Privacy Policy

We collect and use your personal information to deliver, improve, and ensure the safe operation of our Services. The types of information we may collect include:

We use the collected data for various purposes:

• To provide and maintain our services
• To notify you about changes to our Services
• To enable you to participate in interactive features of our services
• To provide customer support
• To gather analysis or valuable information so that we can improve our Services
• To monitor the usage of our services
• To detect, prevent, and address technical issues

Your privacy is important to us. We do not share, sell, or rent your personal information to third parties. Your data may be used to enable service providers (sub-processors) to perform functions and services on our behalf, such as hosting, authentication, browser automation, AI model inference, email delivery, payments, and performance monitoring. The sub-processors we currently rely on are:

• Supabase– authentication, database, storage, and realtime
• Vercel– application hosting, edge delivery, and AI Gateway
• Amazon Web Services (AWS)– underlying cloud infrastructure for several of our sub-processors
• Cloudflare– network, edge, and inbound email handling
• Google Cloud– Vertex AI model hosting and Google sign-in
• Anthropic and OpenAI– AI models that power our agents (Anthropic models are accessed via Google Vertex AI)
• Browserbase– hosted browser sessions used by our AI actors
• Trigger.dev– background task and workflow orchestration
• Resend– transactional and notification email delivery
• Stripe– billing and payment processing
• Opinly– blog content management, and first-party analytics across our website and the product (see Website Analytics below)
• GitHub, Figma, Linear, and Slack– optional integrations you choose to connect (see Third-Party Integrations below)

These parties are obligated not to disclose or use your data for any purpose other than providing their services to us. Where a sub-processor is located outside your region, transfers are made under appropriate safeguards.

Some features let you connect Stunt Double to third-party accounts. Connecting an integration is always optional and initiated by you. We request only the minimum OAuth scopes needed for the feature, access only the data those scopes permit, use it solely to provide the functionality you have requested, and never sell it. You can revoke access at any time from your connection settings or from the provider directly, after which we stop accessing new data.

• GitHub– your basic profile, email address, and the repository content you authorise, so actors can review and work with your code.
• Figma– your profile, file metadata and content, and file comments, so actors can test and comment on your designs and prototypes.
• Linear– read and write access to issues and comments, so we can create and update issues on your behalf.
• Slack– reading and posting messages in the channels you authorise, so we can deliver notifications and respond to mentions.
• Vercel– project and deployment metadata for the Vercel Marketplace integration, used for provisioning and billing.

We also support passwordless sign-in with Google, GitHub, and Figma, which shares only the profile and email information needed to create and authenticate your account.

Our public website (stuntdouble.io) uses Opinly for first-party analytics and to publish part of our blog. The analytics are first-party: the data is ours, and no third-party advertising network sits in the middle.

When you visit our website, Opinly records:

• Page views and client-side navigation, along with the page path and title, your screen and viewport size, browser language, and timezone
• Clicks on links and buttons, and the fact that a form was submitted, including the names of the fields in that form but never the values you typed into them
• How you arrived: the referring site, any campaign (UTM) tags, and any advertising click identifier in the URL
• A two-letter country code derived from your IP address at the network edge. The IP address itself is not stored
• An anonymous visitor identifier, held in your browser’s own local storage rather than in a cookie, so that repeat visits can be recognised

Email addresses. If you enter your email address into a form on our website, it is sent to Opinly and stored only as a SHA-256 hash; the address itself is never written to disk there. The hash lets us connect an enquiry to the visit that produced it. Because the hash is deterministic, we treat it as pseudonymised personal data rather than anonymous data, and it is covered by the data protection rights set out below. Password fields and hidden fields are never captured, and no other value you type is ever read.

Enquiries. When you submit our feedback or contact form, we record the fact that an enquiry was received (together with the enquiry type and the page you sent it from) so we can tell which parts of our site are useful. The content of your message is not sent to Opinly.

Inside the product. The same analytics run on the signed-in product at app.stuntdouble.io, so that we can tell which of our marketing actually leads to people using and paying for the Services. When you are signed in we link your visit to your account using your email address, which is stored as a hash as described above, and your user identifier. When a subscription payment succeeds we record the amount, the currency and the transaction identifier so that revenue can be attributed to the campaign that introduced you. We do not send the content of anything you create in the product, your actors, checklists, interviews, runs or results, to our analytics provider.

We shall at all times throughout the term of any agreement comply with information security requirements and other applicable security legislation (including, but not limited to intellectual property, cryptography restrictions, and retention of records) and shall:

• Not be entitled to use information except to the extent strictly necessary to perform our obligations under any agreement;
• Not provide information to any unauthorised third party; and
• Upon request, provide evidence of the existence, adequacy, and effectiveness of the controls implemented to comply with any agreement.

When available, we provide regularly to customers an internationally recognised type of report (as prescribed, for example, by ISO 27001, PCI DSS, ISAE 3402, SSAE 16) issued by an independent party, providing assurance that we have appropriate and effective security controls in place. This may also include SOC 2 Type II, ISO 27701 (privacy management), or ISO 22301 (business continuity), where relevant and available from our suppliers.

A Security Incident is defined, with respect to information and services, as any event leading to or reasonably likely to lead to:

• Information loss;
• Information corruption;
• Unauthorised access to systems storing or processing information;
• Unauthorised access to physical locations storing or processing information;
• Negligence or gross misconduct of any employee who had access to information or services;
• Outage due to DDoS and other mass attack events; or
• Any other security event relating to information that could damage or harm business operations, legal/regulatory compliance, or reputation of customers.

If at any time we suspect or have reason to believe that a Security Incident has occurred impacting customer information or services, we shall:

• Notify customers of the Security Incident as soon as it is reasonably practicable (and in any event within 48 hours) and thereafter provide customers as soon as possible with the available details of the Security Incident. Subject to our legal obligations, we shall not report any Security Incidents relating to information to any authority without consultation with customers.
• In consultation with customers, take all reasonable steps necessary to mitigate the consequences of the Security Incident or (if applicable) to protect against a threatened Security Incident.
• Notify customers of the progress, closure of the Security Incident, and remedial action we propose to take to prevent any similar Security Incident occurring in the future.

Under data protection laws, you have rights, including:

• The right to access – You have the right to request copies of your personal data from us.
• The right to rectification – You have the right to request that we correct any information you believe is inaccurate or incomplete.
• The right to erasure – You have the right to request that we erase your personal data, under certain conditions.
• The right to restrict processing – You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The right to object to processing – You have the right to object to our processing of your personal data, under certain conditions.
• The right to data portability – You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.

If you have any questions about this Privacy Policy, please contact us:

This Privacy Policy forms part of our Terms of Service and should be read in conjunction with them. By accessing or using our Services, you agree to the collection and use of your information in accordance with this Privacy Policy.