Privacy & Data Protection
StackExpected is committed to protecting your privacy and the security of your data. This page outlines how we collect, use, store, and protect information, along with our full suite of security documentation.
1 Overview & Scope
StackExpected ("we", "our", "us") is a web design and development company serving small businesses, schools, nonprofits, community organizations, and families. This Privacy & Data Protection Policy applies to all information collected through our website, services, quote request forms, client portals, and any other platforms we operate or manage on behalf of clients.
We act as both a data controller (for information we collect about our own operations and prospective clients) and a data processor (for information we handle on behalf of our clients when we build and manage their websites and systems). This dual role means we have responsibilities under applicable data protection laws in both capacities.
This policy is part of our broader Cybersecurity Policy Framework, aligned to the NIST Cybersecurity Framework 2.0, and incorporates industry best practices for Cloud Access Security Broker (CASB) operations as defined by Gartner and the Cloud Security Alliance.
2 Data We Collect
We collect information in the following categories:
Information You Provide
Full name, email address, phone number, organization name, project requirements, budget range, timeline preferences, and any additional notes submitted through our quote request form, contact forms, or during consultations.
Client Project Data
Website content, customer databases, document systems, user accounts, and any data you provide for inclusion in websites or web applications we build and manage on your behalf.
Automatically Collected
IP address, browser type, operating system, referring URLs, pages visited, time spent on pages, and click patterns collected through analytics tools and server logs.
Communication Records
Email correspondence, call notes, meeting summaries, and project communication records maintained for service delivery and quality purposes.
Payment Information
Billing records and transaction data processed through third-party payment processors. We do not store full credit card numbers or sensitive payment credentials on our systems.
Device & Network Data
Information about devices used to access our services, including device identifiers, screen resolution, and network connection details for security monitoring purposes.
3 How We Use Your Data
We use collected information for the following purposes:
4 Data Sharing & Third Parties
We do not sell, rent, or trade your personal information. We share data only in the following circumstances:
5 Data Retention & Deletion
We retain personal data only as long as necessary to fulfill the purposes for which it was collected:
Quote Request Data
Prospective client information not converted to projects is retained for 12 months, after which it is securely deleted unless you consent to longer retention for marketing purposes.
Active Client Data
Client data is retained for the duration of the engagement plus 12 months for support purposes. Upon project completion or client request, data is returned or securely deleted.
Financial Records
Billing and transaction records are retained for 7 years as required by tax and accounting regulations.
All deletion is performed using secure methods: database records are permanently removed, encrypted backups are overwritten in the next backup cycle, and physical media is destroyed using NIST 800-88 compliant procedures.
6 Your Rights
Depending on your location and applicable law, you may have the following rights regarding your personal data:
Right to Access
Request a copy of all personal data we hold about you, including the categories of data, purposes of processing, and recipients of your data.
Right to Rectification
Request correction of inaccurate or incomplete personal data. We will respond to rectification requests within 30 days.
Right to Erasure
Request deletion of your personal data where there is no legal obligation to retain it. This right is subject to applicable legal and contractual obligations.
Right to Portability
Request your data in a structured, machine-readable format for transfer to another service provider.
Right to Restrict Processing
Request that we limit how we use your data while a dispute about its use is being resolved.
Right to Object
Object to processing based on legitimate interests or direct marketing. We will cease processing unless we demonstrate compelling legitimate grounds.
To exercise any of these rights, contact us at support@stackexpected.com. We will respond within 30 days.
7 Security Measures
We implement industry-standard technical and organizational measures to protect your data:
8 CASB (Cloud Access Security Broker) Policies
As a web development company that relies heavily on cloud services, StackExpected implements CASB-style controls to secure our cloud environment. A Cloud Access Security Broker acts as an intermediary between our organization and cloud service providers, enforcing security policies, monitoring activity, and protecting data across all cloud applications.
