Privacy Policy

This policy applies to visitors, account holders, workspace members, business contacts and people whose personal data is submitted to Strabora through an authorized workspace.

An organization using Strabora is responsible for ensuring that it has the authority to upload or use personal data relating to its clients, employees, audiences or other people.

Where an organization determines why and how personal data is processed within its workspace, that organization may be responsible for the relevant personal-data processing, while Strabora may provide the service and process data on the organization's instructions.

Depending on how you use Strabora, we may process:

• Account and identity information, including name, work email address, mobile number and authentication records.
• Organization, workspace, brand and membership information.
• Marketing, research, strategy, campaign, content, PR and approval information submitted to or generated within a workspace.
• Helpdesk tickets, messages and authorized support records.
• Subscription, plan, sales-inquiry and billing-related records. Payment credentials should be handled by an authorized payment provider where billing is enabled.
• Technical and security information, such as session records, device or browser information, timestamps, audit events and diagnostic details.
• AI usage information, including capability, provider, model, token counts, status and estimated cost.
• Preferences and settings selected within the service.

We may also receive information directly from you when you contact Strabora, request support, submit a business inquiry, communicate with us about privacy or security, or otherwise interact with the service.

Do not submit passwords, session tokens, API keys, payment credentials or unnecessary sensitive personal data to Strabora.

We use personal data for purposes reasonably necessary to operate and provide the Strabora service, including to:

• Provide, maintain and secure the Strabora service.
• Authenticate users and enforce workspace roles, permissions, approvals and tenant isolation.
• Create requested AI-assisted research, strategy, content, campaign, PR and support outputs.
• Preserve workspace history, approvals, audit records and authorized support conversations.
• Measure service usage, enforce plan limits and prevent abuse, fraud or unauthorized access.
• Respond to support, privacy, security and business inquiries.
• Improve reliability, accessibility, safety and product performance.
• Meet legal obligations and protect the rights, safety and integrity of Strabora, its users and others.

Strabora uses AI providers to prepare requested outputs. Relevant prompts, workspace context and conversation history may be sent to an authorized AI provider when a user explicitly starts an AI-powered operation.

The information sent to an AI provider depends on the capability being used and the context required to complete the requested operation. Strabora is designed so that AI processing occurs through controlled application/server pathways rather than by exposing provider credentials to ordinary users.

AI-generated results may be stored in the relevant workspace when necessary to provide history, review, approvals, reporting or other requested functionality.

AI output can be incomplete or inaccurate and should be reviewed before use. Strabora's AI does not independently authorize publishing, spending, outreach, payments or other consequential external actions.

Strabora does not permit users to use the service as a substitute for professional legal, financial, medical or other regulated advice.

Users must not use Strabora to submit data they are not permitted to process or to make unlawful, deceptive, discriminatory or harmful decisions.

Strabora may use authorized third-party AI providers to process information needed for requested AI functionality. Provider-specific processing is governed by the applicable provider terms, privacy documentation, product configuration and, where applicable, contractual commitments.

Strabora does not represent that every third-party provider has identical data handling practices. The providers and services used by Strabora may change as the platform develops. Where required, Strabora will provide appropriate notice of material changes.

Strabora does not intentionally use customer workspace content for unrelated advertising purposes. Strabora also does not treat customer workspace content as permission to train or improve third-party AI models outside the terms and configurations applicable to the relevant provider integration.

For each AI provider, the applicable provider documentation and configuration determine whether submitted inputs and outputs may be retained, reviewed for abuse prevention, used for service improvement, or otherwise processed. Strabora will use the provider configuration available to it and applicable contractual restrictions rather than promising that every provider has identical retention or training practices.

Users should review the applicable AI provider documentation where they need provider-specific information about retention, training, abuse monitoring, international processing or other secondary processing.

Where applicable law requires a legal ground, Strabora processes personal data as necessary to provide the requested service, operate and secure the platform, comply with legal obligations, pursue legitimate business and security interests, or act with consent where consent is required.

The applicable legal basis depends on the circumstances, the type of information involved and the law applicable to the relevant person or organization.

You may withdraw consent where processing depends on consent. Withdrawal does not affect processing already completed lawfully.

We do not sell personal data. We may share limited data with service providers that help operate Strabora, such as cloud hosting, database, authentication, AI, communications, monitoring and payment providers.

