Privacy Policy

Last updated: 9 September 2026

This policy explains how Joe Reid, trading as Stratavue (“we”) collects, uses, stores, and protects personal data when you use our Service. We are the data controller for personal data submitted directly by you (e.g. account details). For data your organisation uploads about other people (employees, customers, third parties), your organisation is the controller and we are the processor.

1. What data we collect

• Account data — name, email, organisation.
• Enquiry data — if you use the contact form: your name, email, organisation, role, anything you write in the message, and — only if you ask us to call — an optional phone number and preferred time. This is emailed to us and stored so that an enquiry cannot be lost if the email fails to arrive. It is kept until we have dealt with it and no longer need it; ask us at any time and we will delete it.
• Billing data — handled by Stripe. We receive only the last 4 digits and card brand for display.
• Usage data — login times, page views, audit log entries.
• Content you upload — capabilities, initiatives, evidence, processes, and other data you enter into the Service.

2. How we use it

• To provide and improve the Service.
• To send transactional emails (welcome, billing alerts, password reset).
• To send the optional weekly digest, which you can opt out of in your notification preferences.
• To investigate abuse, security incidents, or legal requests.

3. Legal basis (UK GDPR)

• Contract performance — for core service delivery.
• Legitimate interests — for security, fraud prevention, and abuse detection.
• Consent — for optional emails (digest) and any non-essential cookies.
• Legal obligation — for accounting and tax records.

4. Sub-processors

We use the following sub-processors to deliver the Service:

• Supabase, Inc. — database hosting and authentication services. Data processed in the United Kingdom.
• Stripe Payments UK Limited — payment processing for paid subscriptions. Data processed in the United Kingdom. Stripe Payments UK Limited is authorised by the Financial Conduct Authority as an electronic money institution (firm reference number 900461).
• AI model provider — Stratavue's AI features send the relevant content to a third-party AI model: the optional setup wizard, the insight panels on project, capability, system, objective and programme pages, impact suggestions, capability generation, and reading documents you upload to Stratavue Assurance. Which provider is used, and the country it processes data in, is a configuration choice rather than a fixed part of the Service. The provider that applies to your workspace — and whether it processes in the United Kingdom, the European Economic Area or elsewhere — is named in your Data Processing Agreement with us, and the current list is available on request at any time. Where a provider processes outside the UK, transfers are governed by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
• No AI at all, if you prefer. A workspace administrator can switch AI features off in Organisation Settings, after which no content from that workspace is sent to any AI provider and the features named above are unavailable until an administrator turns them back on. Separately, projects classified RESTRICTED or SECRET are never sent to an AI provider, whether the setting is on or off.
• Vercel, Inc. — web application hosting. Data processed in the United Kingdom.
• Google Ireland Limited (Google Workspace) — transactional email delivery. Data processed in the United Kingdom and the European Economic Area.
• Upstash, Inc. — rate-limiting infrastructure to protect against abuse. Data processed in the United Kingdom.
• Microsoft Corporation (Microsoft Clarity) — website usage analytics, marketing pages only. Not loaded in the application. See Microsoft's privacy statement for how Microsoft processes this data.

5. Business transfers

If Stratavue undergoes a change of ownership — such as a merger, acquisition, or sale of assets — your personal data may be transferred to the acquiring entity as part of that transaction. We will notify affected users by email at least 30 days before any such transfer becomes effective. The acquiring entity will be bound by the terms of this Privacy Policy unless and until you receive notice of a new policy, at which point you may exercise your data subject rights (including erasure) before continuing to use the Service under the new terms.

6. International transfers

Where your workspace uses an AI provider that processes outside the United Kingdom, that transfer is governed by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses; your Data Processing Agreement names the provider and its location, and a provider processing within the UK or the European Economic Area can be configured where you require it. Microsoft Clarity, used on our marketing pages, may process data outside the United Kingdom — see Microsoft's privacy statement, linked above, for where and on what basis. All other sub-processors process data in the United Kingdom or the European Economic Area only.

7. Data retention

• Account data is retained while your account is active and deleted within 30 days of account closure (per the trial-cleanup cron and GDPR cascade).
• Audit logs are retained for 7 years in line with UK regulatory standards.
• Backups are retained for 30 days.

8. Marketing and downloadable resources

When you request a free resource such as our change impact assessment template, we collect the email address you give us, and — only if you choose to provide them, as both fields are optional — your company name and an approximate company size. We also record how many times you have requested the resource, and whether you ticked the box asking for occasional content.

• Why — to send you the file you asked for, to understand which parts of the product are relevant to you, and, only with your consent, to send occasional practical content about managing change.
• Legal basis — sending the requested file is legitimate interest (you asked us for it). Any marketing email beyond that is sent on consent, which is never assumed: the box is unticked by default and leaving it unticked has no effect on receiving the template.
• Retention — kept for 24 months from your most recent request, then deleted. If you withdraw consent we stop marketing immediately and delete the record on request.
• Sharing — not sold, not shared with third parties, and not used for advertising. It reaches only our own email delivery (see sub-processors above).
• Withdrawing consent — email contact@stratavue.co.uk and we will remove you. A one-click unsubscribe link will be included in every marketing email we send.

Requesting a resource does not create an account and does not sign you up to anything by itself.

9. Your rights under UK GDPR

• Access (Article 15) — via /settings/data-export for organisation admins.
• Rectification (Article 16) — edit in-app, or contact us.
• Erasure (Article 17) — /settings/delete-organisation for org admins, or /settings/leave-workspace for individual users.
• Portability (Article 20) — via /settings/data-export.
• Object to processing — contact us.
• Withdraw consent — via /settings/notifications, or contact us.

10. Cookies

We use essential cookies for login session and preferences. We do not use advertising cookies, and we do not sell or share what we collect.

We use Microsoft Clarity on our marketing pages only (not the application) to understand how visitors use the site, through session replay and heatmaps. Microsoft Clarity sets cookies (_clck, _clsk) only if you accept analytics cookies in our cookie banner. You can change your choice at any time via “Cookie settings” in the footer. Microsoft acts as a sub-processor for this purpose; see Microsoft's privacy statement.

Cookies this site may set:

We also use Vercel Web Analytics, which measures page views without cookies and without tracking individuals across sites. If we ever introduce analytics or marketing cookies, we will update this policy and prompt for consent first.

11. Security

We use TLS encryption in transit, encryption at rest, role-based access controls, and append-only audit logging. We conduct regular security review of our infrastructure and dependencies.

12. Data breach notification

Material data breaches are reported to the Information Commissioner's Office (ICO) within 72 hours of discovery and to affected users without undue delay.

13. Children

The Service is not directed at individuals under 18. We do not knowingly collect personal data from children.

14. Contact

For privacy questions, data subject access requests, or complaints, contact contact@stratavue.co.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Material changes to this policy will be notified by email 30 days in advance. Continued use of the Service after the effective date constitutes acceptance.