8.1 SaaS Application Security
All SaaS applications used by StackExpected are subject to the following controls:
8.2 IaaS & PaaS Security
Infrastructure and platform services (hosting, cloud databases, CDN) are secured through:
8.3 Data Governance in the Cloud
9 SaaS Security Posture Management (SSPM)
StackExpected maintains a SaaS Security Posture Management program to continuously assess and improve the security configuration of all cloud applications we use or manage:
Configuration Assessment
Regular automated scans of SaaS application settings to identify insecure configurations, excessive permissions, and policy violations. Critical misconfigurations are remediated within 48 hours.
Permission Governance
Continuous monitoring of user permissions across all SaaS applications. Administrative privileges are limited to designated personnel and reviewed quarterly. Excessive permissions are automatically flagged.
Application Risk Scoring
Each SaaS application receives a risk score based on its security configuration, data access level, and provider security posture. High-risk applications trigger enhanced monitoring and review.
Third-Party Risk Assessment
All SaaS providers undergo a security assessment before onboarding, including review of SOC 2 reports, penetration test summaries, and data handling practices. Assessments are renewed annually.
API Permission Auditing
Regular review of API permissions granted to third-party integrations. Stale and unused API connections are revoked. Permission scopes are limited to the minimum required for functionality.
Compliance Mapping
SaaS application configurations are mapped to compliance frameworks (NIST CSF, SOC 2, ISO 27001) to ensure continuous compliance and facilitate audits.
10 Data Loss Prevention (DLP)
StackExpected implements Data Loss Prevention controls to protect sensitive information from unauthorized disclosure, whether accidental or intentional:
10.1 Endpoint DLP
10.2 Network DLP
10.3 Cloud DLP
11 Threat Protection
StackExpected employs multiple layers of threat protection across our cloud and on-premises environments:
Cloud Workload Protection (CWPP)
Continuous monitoring of cloud workloads (servers, containers, serverless functions) for vulnerabilities, malware, and suspicious activity. Automated patching and remediation for critical vulnerabilities.
Identity Threat Protection
Multi-factor authentication enforcement, anomaly detection for login behavior, credential breach monitoring, and automated account lockout for suspicious activity. Continuous authentication scoring.
Endpoint Detection & Response (EDR)
Real-time monitoring of endpoint activity for malicious behavior, automated threat containment, and forensic investigation capabilities. All company devices run EDR agents.
Secure Web Gateway (SWG)
All web traffic is routed through a secure web gateway that enforces acceptable use policies, blocks malicious websites, and prevents access to known threat distribution points.
Email Security
Advanced email filtering with phishing detection, malware scanning, URL rewriting, and sandboxing of suspicious attachments. Quarterly phishing simulation exercises train team members.
Threat Intelligence
Subscription to threat intelligence feeds for early warning of emerging threats targeting web development tools, hosting platforms, and supply chain vulnerabilities.
12 Compliance & Certifications
StackExpected maintains compliance with applicable regulations and industry standards:
14 Children's Privacy
StackExpected's services are not directed to children under 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly. For school clients, we comply with COPPA requirements and work with schools to ensure appropriate safeguards for student data.
15 International Data Transfers
Some of our cloud service providers may process data in countries outside your jurisdiction. When we transfer personal data internationally, we ensure appropriate safeguards are in place:
16 Data Breach Notification
In the event of a data breach affecting your personal information, we will:
17 Security Documentation Downloads
The following documents comprise our complete security and privacy documentation framework. All documents are aligned to the NIST Cybersecurity Framework 2.0. You may download individual documents or the complete set as a ZIP archive.
Governance & Framework
Identification & Assessment
Protective Controls
Detection & Monitoring
Response & Recovery
Additional Documents
This page also covers CASB-specific privacy topics including SaaS Security Posture Management (SSPM), Data Loss Prevention (DLP) across endpoint/network/cloud layers, Cloud Workload Protection (CWPP), Identity Threat Protection, Secure Web Gateway (SWG) policies, and Data Governance in the Cloud.
18 Contact
Privacy Questions?
If you have questions about this Privacy & Data Protection Policy, want to exercise your data rights, or need to report a privacy concern, please contact us:
Email: support@stackexpected.com
Phone: (555) 123-4567 (Mon-Fri, 9am-5pm)
Response Time: We respond to all privacy inquiries within 30 days.