Privacy policy

1. Who is responsible for your data

Strato is the controller of the personal data described here. For any question about your data, write to sales@strato.ge or use the Contact page.

2. What we collect

• Account: your name, email address and job title, and your password — stored only as a one-way hash that we cannot read back.
• Team members: the name and email address of each person an account owner adds to the team. The owner is responsible for having the right to give us these details.
• Your workspace: the project and the competitors you choose, the names you give them and your package.
• Company requests: when your company is not in Strato yet — the company name, project name, city, website, Facebook page and, if you give one, a phone number.
• Feedback: the messages you send from inside the dashboard, an optional screenshot, and the page, language, screen size and browser they were sent from.
• Contact form: your name, email address and message.
• Payments: the package, amount, date and result of each payment and the bank’s order number. We never see or store your card details — you enter the card on Bank of Georgia’s own secure page. When you pay the regular price of a package, the bank saves the card so that you can turn automatic payment on later; we receive and keep only its type, the last four digits of its number and its expiry date, to show you which card it is. You can remove the card at any time on the Billing page.
• Research assistant: the questions you type into the market-research chat.
• Technical data: the cookies listed below; the time you last signed in; and a salted hash of your email or network address, kept for up to an hour, that limits repeated sign-in, sign-up, email-confirmation, password-reset and contact-form attempts. Our servers also keep short-lived technical logs.
• Visit statistics: through Google Analytics — which pages of the site and the dashboard are opened and when, their addresses (these show the filters you choose and a search you type in the Research library), how you reached the site, the type of device and browser, and an approximate location (country and city) worked out from your network address. It is also told that certain actions took place: registering and signing in, pressing a button on the home page, sending the contact form or a company request, starting a payment and completing one (with the package, its term, the amount and our order number), asking the research assistant a question, exporting a file and sending feedback. What you type — a message, a question — is not sent, and neither are your name, email address and account details.
• Use of the dashboard: while you are signed in, our own servers record with your account the days you use the service; which pages you open and when, including the company, ad or post a page shows, the period and the filters you choose (a search you type is not recorded); how long each page is in front of you; the names of the buttons and links you press; the type of device and browser; and how a visit began — from a link in our email, from another website (its name only) or directly. What you type is never recorded. Our team uses it to support customers and to improve the service; it is not sent to anyone else.
• Advertising measurement — only if you accept Meta’s cookies on the bar the site shows: through the Meta pixel, which pages of the site and the dashboard you open and their addresses, and that you registered, sent the contact form or a company request, started a payment or completed one (with the package, the amount and our order number). When you register or complete a payment, our server tells Meta the same directly, with your network address, your browser and Meta’s own cookies, so that it counts it once even if your browser blocked the pixel. Your name, email address and account details are never sent to Meta.

The market data shown in the dashboard — competitors’ ads, posts, press mentions, search positions and market reports — is collected from public sources and is about companies, not about you.

3. Why we use it

• To create your account and provide the service you ordered — to perform our contract with you.
• To take payment and keep payment records — to perform the contract and to meet our obligations under tax and accounting law.
• To answer your requests, feedback and messages, and to send service emails: a code to confirm your email address, a password-reset link, a notice when your password or sign-in address changes, a reminder before a paid period ends, news about a company request, a reply to your feedback — to perform the contract and on the basis of our legitimate interest in supporting customers.
• To protect accounts and the service against abuse — on the basis of our legitimate interest in security.
• To see how the site and the dashboard are used, and to improve them — on the basis of our legitimate interest in developing the service.
• To measure our advertising on Facebook and Instagram and to show our ads to people who have visited Strato — only with your consent, which you can withdraw at any time at the end of this page.

We send no marketing email and make no decision about you by automated means alone.

4. Who else handles your data

We do not sell personal data. We share it for advertising only with Meta, and only if you accept its cookies. Otherwise it is handled only by the providers we need to run the service:

• Google — the Gemini AI service that writes the dashboard’s analyses and answers research questions. The analyses are written from public market data. The questions you type into the research chat are sent to Gemini to produce the answer; your name, email address and account details are not sent with them.
• Google — the Google Analytics service that counts visits. Through its own cookies (see “Cookies”) it receives the visit statistics described above. We do not send it your name, email address or account details.
• Meta (Facebook, Instagram) — only if you accept its cookies: receives the advertising measurement described above, through its pixel and from our server, and uses it under its own data policy to count the results of our ads and to show them to people who have visited Strato. We do not send it your name, email address or account details.
• Bank of Georgia — processes card payments on its own page. We send it the order number, the amount and a description of the purchase; it tells us whether the payment succeeded. It keeps the card saved with your payment, charges it for the next period when you have turned automatic payment on and we ask, and deletes it when you remove the card.
• Our email provider — delivers the service emails and carries the messages you send us.
• Our hosting provider — runs the servers and the database where the service and its data are kept.

