Privacy Policy

1.Who we are, and what this document covers

GoPickStack is an independent software review and comparison website. It is not a company. It is operated by Muhammad Shadab Shams, an individual in Punjab, Pakistan trading under the name GoPickStack.

Under the GDPR, that makes Muhammad Shadab Shams the data controller: the person who decides why and how personal data is processed. You can contact us at any time at the address in the footer of this page.

This policy explains every piece of personal data we handle, the lawful basis for each, who else receives it, how long we keep it, and what you can demand from us. We have written it plainly because a privacy notice nobody can read protects nobody.

2.The short version

We collect far less than most sites of our kind. We have no user accounts, no tracking profile of you, and no advertising network. What we do collect falls into four buckets: an email address if you ask for the newsletter or a price alert, content you choose to send us through a form, a question you type into the AI Copilot, and anonymous page view counts.

We do not sell your personal information. We do not run ads. We do not build a profile of your reading habits. The only third parties that touch your data are the six listed in our Subprocessors page, and each one exists to make a specific feature work.

You can ask us to delete your email and any form submissions at any time, free, and we will confirm within 45 days. See Delete My Data.

3.What we collect, and where it comes from

We only collect what you give us, plus the minimum technical data any web server records. We do not buy data about you from brokers, and we do not enrich what you give us.

4.Why we are allowed to process it

Under GDPR Article 6 we need a lawful basis for each purpose. We use three, and we use the one that actually fits rather than defaulting to consent everywhere.

• Consent means you actively agreed, you can withdraw it at any time, and withdrawing it does not affect processing we did lawfully beforehand.
• Legitimate interests means we balanced your rights against ours and concluded ours do not override yours. You can ask what the balance was, and object, as described below.

5.The AI Copilot sends your questions outside our servers

This is the part most privacy notices leave out, so we are putting it in plain terms. When you type a question into the AI Copilot, that text is sent to OpenRouter, a United States company, which forwards it to whichever language model it routes the request to. Your question leaves our infrastructure.

We do this with your consent, which you give separately in the consent panel because it is a materially different thing from counting page views. If you decline the AI category, the Copilot still answers, but only from our own published review data instead of a language model. Nothing breaks.

We do not store your questions. They are held in your browser so you can see your own conversation history, and in server memory only while the answer is being generated. They are not written to disk and are not joined to your email address unless you separately subscribe to something.

Do not type anything into the Copilot that you would not want sent to a third-party service in another country. That includes client names, unreleased financial figures, or anything under a confidentiality obligation.

6.Server logs and IP addresses

Our host records the standard web server log: IP address, timestamp, requested URL, and user agent. This happens for every visitor whether or not they do anything on the site. We also use your IP address in volatile server memory to enforce rate limits, which is how we stop the AI Copilot from being hammered and running up an unbounded bill.

That in-memory entry expires within about a minute and is never written to disk. Hosted access logs are retained by our host for a limited period described in our Subprocessors page.

An IP address is personal data under the GDPR. We process it on the basis of legitimate interests: keeping a public service available and affordable.

7.Who else receives your data

We do not sell your personal information. We have never sold, rented, or bartered it, and we do not intend to.

We share data only with the processors who need it to run a feature you used, and only the minimum they need. Every one of them is listed on the Subprocessors page with what it receives and where it runs. In summary: our host, our email provider, our AI provider, our cookieless analytics, and the affiliate networks that attribute referrals.

We will never sell or share your personal information for money. We also honour Global Privacy Control signals, which several US states now require. If your browser is sending one, affiliate and analytics storage stays switched off regardless of what you clicked earlier. See Do Not Sell or Share My Information.

8.Transfers to other countries, including where our servers are

Muhammad Shadab Shams is established in Pakistan, and this site is served from Hostinger in Singapore. That hosting region sits outside the European Economic Area and outside the United Kingdom, and it is not covered by an adequacy decision.

We are not going to dress that up. When an EU or UK reader's personal data passes through infrastructure in that region, that is a restricted transfer, and we handle it under Article 46 of the GDPR using the European Commission's Standard Contractual Clauses at Commission Implementing Decision (EU) 2021/914, together with the UK International Data Transfer Addendum. We have also run a transfer impact assessment and confirmed the risk is low, because the processing in question is a request being served, not data being warehoused on a government target list.