These providers may process information only to the extent reasonably necessary to provide their services to Strabora, subject to applicable contractual, confidentiality and security obligations. Depending on the service, a provider may act as a processor, service provider or independent controller for a particular processing activity under applicable law.

Strabora may maintain or publish additional provider/subprocessor information as the service develops. Provider-specific terms may also contain additional information about the provider's role, processing locations, retention and security practices.

We may also disclose data when required by law, to protect legal rights or safety, during a legitimate corporate transaction, or when an authorized workspace administrator requests or permits the disclosure.

A corporate transaction may include a merger, acquisition, financing, restructuring, sale of assets or similar legitimate business transaction, subject to applicable law.

Strabora and its service providers may process data in countries other than the country where you live.

Where required, we use appropriate safeguards for international transfers and comply with applicable transfer restrictions.

International processing may be necessary because Strabora relies on infrastructure and service providers that can operate across multiple jurisdictions.

We retain personal data only for as long as reasonably necessary to provide the service, maintain security and audit history, resolve disputes, enforce agreements and comply with legal obligations.

Retention periods vary by record type. Workspace records may remain available until deleted by an authorized user or until the related account or organization is deleted, subject to backup, security, fraud-prevention and legal retention requirements.

Different categories of information may therefore have different retention periods. For example, operational workspace content, authentication records, security records, audit information, billing records and legally required records may not be deleted at exactly the same time.

Account deletion may use a delay period to prevent accidental or unauthorized permanent deletion.

Deletion from active systems may not immediately remove every copy from backups, disaster-recovery systems, security records or other systems where retention is necessary for legitimate operational, legal or security purposes. Such information will be handled according to applicable retention requirements and removed or de-identified when those requirements no longer apply.

Some records may be retained or de-identified where legally permitted or required.

Strabora uses safeguards designed to protect data, including authenticated access, role-based authorization, tenant isolation, database policies, server-controlled privileged operations, audit records and controls for sensitive or consequential actions.

Security controls are designed to limit unauthorized access between organizations and to restrict privileged operations to appropriate server-side pathways.

No system can guarantee absolute security. Users are responsible for protecting their credentials, enabling available account security features and promptly reporting suspected unauthorized access.

If Strabora becomes aware of a security incident involving personal data, we will assess and respond according to applicable law and our incident-response procedures, including notifications where legally required.

Strabora may use cookies or similar browser storage that are necessary for authentication, session continuity, security and user preferences.

If optional analytics, advertising or other non-essential tracking technologies are introduced, additional notice or consent controls will be provided where required.

Browser storage used for authentication or application functionality may be necessary for the service to operate correctly.

Depending on where you live and which laws apply, you may have rights to request access, correction, completion, deletion, restriction, objection, portability or withdrawal of consent.

You may also have the right to complain to an applicable privacy or data-protection authority.

We may need to verify your identity and authority before completing a request. This helps protect accounts and personal information from unauthorized disclosure or deletion.

Some requests may be limited where retention or processing is required by law, necessary for security, needed to establish or defend legal claims, or necessary to protect other people's rights.

Workspace members should first contact their organization administrator when the organization controls the relevant data. You may also contact Strabora using the details below.

Privacy requests should include enough information for Strabora to understand the request and, where appropriate, verify the requester's identity and authority.

We may request additional information when necessary to prevent unauthorized access to another person's data or unauthorized account changes.

If an organization controls the relevant workspace data, Strabora may direct the request to the organization or require the organization to participate in the request process where appropriate.

We aim to respond to valid privacy requests within the period required by applicable law. The applicable response period may vary depending on jurisdiction and request type. Where a request is complex or legally subject to an extension, we may take additional time where the applicable law permits it and will provide the required notice.

Strabora is intended for business users and is not directed to children.

Do not create an account or submit a child's personal data unless the processing is lawful and appropriately authorized.

Contact us if you believe a child's data was submitted improperly.

If you contact Strabora for sales, support, partnerships, security, privacy or other business purposes, we may process the contact information and communications you provide.

This information may be used to respond to your request, maintain business records, provide requested services, prevent abuse and meet legal or operational requirements.

We may update this policy as Strabora, its service providers, product functionality or applicable requirements change.

The updated date will appear at the top of this page. We will provide additional notice when a material change requires it.