Some of these providers may process data outside Georgia; where they do, we rely on the safeguards Georgian law requires for such transfers. We may also disclose data where the law obliges us to.

5. Cookies

We use the cookies the site needs to work, Google Analytics cookies that count visits, and — only if you accept them — Meta’s advertising cookies.

• authjs.session-token — keeps you signed in; up to 30 days.
• authjs.csrf-token and authjs.callback-url — protect the sign-in form and remember where to return after signing in; they hold no personal data.
• strato-lang — the language you chose; one year.
• strato-range — the date range you chose in the dashboard; one year.
• _ga and _ga_G2H6G9KMYZ — Google Analytics: tell one browser from another so that visits can be counted; they hold a random number, not your name or email address; up to two years.
• strato-ev and strato-pay — tell the visit statistics that an action took place (for example “registered”) or which payment to wait for (our order number); they hold no personal data; two minutes, and up to seven days.
• strato-consent — your answer about Meta’s advertising cookies; one year.
• _fbp and _fbc — Meta, only if you accept: tell one browser from another and remember a click on our ad, so that Meta can count its results; they hold a random number, not your name or email address; up to 90 days.

On the secure site the first three carry a “__Secure-” or “__Host-” prefix. Your browser also keeps, on your device only, which notifications you have already seen and your place in a list you return to.

The cookies in the first four lines, and strato-consent, are strictly necessary, so we do not ask for consent to them. _ga, _ga_G2H6G9KMYZ, strato-ev and strato-pay serve the visit statistics and are not necessary: you can block or delete them in your browser, or switch Google Analytics off with Google’s opt-out add-on (tools.google.com/dlpage/gaoptout) — the site works the same without them. If you delete the necessary ones, the site will sign you out and forget your choices. Meta’s cookies, _fbp and _fbc, are set only after you accept them on the bar the site shows; you can withdraw at the end of this page, which deletes them, and the site works the same without them.

6. How long we keep it

• Account, workspace, company requests and feedback — for as long as your account exists.
• Payment records — for the period tax and accounting law requires; after an account is deleted they are kept without the account holder’s name.
• Sign-in sessions — 30 days. Password-reset links — one hour, or one day when our team issues one. Abuse counters — up to an hour.
• Contact-form messages — in our mailbox for as long as it takes to deal with them; they are not stored in the service’s database.
• Visit statistics — Google Analytics keeps the records of individual visits for no longer than 14 months; its cookies last up to two years.
• Use of the dashboard — one year.
• Advertising measurement — what our server keeps with a payment for Meta is deleted once Meta has been told; for a payment that is never completed, at our first check after seven days. Meta keeps what it receives under its own data policy; its cookies last up to 90 days.

Safety backups may still hold deleted data for a limited time before they are replaced.

7. Deleting your account

You can delete your account at any time from the Account page of the dashboard (“Delete my account”). It is removed at once and cannot be restored. When an account owner deletes theirs, its projects, company requests, feedback and the team members’ logins are deleted with it. You can also ask us to do it at sales@strato.ge.

8. Your rights

Under the Law of Georgia on Personal Data Protection you have the right to:

• learn whether and which data about you we process, and receive a copy of it;
• have inaccurate or incomplete data corrected — your name, email address and job title you can change yourself on the Account page;
• have your data deleted, or its processing stopped or restricted;
• receive the data you gave us in a commonly used electronic form;
• withdraw your consent where processing rests on it, and object to processing.

To use any of these rights, write to sales@strato.ge from the email address of your account. We answer within 10 working days.

If you believe your rights have been infringed, you may apply to the Personal Data Protection Service of Georgia (personaldata.ge) or to a court.

9. Security

Passwords are stored only as hashes, connections to the site are encrypted, repeated sign-in attempts are limited, and access to the data is restricted to the people who operate the service.

10. Children

Strato is a service for businesses and professionals. It is not intended for anyone under 18, and we do not knowingly collect their data.

11. Changes to this policy

When we change this policy we publish the new version on this page with a new date. We tell account holders about a significant change by email or in the dashboard before it takes effect.