As supplementary measures we use TLS for everything in transit, preload HSTS so a downgrade to plain HTTP is refused by the browser, and keep personal data out of application logs wherever the hosting platform allows. Note the honest limit: our host retains standard access logs containing IP addresses for security and troubleshooting, and that retention sits with them, not with us.

We do not rely on the Article 49 derogations, such as grabbing per-request consent, as a routine mechanism. They are a fallback, not a strategy.

Singapore's own law runs alongside this rather than instead of it. The Personal Data Protection Act 2012 applies because the processing happens on Singaporean infrastructure, and section 26 of that Act limits transfers out of Singapore to recipients bound by legally enforceable obligations giving protection comparable to the Singapore standard. The same Standard Contractual Clauses satisfy the PDPA section 26 transfer limitation obligation, which requires the recipient to be bound by legally enforceable obligations giving protection comparable to the PDPA. We hold the same contractual safeguards to every subprocessor in every jurisdiction, rather than maintaining two weaker standards for one region.

9.If your data is breached

We would tell you, and we have written down what we do rather than leaving it to judgement. Three clocks can start at once when something goes wrong here, because our reader base is in the EU and the UK, the regulator in Singapore has jurisdiction, and the people affected have rights under all three regimes.

A breach becomes notifiable to the PDPC on either limb of the test. It qualifies where it is likely to result in significant harm to individuals, which the Singapore regulations deem to be the case where a name or identification number appears alongside prescribed data such as financial information or account credentials. It also qualifies outright where it affects 500 or more individuals, regardless of how serious the data involved is.

The 3-day Singapore deadline is faster than the 72-hour GDPR one once the assessment clock has run, and the two run from different moments: GDPR counts from awareness, Singapore counts from the moment we conclude the breach is notifiable. We do not treat the later of the two as our deadline.

A breach at a one-person site is most likely to be a leaked credential or a misconfigured server rather than a sophisticated intrusion, and the fastest fix is a password change. If one happens, we will say what was exposed, what we did, and what you should do about it.

10.Our EU and UK representative, and our current position

We deliberately target readers in the European Union and the United Kingdom. GDPR Article 27 therefore requires us to appoint a representative in the Union, and the UK GDPR requires the equivalent. We have not yet appointed one, and we are telling you that rather than implying otherwise.

Our reason is not that the obligation does not exist. It exists, and Article 27(2) does not excuse us from it, because our processing is neither occasional nor unconnected to the Union. The reason is cost and sequencing: we are a one-person operation and we would rather be transparent about the gap while we put it right than publish a representative we have not engaged.

What this means for you in the meantime, stated concretely. You do not need a representative to reach us. Exercise your rights by emailing Muhammad Shadab Shams at the address in the footer, and we respond on the deadlines set out below. We are reachable, we answer, and we do not sell your data, so the risk a representative exists to mitigate is small in practice even though the paperwork obligation is real.

We do not currently sell paid services to consumers in the European Union or the United Kingdom. Our paid products are sponsorship packages sold to software vendors under a business-to-business arrangement, and we will confirm the tax position with any EU or UK buyer before taking money.

If you are an EU or UK resident and would like this escalated, or you want to know whether the gap affects you specifically, say so in your message and we will answer directly. We will update this section and name the representative as soon as one is appointed.

11.How long we keep things

We keep personal data only as long as the purpose requires. In practice: an email subscription lives until you unsubscribe, then is deleted from our provider within 30 days. Form submissions stay in our inbox for up to 24 months so we have a record of what was asked of us. Server logs are kept by our host for the short period stated in our Subprocessors page. Anything stored in your browser stays there until you clear it, and we cannot see it either way.

12.Your rights

You have the following rights. We extend the same rights to everyone, not only residents of particular jurisdictions, because operating a single global policy is simpler for you and no less protective.

How to act: email Muhammad Shadab Shams using the address in the footer, or use Delete My Data for an erasure request. We respond within 30 days for GDPR requests and within 45 days for US state requests. We may extend a GDPR request by up to 60 days where it is genuinely complex, and we will tell you if we do.

We do not charge for responding to a privacy request. We verify identity using only the email address you contact us from, so we do not ask for a government-issued document.

• Access. Ask what personal data we hold about you, and get a copy of it.
• Rectification. Ask us to correct anything inaccurate. Our Contact page explains how corrections to reviews work separately.
• Erasure. Ask us to delete your data. We do it within the deadline below.
• Portability. Ask for your data in a machine-readable format you can take elsewhere.
• Object and restrict. Ask us to stop processing where our basis is legitimate interests, or to pause it while a dispute is resolved.
• Withdraw consent. Change your mind about any optional cookie or the AI Copilot, as easily as you gave it, from Manage cookies in the footer.
• Complain. Contact your local data protection supervisory authority. In the UK that is the ICO; in the EU it is the authority in your country of residence.
• Non-discrimination. We never treat you worse for exercising a right.

13.United States state privacy rights

As of the effective date of this policy, 20 US states have comprehensive consumer privacy laws in effect. California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Delaware (DPDPA), Florida (FDPPA), Indiana (INCDPA), Iowa (ICDPA), Kentucky (KCDPA), Maryland (MODPA), Minnesota (MCDPA), Montana (MCDPA), Nebraska (NDPA), New Hampshire (NHPA), New Jersey (NJDPA), Oregon (OCPA), Rhode Island (RIDTPPA), Tennessee (TIPA), Texas (TDPSA), Utah (UCPA), Virginia (VCDPA).

To be clear about our position: we do not sell your personal information, we do not share it for cross-context behavioural advertising, and we have never done either. That means the "Do Not Sell or Share My Personal Information" right, while it exists, has nothing for us to do in practice. We still publish the mechanism, honour Global Privacy Control, and honour a request the moment it is made, so you do not have to argue with us about it.

We recognise the right to know, the right to correct, the right to delete, the right to opt out of sale or sharing, the right to opt out of targeted advertising, the right to limit use of sensitive personal information, and the right to appeal a denied request. Where a state requires an appeal route we provide one at the contact address.

We do not knowingly sell the personal information of anyone under 16 and we do not knowingly process the personal information of anyone under 13. See our [COPPA notice](#children-and-minors).

14.Children and minors

GoPickStack is written for people choosing business software: founders, operators, developers, and buyers. It is not directed at children and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us personal information, email us and we will delete it.

15.How we protect it

All traffic is served over HTTPS with HSTS preloading. We transmit as little as possible, we keep it in as few places as possible, and we hold rate-limit data in memory so it is never written to disk.

No system is perfect, and a single-operator site is not a bank. If you discover a vulnerability in this site, please tell us rather than exploiting it. Email us with enough detail to reproduce, and we will fix it and credit you in the changelog if you want.

16.Automated recommendations and profiling

We show you recommended tools. Those recommendations are produced by ranking published review scores, price tiers, and category fit. There is no behavioural profiling of you behind them, and they are not legally significant decisions about you. We do not use your reading history to shape what we show you.

The one automated system that processes free text is the AI Copilot. No legal or similarly significant effect arises from its output. Do not rely on it for purchasing decisions; verify against the review it cites.

17.Data Protection Officer

No Data Protection Officer has been appointed. The operator acts as controller under GDPR Article 4(7). A sole publisher collecting an email address and answering a question is not the kind of large-scale, regular, systematic monitoring that triggers a duty under GDPR Article 37, and the Singapore PDPA imposes no general DPO requirement on an organisation of this size.

18.Changes to this policy

We update this page when what we do changes, not on a schedule for its own sake. The effective date at the top always reflects the current version, and every substantive change is recorded in our changelog. If a change materially affects your rights we will say so plainly rather than burying it.

19.How to reach us

Privacy questions, access requests, and complaints all go to the same person: Muhammad Shadab Shams, trading as GoPickStack.

Email: hi@gopickstack.com. Post: P/O Lang Shumali, Sargodha, Punjab, Pakistan.

If you are unhappy with how we have handled your data, you have the right to complain to your national supervisory authority. In the United Kingdom that is the Information Commissioner's Office. In the European Union, it is the data protection authority in the country where you live. A complaint does not stop you also contacting us.

20.Governing law

This policy is governed by the laws of England and Wales. Nothing in it limits rights you have under the mandatory law of your own country of residence, including the GDPR rights described above.