Legal

Privacy Policy

Last updated: October 22, 2026

1. Who we are

This site is operated by LumiShop LLC, doing business as The Operator Stack, 30 N Gould St, Sheridan, WY 82801, United States. LumiShop LLC is the controller of the personal data described in this policy. Privacy questions and requests: andrej@theoperatorstack.io.

2. What we collect

We collect different information depending on what you do:

• Purchases: name, email address, billing details, country, any business name or tax ID you choose to provide, the product and price, payment status, refund or dispute status, and a Stripe customer, checkout, or payment identifier. Stripe receives your full card details. We do not receive or store the full card number or card security code.
• Delivery and owner support: the files and emails sent to you, delivery status, scheduled follow-up messages, replies, stop requests, and support correspondence.
• Free downloads and leads: email address, the item requested, form and campaign source, delivery status, scheduled follow-up messages, and any stop request you send us.
• Optional buyer answers: if you answer the short one-tap questions on your access page (what you sell, who does your marketing, where your customers come from and what's holding your business back), we store each selected option with your Stripe customer or payment record and on your contact record with our email provider, Resend.
• Site and device activity: pages and links viewed, clicks, scrolls, session duration, referral page, approximate region, language, browser, device, operating system, IP address, user agent, advertising identifiers, and cookie or local-storage identifiers.
• Attribution: UTM source, medium, campaign, content, and term, plus campaign, ad-set, ad, placement, click identifiers, and first or recent landing details when present.
• Security and operations: request logs, timestamps, error details, webhook events, and other records needed to prevent abuse, diagnose failures, and keep purchases and delivery working.
• Manny: if you use Manny, the business details, files, chats and work you put into it, as described in section 13.

Please do not send us sensitive personal information. This site is built for business operators and does not ask for health, biometric, government-ID, precise-location, or similar sensitive data.

3. Why we use it

• Process payment, prevent fraud, issue refunds, and keep accounting and tax records.
• Deliver the product or free item you requested and show the correct access instructions.
• Send transactional messages, product updates, support replies, and permitted marketing messages.
• Remember attribution details long enough to connect a checkout with the visit that led to it.
• Measure traffic, page use, checkout activity, purchases, and advertising performance.
• Show people who have bought from us ads for products they don't own yet, and leave them out of ads for products they already have.
• Understand where people get stuck, improve the site, and decide what to build next.
• Protect the site, investigate errors, enforce our terms, and meet legal obligations.

4. Our legal bases

Where laws such as the GDPR or UK GDPR apply, we use personal data on one or more of these bases:

• Contract: to take payment, deliver what you requested, provide access, process a refund, and answer product support questions.
• Legitimate interests: to secure and operate the business, prevent abuse, keep accurate attribution and business records, understand aggregate site performance, show past customers ads for our other products, improve the product, and defend legal claims. We balance these interests against your rights.
• Consent: where you give it for a specific optional use, including marketing where consent is required. You can withdraw consent at any time.
• Legal obligation: for tax, accounting, consumer-protection, sanctions, law-enforcement, and other duties that apply to us.

5. Services that receive data

We use the following providers to run the site and measure it:

• Stripe processes checkout, payment, refunds, fraud checks, and payment records. Stripe Privacy Center.
• Resend sends delivery, lifecycle, marketing, and support email and records delivery events. Resend Privacy Policy.
• Vercel hosts the site, server functions, logs, and private product files. Vercel Privacy Notice.
• Google Analytics measures visits, pages, devices, approximate location, traffic source, and events. Google Privacy Policy.
• Google Fonts supplies the site's typefaces. When your browser requests a font file, Google receives technical request data such as the IP address and user agent. Google Privacy Policy.
• Microsoft Clarity provides interaction analytics, heatmaps, and session replays that can include clicks, scrolls, and the page content shown in a browser. We do not use it to intentionally capture payment-card fields. Microsoft Privacy Statement.
• Rybbit provides traffic, funnel, and custom-event analytics, including URLs, query parameters, device and region data, UTMs, and anonymous session identifiers. For customers, it also receives a coded customer number, so that one customer's visits from different browsers count as one person. The number contains no name, email or payment details. Rybbit Privacy Policy.
• Meta, including Meta Pixel, Conversions API, and the Stape CAPI Gateway used to route server events, measures ad delivery and conversions. Purchase or lead events can include page and campaign details, IP address, user agent, Meta cookie identifiers, and contact information transformed into hashed values for matching. If you have bought from us, we may also send Meta your email address, name and country as hashed values, so it can match them to a Facebook or Instagram account and show you ads for products you don't own yet, or leave you out of ads for products you already have. To be left out, email andrej@theoperatorstack.io and we will remove you before the next list goes to Meta. Meta Privacy Policy.
• FirstPromoter runs our referral program. When you arrive through a referral link, it sets a cookie that records the visit and the link, so a purchase can be credited to the person who referred you. If you join the program, it also holds your name, email, payout details and the purchases credited to you. FirstPromoter Privacy Policy.

