Privacy policy

1. Controller

The data controller is Mateu Foixench Vilagrasa, owner of StrategaOS, based in Spain. For any privacy matter, write to mateo.foixench@gmail.com.

2. Data we process

• Account data: name, email address, organisation, team role and preferences.
• Application usage data: which screens are opened and which actions are taken, recorded as codes, without your clients' content. Technical error logs for 30 days.
• Data from the sources you connect, only those authorised by you or your client: campaign, ad, keyword and search term metrics, their configuration and change history (advertising); aggregated daily metrics by channel, source, page, device, country and event, and the key event configuration (web analytics); orders, products and channels (store); sends, flows and lists (email); contacts, opportunities and stages as aggregated figures (CRM).
• Access credentials for those sources (OAuth tokens or keys), stored encrypted and never visible in the browser.
• What you write in the application: notes, tasks, questions, report conclusions.

We do not process personal data of visitors to your clients' websites: the analytics we read are aggregated figures.

3. Why we use it

• To provide the service: show you reports and analyses, detect changes and alert you, prepare diagnoses and recommendations and generate the reports you share with your clients (performance of the contract).
• To keep the service secure and working: access control, abuse prevention and error resolution (legitimate interest).
• To answer your support requests (performance of the contract).
• To comply with legal obligations.

We do not sell data, we do not use it for advertising and we do not build profiles of people.

4. Google user data (Google Ads and Google Analytics)

When you connect Google Ads or Google Analytics, Google asks for your permission for StrategaOS to access your accounts. We request only what is needed:

• Google Ads (https://www.googleapis.com/auth/adwords): read the performance, configuration, search terms, serving status and change history of the accounts you assign to each client. StrategaOS only reads: it does not create, change, pause or delete campaigns, ads or budgets.
• Google Analytics (https://www.googleapis.com/auth/analytics.readonly): read aggregated metrics of the properties you assign and their key event and data stream configuration.
• We use this data only to show you reports, alerts, diagnoses and recommendations about those accounts inside StrategaOS.
• We do not sell Google user data, use it for advertising or profiling, or transfer it to third parties except to the processors needed to provide the service (section 5), when required by law or for security.
• No one reads your Google data unless you allow it (for example, in a support request), it is needed for security or by law, or it is aggregated and anonymised.
• We do not use Google user data to train generalised artificial intelligence models.

Limited Use

StrategaOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

5. Who we share data with

Only with providers that process data on our behalf (processors), under contract and with data protection safeguards:

• Supabase: database and authentication.
• Vercel: application hosting.
• Anthropic: automated analysis of the data to write diagnoses, explanations and recommendations. It receives only what each analysis needs and does not use that data to train its models.
• Resend: application emails (invitations and alerts).

6. International transfers

Some of these providers may process data outside the European Economic Area. When they do, they use the safeguards of the General Data Protection Regulation, such as the European Commission's standard contractual clauses.

7. How long we keep it

• Data from a source is kept while it is connected. If you disconnect it or unlink it from a client, its metrics, alerts, analyses and configuration are deleted in the background, and access to the provider account is revoked when no one else uses it.
• What you delete in the application goes to the trash for 30 days and is then permanently removed.
• If you close your account or organisation, its data is deleted after 30 days.
• Technical error logs are deleted after 30 days. Invoices and credit movements are kept as long as the law requires.

8. Security

Connections are encrypted. Source credentials are stored encrypted and are only used by the server. Each organisation can only see its own data and, within it, each person only what their role allows.

9. Your rights

You can request access, rectification, erasure, objection, restriction or portability of your data by writing to mateo.foixench@gmail.com. If you think we are not handling it properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

You can withdraw StrategaOS's access to your Google account at any time from the application (Connections › Disconnect) or at https://myaccount.google.com/permissions.

10. Cookies

We only use technical cookies needed to sign in, keep the session and protect the connection flows. We do not use third-party analytics or advertising cookies.

11. Changes

If we change this policy, we will update the date above and, if the change is significant, let you know in the application or by email.