Privacy Policy
Your privacy matters to us. This policy explains how we collect, use, and protect your personal data.
1. Introduction
Welcome to STRAETCH. This Privacy Policy explains how Action & Consequence AB ("we," "us," "our," or the "Company"), a Swedish limited company, collects, uses, discloses, and protects your personal data when you use the STRAETCH platform and related services (collectively, the "Service").
We are committed to protecting your privacy and processing your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Swedish Data Protection Act, the California Consumer Privacy Act ("CCPA"), the California Privacy Rights Act ("CPRA"), and other applicable data protection laws.
Data Controller
Action & Consequence AB
Product
STRAETCH
Registered Country
Sweden
2. Data Controller and Data Processor Roles
When We Act as Data Controller
- Your account registration and profile information
- Your use of our platform features
- Our marketing communications to you
- Analytics about platform usage
When We Act as Data Processor
On behalf of our business customers (the Data Controllers):
- Marketing content and strategies created by customers
- Customer-uploaded data (leads, contacts, documents)
- AI-generated content for customer use
- Data published through social media integrations
For processing activities where we act as a Data Processor, please refer to our Data Processing Agreement (DPA) available upon request.
3. Personal Data We Collect
3.1 Account and Profile Data
| Data Type | Purpose | Legal Basis |
|---|---|---|
| Name, email address | Account creation, authentication | Contract performance |
| Job title, company name | Service personalization | Legitimate interest |
| Profile photo/avatar | User identification | Consent |
| Password (hashed) | Account security | Contract performance |
3.2 Usage and Technical Data
| Data Type | Purpose | Legal Basis |
|---|---|---|
| IP address | Security, fraud prevention | Legitimate interest |
| Browser type, device info | Service optimization | Legitimate interest |
| Pages visited, features used | Product improvement | Legitimate interest |
| Session data, timestamps | Analytics, troubleshooting | Legitimate interest |
3.3 Business and Marketing Data
Data processed for service delivery under contract performance:
3.4 Payment Data
- Billing name, address — Payment processing
- Payment method (via Stripe) — Subscription management
- Transaction history — Accounting, support
3.5 Social Media Integration Data
When you connect third-party platforms:
- • Platform account identifiers
- • Access tokens (encrypted)
- • Profile name, avatar
- • Publishing status, metrics
Supported: LinkedIn, Meta (Facebook/Instagram)
4. How We Use Your Data
Service Provision
- • Creating and managing your account
- • Providing marketing strategy and content features
- • Processing AI-assisted content creation
- • Enabling social media publishing
- • Providing customer support
Service Improvement
- • Analyzing usage patterns to improve features
- • Identifying and fixing technical issues
- • Developing new functionality
- • Conducting product research
Communication
- • Sending service-related notifications
- • Providing security alerts
- • Sending marketing communications (with consent)
- • Responding to inquiries
Legal and Security
- • Preventing fraud and abuse
- • Enforcing our terms of service
- • Complying with legal obligations
- • Protecting rights and safety
5. AI Data Processing
5.1 How AI Features Work
STRAETCH uses artificial intelligence to generate marketing content, analyze strategies, and provide recommendations.
| Aspect | Our Practice |
|---|---|
| Data sent to AI | Anonymized prompts; company names and PII stripped |
| AI Provider | OpenAI (with Data Processing Agreement) |
| Data retention by AI | Zero retention policy; data not used for AI training |
| Human review | No routine human review of AI inputs/outputs |
5.2 Your Control Over AI Processing
6. Data Sharing and Disclosure
6.1 Subprocessors
| Provider | Purpose | Location | Safeguards |
|---|---|---|---|
| Supabase / AWS | Infrastructure, database, authentication | EU (Ireland) | Standard Contractual Clauses, DPA |
| OpenAI | AI content verification & analytics | US | DPA, anonymized data only |
| Anthropic | AI content creation | US | DPA, anonymized data only |
| Stripe | Payment processing | EU | PCI-DSS compliance, DPA |
| Resend | Email delivery | US | DPA, Standard Contractual Clauses |
| DataForSEO | Search/keyword data | EU | No PII transmitted |
| Firecrawl | Web scraping for social listening | US | Public URLs only |
| Lovable | Application hosting | EU | DPA |
| Google Cloud | Analytics (GA4, Search Console) | EU | DPA, Standard Contractual Clauses |
6.2 Social Media Platforms
When you connect social media platforms (LinkedIn, Meta):
- Not our subprocessors: These are independent services you choose to connect
- Their own terms apply: Data shared is governed by their privacy policies
- Your responsibility: You are responsible for platform terms compliance
- We act as conduit: STRAETCH transmits your content via official APIs
6.3 Legal Disclosures
We may disclose data when required by law, subject to our policy which includes:
- • Legality review of all requests
- • Challenging overbroad or unlawful requests
- • Data minimization
- • Customer notification when legally permitted
6.4 Business Transfers
In the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you before your data becomes subject to a different privacy policy.