We may also disclose information to professional advisers, authorities, courts, or a buyer of the business when reasonably necessary and permitted by law. We do not sell personal information for money.

Manny uses further providers, listed in section 13.

6. Cookies, local storage, and advertising choices

Google Analytics, Microsoft Clarity, Meta, and related tools can use cookies or similar identifiers. Our own attribution script uses browser local storage to remember campaign and landing details. These technologies can recognize a browser, connect events within a session, and help attribute a purchase or lead.

The current site does not have a dedicated cookie-preference panel. You can block or clear cookies and local storage in your browser, use privacy extensions, or use device and platform advertising controls. Blocking them can reduce measurement accuracy, but the core pages and checkout should still work. Browser settings do not erase information already received by a provider.

Some US state laws may call the use of advertising or cross-context measurement providers a "sale," "sharing," or "targeted advertising" even when no money changes hands. You can request an opt-out at andrej@theoperatorstack.io. We will verify and process requests as required by applicable law.

7. Email

We send transactional messages needed to deliver and support what you requested. We may also send product updates and related offers where permitted. Free-download follow-up can include the requested item, reminders, and product offers. To ask us to stop marketing email, reply STOP or email andrej@theoperatorstack.io. We handle these requests manually, so a message already queued before we process the request may still arrive. Necessary purchase, delivery, refund, security, and support messages may continue.

8. How long we keep it

We keep purchase, refund, and accounting records for the period required by tax, accounting, fraud-prevention, and legal rules. We keep owner, lead, and email records while the relationship is active, until a stop or deletion request is processed, and for a limited period afterward when needed to honor that request, resolve disputes, or meet legal obligations. Support correspondence and operational logs are kept only as long as reasonably needed for support, security, debugging, and claims. Analytics and advertising providers apply their own retention settings and policies. Manny's retention is in section 13.

9. International transfers

We are a United States company and use providers that process information in the United States and other countries. Those countries may have different privacy laws. Where required, we or the relevant provider rely on an approved transfer mechanism or another lawful safeguard. A provider's own policy may give more detail about its transfer practices.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, object to, or receive a copy of personal data, withdraw consent, opt out of certain advertising uses, and appeal a request decision. You may also have the right to complain to your local data-protection authority.

Email andrej@theoperatorstack.io with the request and the email address you used. We may ask for enough information to verify your identity and locate the record. Authorized agents may submit a request where local law allows it. We will not discriminate against you for exercising a privacy right.

11. Security

We use access controls, private file storage, signed webhooks, and established service providers to protect information. No online service can guarantee perfect security. Please contact us if you believe your purchase, email, or personal data has been misused.

12. Children

This site sells business tools and is not directed at anyone under 18.

13. Manny, the web app

Manny is our web application at manny.theoperatorstack.io. This section covers what happens to the information you put into it. Everything else on this page applies to Manny too.

What Manny keeps

• Your account: your name, email address, sign-in details, the workspaces you belong to and the people you add.
• Your business details: what you save in a workspace, such as your offer, prices, customers' words, voice samples and the work you approve.
• Your chats and requests: what you ask Manny and what it answers.
• Files you upload: images, logos, product photos, documents, fonts and pages.
• What Manny makes: drafts, briefs, research reports, images and other outputs, with a record of what each one used.
• Research results: when you ask for research, the public web pages, search results and public posts Manny collects for it.
• Usage and cost records: which job ran, which AI provider and model it used, and what it cost.
• Support and security records: support requests and screenshots you send us, sign-in and error logs.

Manny runs no advertising or analytics trackers and sets no cookies of its own. It keeps you signed in through your browser's session storage and saves a few settings, such as light or dark mode, in your browser's local storage.

