Privacy Policy

1. Information We Collect

Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. This may include:

• Email address
• First name and last name
• Company name
• Phone number
• Address, State, Province, ZIP/Postal code, City

Usage Data

We may also collect information on how the Service is accessed and used. This Usage Data may include information such as your computer's Internet Protocol address, browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, and other diagnostic data.

2. How We Use Your Information

We use the collected data for various purposes:

• To provide and maintain the Service
• To notify you about changes to our Service
• To provide customer support
• To gather analysis or valuable information so that we can improve our Service
• To monitor the usage of the Service
• To detect, prevent and address technical issues
• To send you service-related communications

3. Data Storage and Security

Data Location

For our managed cloud service, data is stored in EU data centers located in Romania. For self-hosted deployments, data is stored on your own infrastructure in the location of your choice.

Data Isolation

StrataDesk uses a database-per-client architecture. Each client's data is stored in a separate PostgreSQL database, providing physical data isolation between clients.

Security Measures

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS 1.2+)
• Encryption at rest for database storage
• Password hashing with bcrypt
• Regular security updates
• Audit logging of all actions

4. Data Retention

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

5. Your Data Protection Rights (GDPR)

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. MICROLAB DIGITAL SRL aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.

You have the following rights:

• Right of access - You have the right to request copies of your personal data.
• Right to rectification - You have the right to request that we correct any information you believe is inaccurate.
• Right to erasure - You have the right to request that we erase your personal data, under certain conditions.
• Right to restrict processing - You have the right to request that we restrict the processing of your personal data, under certain conditions.
• Right to data portability - You have the right to request that we transfer the data we have collected to another organization, or directly to you, under certain conditions.

6. Data Portability

Due to our database-per-client architecture, we can provide complete data exports in standard PostgreSQL format (pg_dump). This allows you to migrate your data to another service or maintain your own backups.

7. Third-Party Services

We may employ third-party companies and individuals to facilitate our Service ("Service Providers"), provide the Service on our behalf, perform Service-related services, or assist us in analyzing how our Service is used.

8. Cookies

We use cookies and similar tracking technologies to track activity on our Service and hold certain information. Cookies are files with small amounts of data which may include an anonymous unique identifier.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.

8a. Integration Callbacks & Recurring Plans

Customers using the recurring-plans feature can hand integration tokens to external systems (backup scripts, monitoring agents, CI pipelines). Those systems send signed callbacks into our API when scheduled work completes. The data we accept, store, and retain from those callbacks is scoped as follows:

• What we accept: a structured JSON body identifying the ticket, the event (execution.succeeded / execution.failed), and a customer-defined result object whose shape and contents are determined by the customer's own scripts. We do not parse or interpret the contents of result beyond storing them on the ticket.
• What we store: the request headers (timestamp, signature, idempotency key), the body, the derived ticket-state transition, and an entry in the tenant-local event log. The plaintext bearer token is never stored — only an HMAC-SHA256 hash salted with a server-side pepper.
• Retention: result_fields values are retained for the lifetime of the ticket. The append-only event log keeps 12 months of hot data per tenant; older partitions are gzipped, encrypted with a tenant-scoped key, and moved to the tenant's configured archive backend.
• Tenant-configured storage: archive files may live in a customer-configured S3-compatible bucket (per the tenant's storage settings). Where this is the case, that data is under the customer's control and governed by the customer's own storage provider's terms.
• What we don't accept: we don't pull data from your external systems. The callback flow is strictly push-from-customer; we never reach out to your infrastructure.

8b. Newsletter

We run an opt-in newsletter: monthly product news about StrataDesk, and nothing else. It is separate from the Service — you do not need an account to receive it, and having an account does not put you on it. Signing up is double opt-in, so we send nothing until you have clicked the link in the confirmation email.

• What we collect: your email address, and the evidence that you are the one who asked — the date and time we received the request, the date you confirmed it, the IP address the request came from, the page you signed up on, and the browser user agent that sent it.
• Why: the address is what we send the newsletter to. The rest is the record that the subscription was asked for and confirmed, rather than added by us or by somebody else on your behalf — which is what we would have to show if you, or a supervisory authority, ever asked why we were mailing you.
• Lawful basis: consent, under Article 6(1)(a) GDPR. Not legitimate interests: we ask, and nothing is sent before you have answered.
• How long we keep it: a signup that is never confirmed is deleted seven days after it was made. A confirmed subscription is kept for as long as you stay subscribed. When you unsubscribe we delete the consent evidence — the IP address, the source page and the user agent — because once the answer is no there is nothing left to prove. We keep the address itself as a suppression record, so that a later import or bulk signup cannot quietly put you back on a list you have left.
• What we measure, and only here: we ask our email provider to record whether each newsletter was opened and whether any link in it was clicked. Opens are measured by a single invisible image in the message, and clicks by sending each link through the provider first, so that it can note the click before sending you on to where the link says it goes. We use this to see whether the newsletter is worth writing — nothing more. It is not linked to any account, and it does not follow you anywhere else.
  
  This applies to the newsletter and to nothing else we send you. Email about your account — confirming this subscription, resetting a password, a notification from the Service — carries no tracking image and no rewritten links. We considered turning measurement on for the whole mail domain, which would have been simpler for us, and did not: a password-reset link should go where it says it goes.
  
  If you would rather not be counted, most mail apps can block remote images, which stops the open being recorded. Be aware the reverse is also true and not in your control: some providers, including Apple Mail and Gmail, fetch that image for you whether or not you have read anything — which is why we treat opens as a rough signal and not as a fact about any individual.
• How to withdraw: every newsletter we send carries an unsubscribe link, and one click on it is the whole process. No account, no login, and no need to write to us. Withdrawing consent does not affect anything we sent before you withdrew it.
• Who else is involved: the mail is delivered by our email provider (EU region), which processes the address in order to deliver it and reports back what became of each message — delivered, opened, a link clicked, bounced, or reported as spam, as described above. A complaint or a permanent bounce unsubscribes the address automatically. We do not sell or rent the list, and we do not share it with anyone other than that provider.

9. Children's Privacy

Our Service does not address anyone under the age of 18 ("Children"). We do not knowingly collect personally identifiable information from anyone under the age of 18.

10. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this Privacy Policy.

11. Contact Us

If you have any questions about this Privacy Policy, please contact us:

• By email: Contact Form
• For security-related inquiries: Security Contact Form

12. Who is accountable

Naming a supervisory authority without naming anyone to stand in front of it is not much use to you, so:

• Data protection contact: Luiza Badaceanu, Administrator — questions about this policy, data subject requests, and anything under the DPA. Reachable at hello@stratadesk.io.
• Security: Luiza Badaceanu, Administrator — accountable for the controls described on our security page, for incident response, and for vulnerability reports sent to security@stratadesk.io.
• Data Protection Officer: none appointed. Article 37 GDPR requires a DPO of public authorities, of organisations whose core activities involve large-scale systematic monitoring, and of those processing special categories of data at large scale. We are none of these, so we are not required to appoint one and have not. We would rather say that than name a role we do not staff. The contact above handles what a DPO would.
• Supervisory authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP). You may lodge a complaint with them directly; you do not have to come to us first.