Privacy notice
What we process, why, how long we keep it, and what you can ask us to do about it. Written to be read rather than skimmed past.
- Applies to strata.example.com
- GDPR aligned
Who we are
Strata provides document management and workflow software to organizations. This notice explains what personal data we process, why, and what rights you have over it.
Where you use Strata through an employer or client, that organization is the controller of the documents and metadata held in its account, and Strata acts as processor on its instructions.
Data we process
Account data: name, work email, organization, role assignments and authentication metadata.
Usage data: actions taken in the product, recorded to the audit trail — including views, downloads, edits, shares and approvals, each with a timestamp and actor.
Content data: the documents, metadata and form submissions your organization chooses to store.
Technical data: IP address, browser and device information collected for security and diagnostics.
Why we process it
To provide the service, authenticate users and enforce permissions.
To maintain the audit trail, which is a core function of the product and cannot be disabled at the record level.
To secure the platform, investigate incidents and prevent abuse.
To support customers and improve the product in aggregate.
Retention
Audit records are retained for the life of the organization's contract and any period its retention policy requires, because their value depends on being complete.
Account data is deleted within 30 days of an account closing, unless a legal obligation requires otherwise.
Backups roll off on a 30-day cycle.
International transfers
Enterprise organizations may pin their data to a specific region. Where transfers occur, they rely on Standard Contractual Clauses and documented supplementary measures.
Your rights
You may request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests.
If your data sits inside a customer's account, we will route your request to that organization as controller.
Requests can be sent to privacy@strata.example.com and are answered within 30 days.
Changes to this notice
Material changes are announced in-product at least 30 days before they take effect. The revision history is available on request.