Privacy Policy

Last updated: 27 October 2026
Effective date: 27 October 2026

1. Who we are

StratStar is a strategy management application operated by EQIQ Professional Services Ltd ("we", "us", "our").

• Website: www.stratstar.com
• Contact email: jon@stratstar.com
• Registered in: England and Wales — company number 05882293
• Registered address: 1 Parsons Street, Dudley, DY1 1JJ
• ICO registration number: C1931189

We are the data controller for personal data processed through StratStar.

2. What data we collect

2.1 Account data

When you create an account we collect your name and email address. If you subscribe to a paid plan we collect billing information (processed by our payment provider — we do not store card numbers).

2.2 Strategy content

You enter strategy content into StratStar — mission statements, objectives, goals, actions, owner names, and free-text notes. This content is stored on your behalf and is under your control. Owner names within strategy items are business role descriptions; we ask you not to enter personal contact details of individuals in strategy content fields.

2.3 Company context

The "Company Context" feature lets you record information about your organisation (team size, budget, constraints, sector). This context is sent to our AI provider when you use AI features (see section 5.3).

2.4 Usage data

We collect anonymised product usage events (which features you use, which views you open, wizard step completions). These events are identified by your tenant ID only — never by your name or email address.

2.5 Error data

When JavaScript errors occur in the application we capture the error message, stack trace, browser type, and operating system. We do not capture strategy content in error reports.

2.6 Communications

If you contact us by email we retain that correspondence to respond to your query.

2.7 People you send a question form to

An Owner or Admin of your account can email a link to a short question form to a person they name, for example an adviser or a colleague who doesn't have a StratStar login. We send that email through Resend (section 5.5) and keep the person's name, email address and the answers they give in your company's account. Their answers become part of your company context and are used in AI features in the same way (section 5.3). The link stops working after 14 days, or sooner if it is cancelled, and the information is deleted with your account (section 4).

2.8 People in your company

Your account can keep a list of the people in your company, so work can be given an owner. For each person we keep their full name, an optional team or department, whether they have a StratStar login, and whether and when they have left your company. A person's name is shown on the work they own, on decisions and handovers that involve them, in reports you create and in the history of changes. When someone is marked as having left, their name stays on finished work and in the history. StratStar never scores, ranks or compares people. The list is kept while your account is open and deleted with it (section 4). To ask for a person's name to be removed, email jon@stratstar.com.

2.9 Documents you upload

You can add documents (for example strategy papers or market analyses) as Strategic Evidence. The file is read in your browser and only the text taken from it is stored; the file itself is never uploaded or kept. With that text we keep a StratStar summary of it, the strategy areas it covers, passages from it that answer key questions, who added it and when, who approved its summary, and a history of changes to the summary. When "Include in AI" is on (the default for new documents), its content is sent to Anthropic when you use AI features (section 5.3). Documents are kept until you delete them or your account is deleted. Deleting a document removes its text, summary and history; we keep only a short record that it was deleted (its title, who deleted it and when). Before your first upload we ask you to confirm you have the right to upload the material and that it doesn't include personal or confidential information it shouldn't.

2.10 Our website and early-access emails

Our website (www.stratstar.com) sets no cookies and uses no analytics or tracking. When you visit it, our hosting provider (Netlify, section 5.2) records your IP address in its standard access logs, and the page loads its font from Google Fonts, which means your browser sends your IP address to Google (section 5.7). If you click "Get early access" or email us, we receive your name, email address and anything you write, in our Google Workspace email (section 5.7). We use it only to reply and to tell you about StratStar's launch, and keep it as set out in section 4.

3. How we use your data

We do not use your data for advertising, sell it to third parties, or use it to train AI models.

4. Data retention

Deleting your account An account Owner can delete your company's account at any time in Settings → Account. We wait 14 days in case the request was a mistake, and an Owner can cancel it during that time. After 14 days we permanently delete the account, your strategy and everything stored with it. If you can't use the app, email jon@stratstar.com and we will delete it for you within 30 days.

Copies held elsewhere - Backups. Our database provider (Xano) takes a full backup every 24 hours and keeps each one for 7 days, then overwrites it. Deleted information is gone from our backups within 7 days of being deleted. - Usage analytics (PostHog). Usage events are labelled with your company's ID only, never your name or email. They are deleted automatically after 12 months. - Error reports (Sentry). These contain no strategy content and are deleted automatically after up to 90 days. - Emails (Resend). Resend keeps a record of the emails we send you (your email address, the subject and whether it was delivered) for 30 days. - Billing (Paddle). Paddle keeps billing records for as long as tax law requires (currently 7 years in the UK).

