LEGAL DOCUMENT

Privacy Policy

Effective Date: 13 May 2026 · Last Updated: 13 May 2026

Strata ("we," "our," or "the Platform") is an autonomous content authority engine. This Privacy Policy explains how we collect, process, and protect data when you use the Strata platform, including any APIs, dashboards, and automated deployment systems.

⚠By connecting your domain, CMS, or payment provider to Strata, you confirm that you have read and agreed to this Privacy Policy.

Data We Collect

We collect the following categories of data to operate the Strata engine:

Account Data

Email address, name, and authentication credentials used to access the dashboard.

Domain & Site Data

Your domain URL, competitor URLs you provide, and site structure data retrieved via Google Search Console (GSC) integration.

API Credentials

API tokens for third-party integrations (Webflow, WordPress, GSC). These are stored encrypted in Supabase Vault and are never stored in plain text.

Content & Extraction Data

Articles written by the engine, competitor content extracted during Vampire Extraction, and semantic triplets produced during Semantic Triangulation.

Payment Data

Transaction records via Stripe, including the ref_article attribution parameter. We do not store full card details. All payment processing is handled by Stripe.

Usage Telemetry

Dashboard interactions, engine run logs, and article performance data (CTR, impressions) used to power the Attribution Dashboard.

Multi-Tenant Data Isolation

Your proprietary data is yours alone. Strata operates as a multi-tenant platform. Each operator account is strictly isolated at the database level via Supabase Row Level Security (RLS).

Specifically:

Semantic triplets, knowledge graph extractions, and competitor analysis produced for your account are never shared with, surfaced to, or used to train models for any other operator account.
Your competitor data is treated as proprietary business intelligence and is retained only for the purpose of generating content within your account.
Article embeddings and content vectors created for your domain are stored in a segregated namespace and are not accessible cross-account.

How We Use Your Data

To operate the Strata engine: scanning competitors, writing articles, and publishing content to your CMS
To power your Attribution Dashboard: linking published articles to revenue events via the Stripe ref_article webhook
To maintain and improve the platform infrastructure (not to train shared AI models on your proprietary data)
To send transactional emails: engine run notifications, billing receipts, and critical system alerts
To comply with legal obligations when required

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties beyond the integrations you explicitly authorize.

Third-Party API Integrations

When you connect third-party services, the following data flows apply:

Google Search Console

We access your GSC property to retrieve search performance data (queries, impressions, CTR). We operate in read-only mode unless you explicitly authorize publishing via GSC API.

Stripe

We receive webhook events from Stripe to attribute transactions to published articles. We do not initiate charges on your behalf. All payments are configured by you within the Stripe dashboard.

Webflow / WordPress

We write content to your CMS using your API credentials. We do not read, store, or transmit existing CMS content beyond what is required to deploy new articles.

Supabase

Our primary database and auth provider. All data is stored in isolated Supabase projects with Row Level Security enforced.

Data Retention

Active accounts: Data is retained for the duration of your subscription
Cancelled accounts: All account data is deleted within 90 days of cancellation, unless retention is required by law
Competitor extraction data: Retained for 12 months from the date of extraction, then purged automatically
Published article logs: Retained indefinitely while your account is active to power the Attribution Dashboard; deleted upon account closure

Your Rights

You have the right to:

Access: Request a full export of all data associated with your account
Correction: Update any inaccurate account information via the dashboard
Deletion: Request complete erasure of your account and all associated data by emailing adugbovictory@aeostrata.com
Portability: Receive your article content, extraction logs, and telemetry data in JSON format upon request

Security

All API credentials stored encrypted in Supabase Vault (AES-256)
All data transmitted over HTTPS/TLS 1.3
Row Level Security (RLS) enforced on all database tables
Authentication via Supabase Auth with JWT session tokens
No plaintext storage of passwords or API keys

Contact

For privacy-related inquiries, data access requests, or deletion requests:

Data Controller: Victory Adugbo

Email: adugbovictory@aeostrata.com

Response time: Within 5 business days

Registered address: Lagos, Nigeria

Changes to This Policy

We may update this Privacy Policy as the platform evolves. Material changes will be communicated via the email address on your account at least 14 days before they take effect. Continued use of the platform after that date constitutes acceptance of the updated policy.