Privacy policy

Who is responsible

The data controller is Stratorys, a simplified joint stock company (SAS) with registered office at 40 rue Alexandre Dumas, 75011 Paris, France. For any question about this policy, contact hello@stratorys.com.

What we collect

Our contact form collects your name, work email address, organisation, enquiry topic, and message. Your organisation is optional; the other fields are needed to submit and handle your request. The form cannot be submitted without this information or a successful antispam check. You can also email us directly.

When you email us or book a call through the Google Calendar link, we receive the information you provide, including your name, email address, message, or selected time. Operating and securing the website also involves Cloudflare processing technical data, including IP addresses and information about the browser and connection.

Why we process it

We use contact data to answer and follow up on your request and prepare meetings. When an enquiry concerns a potential service or contract, processing is based on steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). For other enquiries, it is based on our legitimate interest in responding to people who contact us (Article 6(1)(f)).

Protecting the website and form against bots and abuse is based on our legitimate interest in keeping them secure (Article 6(1)(f)). We do not use your data for advertising and we do not sell it.

Contact form and recipients

After the form and antispam check are validated, your request is stored in a Cloudflare D1 database with an identifier and submission date. Your contact details and enquiry content are then sent to Resend for email delivery to Stratorys. Authorised people at Stratorys access this information to handle your request; technical providers process it as needed to deliver their services.

Booking and scheduling

Our contact page contains an external link to Google Calendar. No Google booking widget is embedded on that page. Following this link takes you to Google's website to make your booking, where its privacy policy applies, including to technical data and cookies. We receive the booking details to prepare and hold the meeting.

Hosting and processors

Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, provides website hosting, D1 storage for enquiries, and Turnstile antispam protection. Resend delivers the contact form's email notifications. Email providers and Google Calendar also support correspondence and bookings. Cloudflare separately describes its processing to improve Turnstile in its Turnstile privacy notice.

Transfers outside the European Economic Area

Using these providers involves processing outside the European Economic Area, including in the United States for Resend. We do not guarantee exclusively European hosting. The data processing agreements of Cloudflare and Resend provide safeguards for the relevant transfers, including the European Commission's Standard Contractual Clauses where applicable. You can consult these agreements or contact us at hello@stratorys.com for information about the safeguards applicable to your data.

Cookies and analytics

We do not use advertising cookies or audience measurement scripts. However, the contact page loads the Cloudflare Turnstile script when opened, before the form is submitted, to distinguish human visitors from bots. Turnstile processes technical signals, including IP addresses and information about the browser and connection. On submission, our server also sends your IP address to Cloudflare to verify the antispam result; this address is not stored in the D1 enquiries table.

Cloudflare's security processing and any security cookies serve to protect against abuse, a purpose distinct from advertising or audience measurement. For details, see the Turnstile privacy notice and Cloudflare cookie policy. Cookies on the external booking website are governed by Google's rules when you visit it.

How long we keep it

Enquiries that do not lead to a contractual relationship, including associated booking correspondence, are deleted from D1 and our email inboxes no later than 12 months after our last exchange with you. Stratorys carries out this deletion manually.

If a contractual relationship is established, data needed to perform the contract is kept for its duration. Afterwards, only data needed to meet a legal obligation or defend legal rights is archived for the applicable legal periods, with restricted access; other data is deleted. Technical data and copies processed by providers are subject to the retention periods in their own policies and agreements.

Your rights

Under the GDPR and the French Data Protection Act, you have rights of access, rectification, erasure, and restriction, subject to the conditions set out in applicable law. You may object, on grounds relating to your particular situation, to processing based on our legitimate interests. Data portability applies to data you have provided when processing is automated and based on a contract, precontractual steps, or your consent. To exercise your rights, contact hello@stratorys.com. You may also lodge a complaint with the CNIL, the French data protection authority.

Changes to this policy

We may update this policy as our practices or the law evolve. The date at the top reflects the latest revision.