Privacy Policy

STRENC is operated by STRENC LLC, based in Chicago, Illinois, United States. [DRAFT — add the registered business address] We are the “controller” (the party responsible) for the personal information described in this policy. You can contact us at any time at the address in Section 15.

Information you give us:

• Account information: your name, your email address, and your sign-in method, collected through our authentication provider when you create an account. We never see your password.
• Your content: the projects, models, section definitions, analysis inputs, and results you choose to save, and the users you share projects with.
• Academic licence requests: your name, institution, institutional email, department, and country.
• Communications: the content of emails you send us.

Information created when you use the Service:

• Terms acceptance records: when you accept our Terms of Service and this Privacy Policy, we record which versions you accepted, when you accepted them, your IP address, and your browser’s user-agent string.
• Billing information: your subscription plan, status, and billing history. Your payment card is collected and stored by our payment processor, Stripe. It never reaches our servers (see Section 7).
• Usage information: a record of each calculation run (which tool, and when). We use it for plan quotas, compliance with our Terms, abuse prevention, and aggregate product statistics. We also record when you were last active and, for API keys, when each key was last used.
• Technical information: IP address, browser and device type, request logs, and error details, generated automatically when you use the Service.

We do not buy personal information, and we do not collect it about you from data brokers.

• to provide the Service: to authenticate you, run calculations, store and share your projects, and generate calculation packages;
• to manage subscriptions, trials, academic licences, quotas, and payments;
• to keep a record of your acceptance of our Terms and this Privacy Policy, and to verify compliance with and enforce our agreements, for example by detecting shared accounts;
• to send transactional emails, such as acceptance confirmations, billing notices, and project-share invitations;
• to secure the Service: to prevent fraud, abuse, and misuse, and to diagnose errors;
• to understand aggregate usage so that we can improve the Service; and
• to comply with legal obligations.

We do not add you to a marketing mailing list. If we ever send marketing email, we will do so only with your consent, and every message will include an unsubscribe link.

Where the GDPR or UK GDPR applies, we rely on these legal bases:

• Contract: to provide the Service, manage your subscription, and support you;
• Legitimate interests: to secure, operate, and improve the Service, and to keep records that establish or defend legal claims, such as Terms acceptance records, where our interests are not overridden by your rights;
• Legal obligation: for example, tax and accounting rules; and
• Consent: for any optional communications. You can withdraw consent at any time.

We do not sell, rent, or trade personal information. We do not share it for cross-context behavioral advertising. We share it only as follows:

• Service providers (processors) that process it on our behalf under contract, each only as its role requires:
  • Clerk: authentication and account management
  • Stripe: payments, invoicing, and tax
  • Neon: database hosting
  • Vercel: application hosting and request logs
  • Upstash: rate limiting
  • Cloudflare: bot protection on public forms
  • Resend: delivery of transactional email (it processes your email address and the message only to deliver it)
• Other users, at your direction: when you share a project, the recipient sees the project and your name and email address.
• Legal and safety: when the law or legal process requires it, or when it is needed to protect the rights, property, or safety of STRENC, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets. If that happens, this Privacy Policy will continue to apply to your information.

[DRAFT — counsel to confirm that a data-processing agreement is in place with each provider]

We use only strictly necessary cookies: the session cookies our authentication provider sets to keep you signed in and to protect sign-in against attack. The Service also uses your browser’s local storage for convenience settings, such as remembering that you dismissed an announcement. We use no analytics, advertising, or cross-site tracking cookies, which is why there is no cookie consent banner. If you block strictly necessary cookies in your browser, you will not be able to sign in.

The Service does not respond to “Do Not Track” signals differently, because we do not track you across sites. We treat Global Privacy Control signals as an opt-out of sale or sharing, although we do neither.

Payments are handled by Stripe, which is certified to the Payment Card Industry Data Security Standard (PCI DSS). Your card details go directly to Stripe and never reach our servers. We do not store card details in our database. You view and update your payment method in Stripe’s billing portal.

We keep personal information only for as long as we need it for the purposes in this policy and for our legal, accounting, and business obligations:

• Account information and your content are kept while your account exists.
• Usage records are kept for up to 24 months, for quotas, abuse prevention, and statistics, and are then deleted automatically.
• Terms acceptance records are kept while your account exists and for up to seven (7) years after it is deleted, to establish, exercise, or defend legal claims. [DRAFT — counsel to confirm the period]
• Billing records are kept by Stripe and by us for as long as tax and accounting law requires.
• Server logs and error details are kept for our providers’ standard rolling periods, normally no more than 90 days.

You can delete your account yourself at any time from the Account page. When you do, we cancel any active subscription and delete your sign-in identity, account information, projects (including projects you shared), optimization runs, API keys, usage history, and any academic-licence request from our systems. Records we must keep, such as acceptance and billing records, are handled as described above. Copies may remain in encrypted backups for a limited period, until those backups expire in the normal course.

You can view and edit your saved projects in the Service at any time. Depending on where you live, you may also have the following rights:

• Access: to get a copy of the personal information we hold about you;
• Correction: to correct information that is inaccurate or incomplete;
• Deletion: to have your personal information deleted, subject to Section 8. You can do this yourself from the Account page;
• Portability: to receive your information in a portable format;
• Restriction and objection: to restrict or object to certain processing;
• Withdrawal of consent: where we rely on your consent;
• Appeal: to appeal our decision on a request, where state law provides this right; and
• Non-discrimination: to be free from unfavorable treatment for exercising any of these rights.

To exercise any of these rights, email us at the address in Section 15. We may need to verify your identity before we act on a request. We will respond within the time the law requires. You may also use an authorized agent where the law allows.

The Service is for adults (see the Terms of Service) and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact us and we will delete it promptly.

We take reasonable administrative and technical measures to protect personal information. Our hosting providers encrypt data in transit (TLS) and at rest. Our authentication provider handles passwords entirely, and they are never visible to us. API keys are stored only as one-way hashes. Access to production systems is limited to the people who operate the Service. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.

We are based in the United States, and our providers store and process data mainly in the United States. If you use the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data-protection law may differ from the law where you live. [DRAFT — counsel to confirm the transfer mechanism for EEA/UK users, e.g. Standard Contractual Clauses or the EU–U.S. Data Privacy Framework]

The Service may link to websites we do not operate, such as those of standards organizations and our service providers. We are not responsible for their content or privacy practices. This policy does not apply to them.

If you have a concern about how we handle your personal information, please contact us first so that we can try to resolve it. You also have the right to complain to a data-protection authority, including:

• in the EU/EEA, your national data-protection authority;
• in the UK, the Information Commissioner’s Office (ICO);
• in Canada, the Office of the Privacy Commissioner of Canada; and
• in California, the California Privacy Protection Agency or the California Attorney General.

We will post any update to this policy on this page, with a new version date. For material changes, we will notify you by email or in the Service before they take effect, and we will ask you to acknowledge the updated policy.

Privacy questions and requests: jd.pozo.raster@gmail.com [DRAFT — replace with the company privacy/support address]