Files you upload

When you upload a file, Manny treats it as yours. It records the file as material your account owns or has the right to use (in the app this is called "account owned"). It then uses the file on that basis, for example to put your product photo into an image. Upload only files you own or are allowed to use. If you upload something you don't have the rights to, tell us and we'll remove it.

The AI providers that process your content

Manny does its work by sending the parts of your content a job needs to AI providers. Each provider receives only what that job needs, processes it to return a result, and handles it under its own business terms.

• Anthropic (Claude models): chat, writing and checking.
• OpenAI: writing and reading models, and image generation.
• Google (Gemini models): reading, writing and image generation.
• Vercel AI Gateway: passes some chat requests to model providers (Anthropic by default), with zero data retention requested.
• Kie.ai: image and video generation, when you ask for them.
• OpenRouter: connected to Manny, but no Manny feature sends it requests today. If we route a request through it, it passes the request to the model host it selects.

For research, Manny also sends search terms and web addresses (not your files) to Brave Search (web search), Jina Reader (reads public web pages) and ScrapeCreators and Arctic Shift (public Reddit posts and comments).

We do not use your content to train AI models, and we don't sell it. Anthropic, OpenAI, Google and the Vercel AI Gateway say in their API terms that they do not use what we send them to train their models. Kie.ai's terms let it use what we send it to operate and improve its service, and they do not say whether that includes training.

OpenRouter is also an exception. We have not turned on OpenRouter's settings that block training and data retention, so a request sent through OpenRouter would be handled under the terms of OpenRouter and the model host it picks. Those terms may let the host keep the request or use it to improve its models.

Where it is stored

• Supabase stores the database and your uploaded files in the United States (US East, Ohio).
• Vercel runs the app and its server functions in the United States (Cleveland, Ohio) and keeps request and error logs for up to 30 days.
• Amazon Web Services (Key Management Service, US East, Ohio) encrypts the access keys for AI provider accounts. It never sees your content.
• Resend sends account and support emails, with open and click tracking turned off, and stores its email records in the United States.
• The AI providers above process requests in the United States and other countries.

If you use Manny from the European Union, the UK or Switzerland, your Manny data is transferred to the United States. Supabase and Vercel process it for us under data processing agreements that include the European Commission's standard contractual clauses. Section 9 explains how transfers are protected.

Who can see your work

You, and the people you add to a workspace, in the workspaces you give them. We look at your data only to give you support, fix a problem or keep the service secure.

How long we keep it

• While your account is open, we keep your workspaces and files until you delete them.
• When your account closes (for example when a subscription ends), you have 30 days to export your work. After that, your content is deleted.
• If we gave you free access and it ends, you can still sign in and export your work. We keep your content until you ask us to delete it or we delete the account.
• When we delete an account, we remove its content from the database and file storage. We keep billing and accounting records for the periods the law requires, security logs for a limited time, and a short record that the deletion happened. Backup copies are overwritten on our storage provider's backup cycle, within 7 days.
• AI providers keep request data for the periods their own terms set, unless zero data retention applies. Anthropic deletes it within 30 days, OpenAI keeps abuse-monitoring logs for up to 30 days, Google keeps it for 55 days to detect misuse, and Kie.ai keeps generated files for 14 days and its logs for 2 months.

How we improve Manny

Manny records how it is used: which features you use, how long they take, what they cost and which errors happen. These usage numbers contain no chat content. We keep them for up to 13 months. Once a day, Manny also runs an automated review of that day's chats to find where it falls short, such as requests it misreads or cannot handle yet. Before an AI model reads the chats, we remove names, email addresses, phone numbers, web addresses, keys and the business names saved in your workspace. The model returns patterns, each with a few short excerpts from the cleaned text. Through this review, our team sees only those patterns and excerpts, never your raw chats, and we delete them after 90 days. The removal is automatic, so it can miss a detail. That is one reason no one on our team reads chats this way. We do not use your chats or these results to train AI models, and the review runs with zero data retention requested from the model provider. To opt out, email andrej@theoperatorstack.io from the address you sign in with. We will take your account out of the review, delete the patterns and excerpts that came from it, and confirm by email. Usage numbers continue, because they hold no chat content.

Deleting your data

Email andrej@theoperatorstack.io from the address you sign in with and ask us to delete your Manny account or a specific workspace. We confirm when it's done. Your other rights are in section 10.

14. Changes

The current version lives on this page. We will update the date above when the policy changes materially.