Privacy Policy

This policy covers StackFloss, Inc. ("StackFloss," "we," "us") and the website at stackfloss.com (the "Site"). It explains what we collect when you visit the Site, fill in one of its forms, or sign up through one of our ads, how we use it, who we share it with, and the choices you have.

Patient information is different. When a dental practice uses the StackFloss product, any protected health information (PHI) is handled under HIPAA and the Business Associate Agreement we sign with that practice, not under this policy. This Site does not collect PHI, and none of the tools described here run inside the StackFloss product. Please don't include patient information in any form or email to us.

What we collect

What you type into our forms. The contact form, marketing diagnosis request, access request form, sign-up forms in our Facebook and Instagram ads, and job applications are described below.
Where you came from. When you submit a form, we record the page and link you came from, including campaign tags in the link (UTM parameters). Unless you've opted out of advertising, we also record Meta's click ID and browser identifiers, so we can tell which ad led to the sign-up.
How you use the Site. Unless you opt out, our analytics and advertising tools collect pages viewed, the referring page, browser and device type, approximate location based on your IP address, and similar technical details. See Analytics, advertising and cookies.
Business contact information about dental practices. To reach practices that may benefit from StackFloss, we compile business information about dental practices and their owners, such as practice names, locations, websites, the dentists who practice there, and work contact details. It comes from public sources, such as the federal NPI registry, public business listings and practice websites, and from commercial business data providers.
Technical logs. Our hosting provider keeps standard server logs, such as IP address, browser type, and the pages requested, to deliver and secure the Site. When you open a link we emailed you, such as one of our guides or the StackFloss challenge, we also record the time, the page or file, the referring page, browser type, approximate city from your IP address, and a scrambled (hashed) form of the IP address, so we can tell whether the email was useful. We don't store the IP address itself.

Analytics, advertising and cookies

The Site uses two kinds of optional tools. They're on by default, and you can turn either off at any time from Your Privacy Choices at the bottom of every page. We honor Global Privacy Control (see your choices).

Analytics: Google Analytics, loaded through Google Tag Manager. To count visits and see which pages and forms are used.
Advertising: Meta Pixel and Conversions API. To measure the results of our ads on Facebook and Instagram and to show our ads to people who may be interested in StackFloss. When a form is submitted, we tell Meta that a sign-up happened, from your browser and from our server. With the server message we include your email address in hashed (scrambled) form and Meta's own browser identifiers, so Meta can match the sign-up to the ad that led to it. We don't send Meta the rest of the form. If you've opted out of advertising, neither message is sent.
Advertising: LinkedIn Insight Tag. To measure the results of our ads on LinkedIn, to show our ads on LinkedIn to people who have visited our Site, and to see aggregate, anonymous information about the professional backgrounds of our visitors. When you sign up, the tag tells LinkedIn that a sign-up happened. It doesn't send LinkedIn what you typed into the form. If you've opted out of advertising, it doesn't load.
Advertising: Reddit Pixel and Conversions API. To measure the results of our ads on Reddit and to show our ads on Reddit to people who have visited our Site. When you sign up, we tell Reddit that a sign-up happened. We don't send Reddit what you typed into the form. If you've opted out of advertising, the pixel doesn't load and we don't send the sign-up to Reddit.

Our Cookie Policy lists each cookie, what it does, and how long it lasts. Each provider's own privacy policy also applies to what it collects.

How we use it

To respond to you, set up your access, and provide our services.
To check whether a sign-up comes from an independent dental practice, by matching it against the business information described above.
To contact practices that may be a fit for StackFloss, by email, phone, or advertising.
To show our ads on Facebook, Instagram, LinkedIn and Reddit, including to dental practice owners and staff. To do this we may upload business contact information, such as a name, email, job title, practice name and practice location, to Meta or LinkedIn (in hashed, or scrambled, form where the platform supports it), so they can match it to their users.
To measure and improve the Site and our advertising.
To review job applications.
To keep the Site secure, prevent spam and abuse, and meet legal obligations.

We don't sell personal information for money. We share it only with the service providers that run our Site and marketing, and when the law requires it:

Netlify: website hosting and form submissions.
Google: Google Analytics and Google Tag Manager, unless you opt out of analytics, and Google Workspace for our email.
Meta: Meta Pixel, Conversions API, and sign-up forms in our ads, unless you opt out of advertising, and hashed business contact information for ad audiences.
LinkedIn: the LinkedIn Insight Tag, unless you opt out of advertising, and business contact information for ad audiences.
Reddit: the Reddit Pixel and Conversions API, unless you opt out of advertising.
Supabase: the database where we keep access requests and the business information described above.
Resend: to send you a confirmation email when you request access, and the sign-in link and PDF for the pay report.
Cloudflare: Turnstile, the check on the pay report form that a person is filling it in.
Slack: to notify our team of new submissions.

Some state privacy laws treat advertising cookies or ad audiences as a "sale" or "sharing" of personal information. You can opt out at any time (see your choices).

The contact form

If you use the contact form, we receive your name, email, practice name, practice management system, what you're interested in, and your message. We use it to reply and talk with you about StackFloss.

Marketing diagnosis requests

If you ask for a free marketing diagnosis on our managed dental marketing page, we receive your name, role, practice name, email, phone number if you give it, practice website, and the page or link you came from. We use it to prepare your report from public information about your practice and its local market, to contact you about the review call, and to talk with you about our marketing services. It is stored with Netlify and posted to our team's Slack.

