ā† Back to Documentation

Privacy Policy

Category: legalVersion: v2.0Updated: 2026-08-18

How Stallo handles personal data during early access and pre-launch

Privacy Policy

Effective Date: September 19, 2025
Last Updated: August 18, 2026
Version: 2.0

Stallo AI is developed and operated by 6 Hour AS (Org.nr: 932 547 511).
We are committed to protecting your privacy. This policy explains what data we collect through our website, waiting lists, contact forms, and early access platform services, and how we handle it.

1. What We Collect

Depending on how you interact with Stallo, we collect the following categories of data:

A. Website Visitors, Waitlist Applicants & Contact Inquiries

  • Required: Email address (to respond to inquiries, process waitlist entries, or send updates).
  • Optional / Form Inputs: Name, company name, role, company size, and free-text message content or automation use cases.

B. Early Access Platform Users

  • Account & Workspace Data: Authentication credentials, profile information, and organization details.
  • User-Generated Content & Workflows: Prompts, chat history, uploaded files, and workspace configuration data processed within your active early access sessions.
  • Third-Party Integrations: Data synchronized via user-connected integrations (such as Microsoft Teams or HubSpot), processed strictly based on user authorization.

C. Technical Information

  • Standard technical metadata automatically sent by your browser or client application (e.g., IP address, device type, browser version, and server request logs) used exclusively for security, rate-limiting, and infrastructure stability.

Note: Please avoid including sensitive personal data in free-text fields or prompt inputs.

2. How We Use the Data

We use collected data solely for the following purposes:

  • To provide, operate, secure, and maintain the Stallo platform and early access services.
  • To process contact form submissions and manage waitlist / onboarding requests.
  • To execute private AI workflows, chat compression, and mapping via secure EU infrastructure (Mistral AI), or via user-selected model providers.
  • To power user-authorized integrations (e.g., HubSpot, Teams).
  • To monitor system performance, troubleshoot technical errors, and maintain platform security.

We do not sell, rent, or trade your personal data, nor do we use private workspace data or user chat content to train public foundational AI models.

3. Legal Basis (GDPR)

Under GDPR and Norwegian privacy regulations, we process personal data based on:

  • Consent: When you explicitly submit your email to join the waitlist, contact us, or authorize third-party integrations.
  • Performance of a Contract: When providing early access platform services, user accounts, and requested workflows.
  • Legitimate Interest: To maintain website and platform security, analyze service usage trends, and develop product improvements.

4. Data Sharing, Subprocessors, and Residency

We engage trusted service providers and subprocessors to support our infrastructure:

  • Core Hosting & Storage: Amazon Web Services (AWS) hosted in the European Union (eu-central-1).
  • AI Processing (Private Workflows): Mistral AI (EU-native infrastructure for internal data mapping and chat handling).
  • Web Research Signals: Brave Search API (privacy-focused independent web indexing for public market signals).
  • Multi-Model Routing & Integrations: User-configured model providers (OpenAI, Anthropic, Google with explicit regional residency tags) and integrations (HubSpot, Teams) engaged strictly on a user-opt-in basis.

If personal data is transferred outside the EEA, we rely on Standard Contractual Clauses (SCCs), the EU-US Data Privacy Framework, or equivalent legal safeguards. For full details, see our Subprocessor List.

5. Data Retention

  • Waitlist & Contact Data: Retained until product launch, until your request is resolved, or until you opt out/unsubscribe.
  • Early Access Account & Workspace Data: Retained for the duration of your active user account or workspace agreement, after which data is securely purged upon request or account termination.
  • Technical Logs: Retained only for as long as strictly necessary for security auditing, rate-limiting, and debugging.

6. Your Rights

Under GDPR, you retain full control over your personal data. You have the right to request:

  • Access to the personal data we hold about you.
  • Correction of inaccurate data or deletion of your data.
  • Restriction or objection to certain data processing activities.
  • Withdrawal of consent at any time (via unsubscribe links, account settings, or by contacting us directly).

7. Contact

For questions, privacy requests, or data deletion inquiries:
šŸ“§ privacy@6hour.no

Postal Address:
6 Hour AS
Trondheim, Norway

8. Changes to This Policy

We may update this privacy policy as our platform evolves out of early access and introduces general public features. The latest version will always be available at legal.stallo.ai.

Last updated: August 18, 2026

Document Information

  • File: legal/privacy-policy_v2.0.md
  • Category: legal
  • Version: 2.0 (semantic)
Download formats: