Privacy Policy & GDPR Compliance Statement

Last updated: September 2026

StudioStacks B.V. (“Company”, “we”, “our”, “us”), trading as NowButtons and Call Now Button, is committed to protecting your privacy and ensuring transparent, GDPR-compliant handling of personal data.

This single document replaces and merges our previous Privacy Policy and GDPR Compliance Statement into one comprehensive, internationally compliant policy.

Our services include:

• NowButtons floating action buttons
• WhatsApp widget
• Live Chat
• Meeting Scheduler (Google Calendar integration)
• WordPress plugin
• Analytics, performance monitoring, and customer dashboard

---

1. Who We Are

StudioStacks B.V. Dr. Huber Noodtstraat 84 E 7001 DZ Doetinchem The Netherlands

Data Protection Contact: [email protected]

We operate globally and comply with the EU General Data Protection Regulation (GDPR).

Note to Users (Controllers): Our Data Processing Agreement (DPA) forms an integral part of our Terms of Service. By creating an account and using our services, you automatically accept this DPA, ensuring your use of NowButtons is compliant with Article 28 of the GDPR.

---

2. Key Definitions

• “User” = website owners using our services
• “Visitor” = visitors on websites where our scripts/widgets run
• “Controller” = determines purposes of data processing
• “Processor” = processes data on behalf of a controller

When we are the Controller

For data you provide directly to us when creating or managing your NowButtons account.

When we are the Processor

For data collected from visitors via your website using:

• Live Chat
• WhatsApp widget interactions
• Buttons with contact actions
• Meeting Scheduler
  We process this data strictly under your instructions.

---

3. What Data We Collect

We collect data from Users (account owners) and Visitors (on your sites).

---

3.1 Data We Collect From Users (Account Owners)

When creating an account (Free or Pro):

• Email address
• Domain name(s)

For paid plans:

• Name
• Billing address
• Country
• Company name (optional)
• VAT number (if applicable)

Received from our payment providers:

• Payment status and transaction identifiers
• Payment method type (e.g. card or PayPal) and, for cards, the brand and last four digits
• Name, email address and country associated with the payment

Meeting Scheduler (Google Calendar):

To enable scheduling functionality, we connect to your Google Calendar account via OAuth.

We store:

• Authentication Tokens: Strictly to maintain the connection with Google Calendar (stored securely in the User database).

We do not store or log meeting content on our servers:

• No meeting details (title, description, location)
• No attendee PII (names, emails) in our database
• No event history logs

All booking information flows directly into the Google Calendar of the User.

Optional:

• Support requests
• Feedback forms
• Newsletter subscriptions

We do NOT:

• Track account-owner logins
• Store IP logs for account-owner actions
• Maintain behavioral or usage logs beyond essential error reporting

---

3.2 Data Collected From Visitors

A) Before interacting with any widget

We do not collect or store:

• IP address
• Personal data
• Cookies
• Session IDs
• Metrics or analytics of any kind

B) When a visitor starts a Live Chat

We collect:

• Name
• Email
• Chat message
• Consent checkbox (boolean)
• IP address (once, at chat start)
• Start page URL
• Activity timestamps (for chat threading)

We do not collect:

• Phone number
• Custom fields
• Sensitive data (unless voluntarily provided)

Fields a visitor completes in the Meeting Scheduler booking form are passed straight into the User’s Google Calendar and are not retained by us (see sections 3.1 and 5.3).

C) LocalStorage data (stored on visitor’s device)

When a chat begins, the widget stores locally (not on our servers):

• ably-transport-preference
• cnb.channel-id
• cnb.chat-client-persona-id
• cnb.chat.client-persona containing:
  • visitor name
  • visitor email
  • visitor IP
  • start page URL
  • terms accepted boolean

This data remains on the visitor’s device and allows:

• Returning to the active chat
• “Resume chat” links (which only link back to the chat's start page)

D) No Button-Click Tracking

We do not log:

• Phone button clicks
• WhatsApp or Messenger or Telegram or Signal or Zalo or Viber or Line or Skype or WeChat button clicks
• SMS or email button clicks
• Link or anchor clicks
• Map/location click-throughs

E) WhatsApp Widget Input

If a visitor types a message within our WhatsApp widget, this text is used solely to generate the wa.me link on the visitor's device. This input data is transient (client-side) and is not sent to, processed by, or stored on our servers.

F) Google Analytics (GA4)

Visitors may be tracked via the User’s own Google Analytics configuration on their website. That configuration is the User’s responsibility, not ours.

Our widgets do not load Google Analytics. We use Google Analytics only on our own websites (nowbuttons.com and app.nowbuttons.com), configured with:

• IP discarded for EU traffic
• Event retention: 2 months
• User data retention: 14 months
• Advertising features: disabled

---

4. How Data Is Used

4.1 For Users

• Providing and managing your NowButtons account
• Delivering subscription services
• Sending information about your account (renewals, updates)
• Billing and invoicing
• Handling refunds, chargebacks and payment disputes
• Maintaining our financial administration

4.2 For Visitors

We process visitor data strictly to:

• Deliver chat functionality
• Route messages between visitor ↔ user
• Display visitor’s approximate location (based on one-time IP lookup)
• Resume conversations
• Deliver missed messages to User via Brevo
• Support Google Calendar event creation (no storage on our side)

We do not:

• Profile visitors
• Use visitor data for marketing
• Sell or share visitor data

---

5. How Data Is Stored

5.1 Chat Data

Chat messages, visitor name/email, and metadata are stored on our servers for a retention period of 12 months (default), adjustable by plan in the future.

5.2 LocalStorage

Chat state and identifiers remain in the visitor’s browser only.

5.3 Meeting Scheduler Data

We only retain the necessary OAuth tokens to keep the integration active. All actual meeting data (events, attendees) is ephemeral to our system and resides solely in your Google Calendar environment.

5.4 Security and Data Protection

We utilize technical and organizational security measures to protect your information, specifically regarding data accessed via Google APIs.

• Encryption: All data in transit is encrypted via SSL/TLS (HTTPS). Sensitive data at rest, including authentication tokens, is stored in encrypted databases.
• Network Security: We utilize Cloudflare CDN for secure traffic routing and protection against distributed denial-of-service (DDoS) attacks.
• Access Controls: Access to production databases and sensitive user data is restricted to authorized personnel via secure authentication.

Google API Services User Data Policy

NowButtons' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

---

6. How Data Is Shared

We share only what is necessary to deliver our services.

6.1 Third-Party Processors

Brevo (Transactional emails and marketing communications)

Used as our email service provider for all transactional emails and marketing communications. This includes:

• New account creation and welcome emails
• Account verification and plugin activation emails
• Lost password and password reset emails
• Subscription confirmations, renewals, upgrades, cancellations
• Billing notifications and payment-related emails
• Security alerts and important account status messages
• Missed chat notifications to Users
• Emails to Visitors that contain a link back to the page where the chat started
• Newsletters and marketing emails (only if you opted in)

To send these messages, Brevo processes data such as:

• User name (if provided)
• User email address
• Domain name(s) associated with the account
• Subscription and billing status where relevant
• For missed chat notifications: Visitor name and the first message of the chat
• For emails to Visitors: a link back to the page where the chat started (no identifiers are included)

We never include IP addresses in emails.

Return-to-chat emails contain only a link to the webpage, relying on LocalStorage in the visitor’s browser to reopen the active chat.

DigitalOcean

Primary database for:

• Chat messages
• Visitor-provided contact details
• Timestamps
• IP (once, at chat start)

Sentry

Used for error monitoring. Receives:

• Visitor IP at chat start
• URL
• Device/browser metadata
• Error context

Never receives:

• Chat messages
• Names or emails
• Form data

Ably

WebSocket provider. Receives:

• Live chat message transport only
• No name, email, or stored data
• Messages persist for max 2 minutes and then are deleted

Cloudflare

Content Delivery Network (CDN). Receives transient data including:

• Visitor IP
• Browser request metadata
  We do not access Cloudflare logs.

Google Analytics (GA4)

Used on our own websites only. Receives:

• Event data
• Approximate, anonymized geo reference
• IP addresses, which are discarded for EU traffic and are never stored by us
• No PII

Google Calendar API (Meeting Scheduler)

Receives:

• Event details directly from visitor form
• No PII stored on our servers
• No meeting logs stored

Postmark

Used for DMARC monitoring and email security, to protect our domains against spoofing and to verify that mail sent on our behalf is authenticated. Postmark does not send our account or marketing email; that is handled by Brevo.

Receives:

• DMARC aggregate reports covering mail sent from our domains, which may include sender and recipient addresses and the IP addresses of sending mail servers

Grafana Labs

Used for API observability and logging to ensure service stability.

Receives:

• API logs which may include transient chat metadata and contact details involved in widget actions.

Slack

Used for internal team notifications regarding new account signups.

Receives (user data only, not visitor data):

• User email
• Domain name
• Country

Google Cloud Platform

Used for storage of specific widget action values and supporting infrastructure.

Receives:

• Action values
• Widget configurations

Other Providers

• Tally (optional support forms)
• e-Boekhouden (accounting)

6.2 Independent Controllers

These providers determine their own purposes for part of the processing and are responsible for it under their own privacy notices.

Stripe and PayPal — Payment processing and billing

Stripe handles our payment processing and subscription billing. If you pay with PayPal, Stripe passes the transaction to PayPal, which receives what it needs to complete it: your name, email address, billing country, PayPal account identifier and the amount.

PayPal also processes personal data for its own payment, fraud-prevention, risk-management and regulatory-compliance purposes, and acts as an independent data controller for that processing.

We never see or store full card numbers or PayPal login details. The payment data we do receive is listed in section 3.1, and we use it to run your subscription, provide support, keep our accounting records and handle refunds and disputes.

Stripe and PayPal process personal data under their own privacy notices: Stripe and PayPal.

---

7. International Data Transfers

Some of our processors may store or process data outside the EU.
When transfers occur, we rely on:

• Standard Contractual Clauses (SCCs)
• Data Processing Agreements (DPAs)
• GDPR-compliant safeguards

All vendors listed above maintain GDPR-compliant commitments.

Stripe and PayPal act as independent controllers for part of the processing and handle their own transfer safeguards. For EEA customers the PayPal contracting entity is PayPal (Europe) S.à r.l. et Cie, S.C.A. in Luxembourg.

---

8. Cookies & LocalStorage

Cookies Used

• SESSION: required for account functionality (Users only)
• _ga and _ga_*: set by Google Analytics on our own websites (nowbuttons.com and app.nowbuttons.com) only. Our widgets do not set these on your website.

LocalStorage Used (Visitors)

Used exclusively for Live Chat session continuity:

• Chat persona ID
• Name, email, IP (locally stored)
• Terms acceptance
• Channel identifiers

None of this data is transmitted until the visitor chooses to start a chat.

---

9. Legal Bases for Processing (GDPR)

We rely on the following:

Consent

• Visitors submitting name/email in chat
• Visitors booking meetings
• Users subscribing to newsletters

Contractual Necessity

• Delivering NowButtons services
• Managing subscriptions
• Processing payments

Legitimate Interests

• Error logging (Sentry)
• Security and fraud prevention
• Service performance and stability
• Event delivery (chat throughput)

Legal Obligations

• Accounting (e-Boekhouden)
• Tax compliance

---

10. Your Rights (GDPR)

Both Users and Visitors have the right to:

• Access their data
• Rectify data
• Request erasure (“right to be forgotten”)
• Restrict processing
• Object to processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with a data protection supervisory authority

Users (account owners) can submit requests directly to us via [email protected].

Visitors should address their request to the owner of the website where they used our widget, since that website owner is the controller of the data (see section 2). A Visitor who contacts us directly will have their request forwarded to the relevant User, and we will assist that User in handling it.

You may also lodge a complaint with your local data protection authority. Our lead supervisory authority is the Dutch Autoriteit Persoonsgegevens.

---

11. US State Privacy Rights (CCPA/CPRA)

For Users and Visitors located in California and other US states with specific privacy laws:

• Our Role: For visitor data we act as a “Service Provider” and process it only on the User’s behalf. For account data that Users provide to us directly, we act as a “Business”. In neither role are we a “Third Party” that sells data.
• No Sale of Data: We do not sell or share personal information as defined by the CCPA/CPRA.
• Purpose Limitation: We process visitor data solely to fulfill our contractual obligations to the User and to improve the functionality of the service.

---

12. Data Deletion

Users (Account Owners)

• Delete data manually in the dashboard
• Request full account deletion via email
• We purge all data within 14 business days, except for the financial records described below

Statutory retention of payment records. Dutch law requires us to keep our financial administration — including invoices, payment status and transaction identifiers — for 7 years after the end of the financial year in which the transaction took place. These records are kept solely to meet that legal obligation (see section 9, Legal Obligations) and are not used for any other purpose.

Visitors (Chat Data)

Users control deletion of their visitors’ chats.
On account deletion, all visitor chat data is deleted.

---

13. WordPress Plugin

The WordPress plugin transmits:

• Site URL
• WP version
• Plugin version

It does not transmit:

• Admin emails
• Visitor data
• Debug logs
• PII

It does not proxy website visitor traffic.

---

14. Children’s Privacy

Our services are not intended for children under 16.
Users may not use our service to collect data from minors without valid legal basis.

---

15. Changes to This Policy

We may update this policy periodically. The “Last Updated” date at the top will reflect the current version.

Significant changes will be communicated via:

• Email to account owners
• Banner notices in the dashboard
• Updated publication on our website(s)

---

16. Contact Information

StudioStacks B.V.
Dr. Huber Noodtstraat 84 E
7001 DZ Doetinchem
The Netherlands [email protected]