Your data, in plain English.
The lawyers made us write the long version. We wrote a short one too — the promises we'd want if we were you.
Two kinds of data. Two sets of rules.
Stencil lets you build and launch subscription software from a prompt — which means there are two kinds of data in play, and this policy treats them differently.
Your data: your account details, the prompts and content you submit, and how you use the platform. For this, we are the data controller and this policy governs.
Your customers' data: when you launch an app, it may collect information from your own end users — names, emails, payment details. For that data, you are the controller and we act as a processor on your behalf. Your app needs its own privacy policy, and our handling of that data is governed by our Data Processing Agreement. We never use your customers' data for our own purposes.
What we collect.
From you directly: your name, email, and password when you create an account; billing information when you subscribe (processed by our payment provider — we never store full card numbers); the prompts, descriptions, and images you submit while building; and any messages you send us, including feedback from workshops and cohort sessions.
Automatically: log data like IP address, browser, device, and pages visited, plus usage data like features used and apps created. Cookies handle authentication, preferences, and analytics — you can control them in your browser.
From third parties: basic profile info if you sign up with Google, and your name and email if a partner or community referred you.
What you make is yours. All of it.
Your prompts, your content, the apps you build, and the businesses you launch are your intellectual property, entirely and without exception. Using Stencil transfers nothing to us. We take only the limited license we need to operate the Services on your behalf — hosting your app, processing your prompts to generate it.
We don't train on your data.
Not your prompts, not your content, not your apps, not anything — not for our models, not for anyone else's. When you submit a prompt, it goes to trusted third-party AI providers solely to generate your application, and our agreements prohibit them from training on your inputs or outputs.
Our team may review prompts and output to debug issues, provide support, and keep things safe. That review is for operating the Services only — never for training.
How we use what we collect.
To provide and improve the Services — including generating your app from your prompts — process payments, communicate with you about your account, cohorts, and product updates, provide support, watch for fraud and abuse, meet legal obligations, and understand how people use Stencil so we can make it better.
We do not sell your personal information, and we do not share it with third parties for their own advertising.
When we share.
With service providers who help us operate — cloud hosting, AI model providers, payment processing, analytics, email delivery. They may only use your information to provide services to us. We may also disclose information if required by law, or in a merger, acquisition, or sale of assets — in which case we'll notify you.
How long we keep it.
As long as your account is active or as needed to provide the Services. Delete your account and we delete or anonymize your personal information within 90 days, except where we must retain it for legal, tax, or security reasons. Launched apps may be handled differently — see the Terms of Service for what happens to your app and your customers' data on account closure.
Where it lives.
We're based in the United States and process data there and in other countries. If you're in the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses and equivalent safeguards for transfers outside your region.
Your rights.
Depending on where you live: access, correct, delete, or export your personal information; object to or restrict certain processing; and withdraw consent where processing is based on it. Exercise any of these at privacy@hellostencil.com or in your account settings. In the EEA or UK, you can also lodge a complaint with your local supervisory authority.
California residents: we do not sell or share personal information as defined by the CCPA. Exercise your CCPA rights at the address above — we will never discriminate against you for doing so.
Security.
Industry-standard measures: encryption in transit and at rest, access controls, regular security reviews. No system is perfectly secure, so we can't guarantee absolute security — but we'll notify you of any breach affecting your personal information as required by law.
Children.
Stencil isn't directed at children under 16, and we don't knowingly collect their information. If you believe a child has provided us information, contact us and we'll delete it.
When this policy changes.
We may update it from time to time. Material changes get notice — by email or through the Services — before they take effect. The date at the top reflects the latest revision.
Questions? A human reads these.
Stencil Labs, Inc. · 539 Bryant Street, San Francisco, CA