7. International Data Transfers
7.1 Primary Data Location
All core data storage and processing occurs in AWS EU (Ireland), providing EU-based data residency for European users.
7.2 Transfers Outside the EU/EEA
For limited US-based processing, we ensure adequate protection through:
- • Standard Contractual Clauses (SCCs)
- • Supplementary measures where required
- • Data Processing Agreements with all subprocessors
- • Anonymization where possible
8. Data Retention
8.1 Retention Periods
| Data Category | Retention Period | Basis |
|---|---|---|
| Account data | Duration of account + 30 days | Contract |
| AI conversation history | 7 days (local) | User preference |
| Audit logs | 2 years | Legitimate interest, legal |
| Payment records | 7 years | Legal obligation |
| Backup data | 90 days after deletion request | Technical necessity |
8.2 Deletion Upon Termination
When you close your account or your subscription ends:
- Most data is deleted within 30 days
- Backup data is purged within 90 days
- Anonymized, aggregated analytics may be retained
- Legal records are retained as required by law
9. Your Rights (GDPR)
As a data subject under GDPR, you have the following rights:
Right of Access (Article 15)
Request a copy of your personal data and information about how we process it.
Right to Rectification (Article 16)
Request correction of inaccurate or incomplete personal data.
Right to Erasure (Article 17)
Request deletion of your personal data ("right to be forgotten").
Right to Restriction (Article 18)
Request that we limit how we use your data in certain circumstances.
Right to Data Portability (Article 20)
Receive your data in a structured, machine-readable format.
Right to Object (Article 21)
Object to processing based on legitimate interests or for direct marketing.
Rights Related to Automated Decision-Making (Article 22)
Not be subject to decisions based solely on automated processing that significantly affect you.
9.8 How to Exercise Your Rights
In-app
Settings → Security → Account & Data Deletion
Response time
Within 30 days
10. Your Rights (CCPA/CPRA - California Residents)
10.1 Right to Know
You can request information about the categories and specific pieces of personal data we've collected.
10.2 Right to Delete
You can request deletion of your personal data, subject to certain exceptions.
10.3 Right to Opt-Out of Sale/Sharing
We do not sell your personal data. We do not share personal data for cross-context behavioral advertising.
10.4 Right to Non-Discrimination
We will not discriminate against you for exercising your privacy rights.
10.6 Categories of Data Collected
In the preceding 12 months, we have collected:
11. Cookies and Tracking
Essential Cookies
Required for platform functionality (authentication, security). Cannot be disabled.
Analytics Cookies
Used to understand how you use our platform. Can be managed in cookie settings.
Marketing Cookies
Used for targeted advertising (with consent). Not currently implemented.
11.4 Your Cookie Choices
You can manage cookies through:
12. Security Measures
We implement comprehensive security measures including:
| Category | Measures |
|---|---|
| Encryption | TLS 1.3 in transit, AES-256 at rest |
| Access Control | Role-based access, MFA available |
| Infrastructure | AWS with SOC 2 certification |
| Monitoring | 24/7 security monitoring, intrusion detection |
| Development | Secure development lifecycle (SDLC) |
| Incident Response | 72-hour breach notification |
13. Children's Privacy
STRAETCH is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at compliance@straetch.com.
14. Third-Party Links
Our platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to read their privacy policies.
15. Changes to This Policy
We may update this Privacy Policy periodically. We will notify you of material changes by:
- Email notification
- In-app notification
- Prominent notice on our website
Continued use of the Service after changes constitutes acceptance of the updated policy.
16. Data Protection Officer
While not legally required for our current size, we have designated a privacy contact:
17. Supervisory Authority
If you are unsatisfied with our handling of your data, you have the right to lodge a complaint:
18. Contact Us
For any questions about this Privacy Policy or our data practices:
Version: 2.0 • Last Updated: January 2026 • Contact: compliance@straetch.com