Access requests

If you request access or take the StackFloss challenge, we receive what you enter (such as your name, email, practice name, and practice management system), plus the page and link you came from. If you take the chair leak check, we also receive your answers and the example estimate it showed you. We may add publicly available business information about your practice, such as its locations and the dentists who practice there. We use this to send you a confirmation email, to contact you about getting started with StackFloss and related offers, and to check whether you're an independent dental practice. Signups are stored with Netlify and in our Supabase database, and shared with our team in Slack.

The pay report

To open the Dental Front Office Pay Report, and any later pay report we publish, you enter your email address and, if you like, your role. We email you a link, and note that you asked: your email address, which report, your role, whether the address looks like a work or a personal one, the campaign tags on the page, and the time. When you click the link, we record your email address, your role, whether the address looks like a work or a personal one, the campaign tags on the link you came from, and the time you confirmed. If you tick the box, we also email you the PDF. We use this to give you lifetime access, to let you back in when you ask for a new link, to contact you about new reports, updates and StackFloss (any such email will have an unsubscribe link), and to count how many practices use the report. When you click the link we also note your approximate location (city and state, worked out from your internet address; we don't store the address itself), so we can tell you about your own market.

While you are signed in to the report, we record how you use it: which sections you view, which role and market you choose, and whether you download the PDF or click our links. We use this to improve the report and to send you information about the market you looked at. The numbers you type into the calculator stay in your browser and are never sent to us.

If you use "Share it with someone", we receive the email addresses you enter and send each person one email that shows your email address and gives them their own link to the report. We keep a record of who shared with whom so we don't email anyone twice, and we don't email a person you shared with again unless they open the report. Please share only with people you know would want it.

After you confirm, your browser keeps a cookie for up to 400 days so you do not have to confirm again. It holds a signed code tied to your email address. It is not a password and it never holds patient information. We use it only to recognize you on the report pages. Cloudflare Turnstile checks that a person is filling in the form, and Cloudflare receives technical details of your visit under its own privacy policy. If you send us feedback from the report page, we receive your message, the topic you chose and the email address you confirmed, and we use them to reply and to decide what to publish next. Please do not include patient information in feedback. Signups and feedback are stored in our Supabase database and the emails go through Resend. We keep them while the report is published or until you ask us to delete them: email hello@stackfloss.com.

Sign-ups through our Facebook and Instagram ads

Some of our ads open a sign-up form inside Facebook or Instagram. If you use one, Meta collects what you enter (your name, email, phone number, practice name, whether you're the practice owner, and practice management system) and sends it to us, and Meta's own privacy policy also applies to it. We handle it the same way as an access request, and we may call the number you give to follow up on your request. Meta already knows the sign-up came from its ad, so we don't send it back to Meta.

Job applications

If you apply for a role through our careers pages, we receive what you submit: your name, email, résumé, LinkedIn profile, work examples, answers to our questions, and availability. We use it only to evaluate your application and contact you about it. Applications are stored with Netlify and emailed to our hiring inbox. We keep them for six months and then delete them. To have your application deleted sooner, email careers@stackfloss.com.

How long we keep it

We keep contact, marketing diagnosis and access request submissions while we're in touch with you about StackFloss, and delete them when you ask. We keep pay report signups and feedback while the report is published, or until you ask us to delete them. If you ask for a pay report link and never click it, we delete that request after 90 days. Job applications are deleted after six months. Analytics and advertising data is kept according to each provider's retention settings. Server logs are kept according to our hosting provider's settings.

Your choices

Turn tools off. Select Your Privacy Choices at the bottom of any page to turn analytics or advertising off, or back on, at any time.
Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of sale, sharing, and targeted advertising for that browser, and advertising tools stay off.
Opt out of ad audiences, sale, or sharing. Turn advertising off as above, or email hello@stackfloss.com with "Do not sell or share" in the subject line, and we'll also remove you from any ad audience we've uploaded.
See, correct, or delete your information. Email hello@stackfloss.com. We'll verify your request in a way that fits the information involved and respond within 45 days. You can use an authorized agent; we may ask for proof that they're authorized.
Appeal. If we decline your request, reply to our decision to appeal. If you're still not satisfied, you can contact your state attorney general.
Emails. If we email you about StackFloss, reply or use the unsubscribe link and we'll stop.

We won't treat you differently for making any of these requests. We don't respond to the older "Do Not Track" signal, but we do honor GPC.

We don't collect sensitive personal information through the Site, and we don't use Site data to make decisions that have legal or similarly significant effects on anyone.

How we protect it

The Site is served only over encrypted connections (HTTPS), and access to form submissions is limited to the people on our team who need it. No method of storing or sending information is perfectly secure, but we work to protect what you share with us. Our HIPAA compliance page describes the separate, stricter safeguards for patient data in the product.

Children

This Site is for dental practice teams. It isn't directed to children, and we don't knowingly collect personal information from anyone under 16.

Changes and questions

When we update this policy, we'll change the date below. If we start using a new kind of tool or use your information in a materially different way, we'll tell you here first and ask for your permission where the law requires it.

Questions or requests: hello@stackfloss.com, or by mail to StackFloss, Inc., Attn: Privacy, 1401 Lavaca St, Ste 84690, Austin, TX 78701.

Last updated: November 11, 2026.