remain in your browser until you delete them, clear browser storage, or transfer them to cloud storage.
The browser extension may keep an account-scoped local cache of board names and saved-source summaries for faster loading. Stashiro clears private extension cache when the extension detects sign-out or an account change. Session authentication tokens are kept in browser session storage and expire when the browser session ends.
Account deletion can be started from Account settings. The deletion process deletes or anonymizes user data associated with that account from active Stashiro databases within 30 days, unless retention is required or reasonably necessary for billing, tax, accounting, chargebacks, fraud prevention, security, abuse investigations, dispute resolution, legal compliance, or enforcement of agreements.
Deleted account data may remain in Stashiro backups for a limited period and is not restored for normal account use after deletion.
Billing records, invoices, payment events, fraud, tax, accounting, chargeback, security, and legal records may be retained where required by law or payment providers. Stripe may retain payment data under its own legal obligations.
10. Your rights
Depending on your location, you may have rights to access, correct, delete, export, restrict, object to processing, withdraw consent, and complain to a supervisory authority. We may need to verify your identity before responding.
Signed-in users can download an account export from Account settings. The export is a JSON file covering profile details, billing status, cloud board metadata, board item text, AI prompt records, feedback, and connected services. Board-level export remains available when a user needs a portable board archive with embedded media files.
11. Security
We use technical and organizational safeguards designed to protect personal data. No online service can guarantee absolute security, so users should keep credentials safe and report suspected unauthorized access promptly.
If Stashiro becomes aware of a personal data breach, we will investigate it, take appropriate containment and mitigation steps, and document the facts, effects, and remedial actions taken. Where required by applicable law, or where appropriate to help affected users protect themselves, we may notify affected users, competent authorities, payment providers, infrastructure providers, or other relevant parties. Suspected security or privacy incidents can be reported to corsidavide@orso.studio.
12. Children
Stashiro is not intended for children under 16. If you believe a child has provided personal data without appropriate permission, contact us so we can take appropriate action.