5. Third-party processors

We use the following sub-processors. Each has been selected for data protection standards appropriate to their role.

5.1 Xano — backend database and API

Purpose: Stores your account data, strategy content, and subscription information. Location: United States. Transfer safeguard: Standard Contractual Clauses (SCCs). Privacy policy: xano.com/privacy-policy

5.2 Netlify — hosting and content delivery

Purpose: Serves the StratStar web application and its static assets. Location: United States (CDN edge nodes globally). Transfer safeguard: SCCs. Privacy policy: netlify.com/privacy Note: Netlify may log your IP address as part of standard web server access logs.

5.3 Anthropic — AI features

Purpose: When you use AI features (AI Coach, AI Generate Phases, RAID generation, strategy review, and the Strategy Build Wizard), your strategy content and company context are sent to Anthropic's API to generate responses. Location: United States. Transfer safeguard: SCCs. Data use: Anthropic's API usage policy states that API inputs and outputs are not used to train Anthropic's models by default. Privacy policy: anthropic.com/privacy What is sent: Strategy content (mission, vision, objectives, goals, actions), company context answers you have entered, and any Strategic Evidence documents you have toggled "Include in AI". We display a disclosure notice in the application before content is sent. Names of owners: strategy content includes the names of the people who own each objective, goal, action and risk, so these names are sent to Anthropic with it. StratStar instructs the AI never to rank, rate or make employment decisions about identifiable people. What is not sent: Your login email address, the email addresses of people on your people list, or billing information. Your own name is sent only where you are the owner of an item.

5.4 PostHog — product analytics

Purpose: Records anonymised product usage events to help us understand which features are working and where users encounter friction. Location: European Union (EU Cloud, Ireland). No data leaves the EU. Identification: Events are tagged with your tenant ID only — your name and email are never sent to PostHog. Privacy policy: posthog.com/privacy

5.5 Resend — transactional email

Purpose: Sends account-related emails (welcome email, password reset, subscription confirmations). Location: European Union (eu-west-1, Ireland). No personal data leaves the EU for email delivery. Privacy policy: resend.com/legal/privacy-policy

5.6 Sentry — error monitoring

Purpose: Captures JavaScript error reports to help us identify and fix application bugs. Location: United States. Transfer safeguard: SCCs. What is captured: Error message, stack trace, browser type, operating system. Strategy content is not included in error reports. Privacy policy: sentry.io/privacy

5.7 Google — email and website font

Purpose: Google Workspace holds our company email, including emails you send us from the website. Google Fonts supplies the font our website uses, so your browser contacts Google when a page loads. Location: Google may process data in the United States and elsewhere. Transfer safeguard: SCCs. Privacy policy: policies.google.com/privacy

6. Cookies

StratStar uses a small number of cookies and browser storage mechanisms:

We do not use advertising or tracking cookies. Our website sets no cookies at all. The StratStar app shows a cookie notice on your first visit.

7. Your rights under UK/EU GDPR

You have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Portability — receive your strategy data in a machine-readable format (JSON export available in-app via Data → Export)
• Restriction — ask us to restrict processing in certain circumstances
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, email jon@stratstar.com. We will respond within 30 days.

If you are unhappy with how we handle your data you have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk — Tel: 0303 123 1113.

8. Security

We take reasonable technical and organisational measures to protect your data, including:

• HTTPS encryption in transit for all data
• Data at rest encrypted by our hosting and database providers
• Access to production systems restricted to authorised personnel
• API keys and secrets stored in a password manager, never in source code

No method of transmission over the internet is 100% secure. If you become aware of a security concern please contact jon@stratstar.com immediately.

9. Children

StratStar is a business application intended for use by adults in a professional context. We do not knowingly collect personal data from anyone under 16.

10. Changes to this policy

We will notify you of material changes to this policy by email or by a notice within the application at least 14 days before the change takes effect. The "Last updated" date at the top of this page always reflects the current version.

11. Contact

For any privacy-related questions or requests:

EQIQ Professional Services Ltd Email: jon@stratstar.com Website: www.stratstar.com