Privacy policy

1. Who we are

STRATIVA is a business management platform for companies: operations, warehouse, sales, purchasing, projects, fleet, finance, reporting and strategy.

STRATIVA is provided by Strativa Systems Ltd, a company registered in England and Wales [company number, registered office address — to be completed once the company is registered].

2. Our role

Your company decides what information it enters into STRATIVA and why. For that information your company is the data controller, and STRATIVA processes it only on your company's behalf and instructions (we are the data processor). Our Data processing terms set this out in detail.

For the small amount of data we handle for our own purposes (for example your account sign-in, security records, billing and support), STRATIVA is the data controller.

3. The personal data we handle

Account details: name, work email address, job title, department, line manager, role and language; and, if you link it, your Telegram account (chat number and user name).

Work information your company enters: for example reports, tasks, projects and sites, photos, documents, stock movements, deliveries, vehicle and fuel records, driving licences, customer and supplier contacts, sales and invoices.

Security information: sign-in times, the type of device and browser, an approximate location (city and country), a shortened IP address (the last part is removed), a random identifier for each browser so we can recognise a new device, failed sign-in attempts and changes to security settings.

Support: messages you send to our support team and questions you ask our help assistant.

Optional features: questions asked to the AI assistant, and connections your company chooses to switch on (for example e-invoicing, spreadsheets or messaging), only when your company enables them.

We do not need, and ask you not to enter, sensitive data such as health information or identity document numbers unless your company has a legal reason to keep it.

4. Why we use it

To provide the service your company has subscribed to (performance of a contract).

To keep accounts and data secure, detect misuse and prevent fraud (legitimate interests and legal obligations).

To answer support requests and improve the reliability of the service (legitimate interests).

To meet our legal obligations, for example accounting and tax rules for our own invoices.

To send service messages such as security alerts, invitations and reminders your company has set up. We do not send marketing emails to your staff.

5. What we never do

We never sell personal data or your company's data, and we never use it for advertising.

We never use your company's data to train artificial intelligence models. Your company's records are sent to an AI service only once we use one under terms that do not allow the provider to train on them. Until then the AI assistant is not available to your company, and the help assistant receives only the question you type and our public help articles; the AI provider's current terms may allow it to use those questions to improve its services, so please do not type personal or customer details into questions.

We look at your company's business data only when you ask us to help with a support request, or when the law requires it, and only as much as needed.

Other companies using STRATIVA cannot see your company's data, except what your company chooses to share with them, such as an invoice sent with a payment link.

6. Who can see your data

People in your own company, according to the role and permissions your company gives them.

Carefully selected service providers that help us run STRATIVA, such as secure cloud hosting, email delivery, encrypted backup storage and, only when your company switches them on, AI assistance and e-invoicing. They act on our written instructions, must keep the data confidential and secure, and may not use it for their own purposes. The current list is available on request: write to info@strativa.uk.

Authorities, only when we are legally required to, and we will tell your company unless the law forbids it.

A buyer or successor of our business, under the same protections, if STRATIVA is ever sold or reorganised.

7. Where your data is stored

Your data is stored in professionally managed, access-controlled data centres.

Some of our service providers may process data outside your country. When this happens we use the safeguards required by law, such as transfers to countries recognised as offering adequate protection or standard contractual protections, and we only use providers that meet our security requirements.

The list of our service providers, what each one does and in which country it processes data is available on request: write to info@strativa.uk. We will tell company owners before we add a provider or move data to another country.

For customers in Uzbekistan, transfers follow the rules on the cross-border transfer of personal data, including the list of countries approved by the Government. [lawyer: confirm the current hosting country is on that list]

8. How we protect your data

STRATIVA is built with security at its core. Our protection includes:

Separation of every company's data by security rules in the database itself, with an automated test, run on every change to STRATIVA, that checks no company can see or change another company's data.

Encryption in transit (HTTPS with strict transport security) and encryption at rest.

Logins and connection tokens for outside services (such as e-invoicing and spreadsheet connections) and webhook signing secrets kept in an encrypted vault; access keys for 1C and calendar feeds stored only in a scrambled (hashed) form, shown once and afterwards identified only by their last four characters; reporting keys also stored only in hashed form.

Two-step sign-in with an authenticator app, required for owners and administrators by default and enforced by the database (a company can change this setting).

Passwords of at least 8 characters.

Automatic sign-out after inactivity (8 hours by default; each company can choose from 1 to 24 hours), a sign-in history for every person and an email when someone signs in from a new device.

Role-based access, so each person sees only what their job requires.

An audit trail of important changes (who, when, before and after) that people in STRATIVA cannot change or delete.

Encrypted backups every night, stored separately from the live service, kept for 30 days (daily) and 12 months (monthly), and tested every month by restoring the latest backup into a separate database and checking every table and file.

Health checks of the service, its database, file storage and background jobs, and email alerts to our team when a backup or a restore test fails.

Electronic signatures for e-invoices are made on your own device: your private signing key never reaches STRATIVA.

Payment card details are handled entirely by our licensed payment providers and are never stored by STRATIVA.

Field (offline mode) for storekeepers, drivers and site staff: the lists its screens need (names and codes, no prices) and the entries not sent yet are kept on the phone encrypted with a key that only works for that person on that phone; they are removed at sign-out, when someone else signs in on the phone, after 7 days without an online sign-in, or when an administrator signs the person out everywhere. Every entry is checked again against the person's permissions when it arrives.

No system can be guaranteed to be completely secure, but we work continuously to protect your data and to respond quickly if anything goes wrong.

9. If something goes wrong

If a security incident affects your company's data, we will inform your company without undue delay, explain what happened and what we are doing, and help your company meet its own legal notification duties, including short deadlines such as those in Uzbekistan.

10. How long we keep data

Account and work data: for as long as your company uses STRATIVA.

When a company asks to close its account, there is a 30-day waiting period in which any owner can cancel the request and download the company's records. After it, the company's data, including its uploaded files, is permanently deleted the following night.

Sign-in and security history: 12 months.

Questions to the AI and help assistants: 90 days, or earlier if the company owner deletes them. AI drafts that your company saves stay until it deletes them. Support requests: 12 months after they are closed.

Entries received from phones in Field (offline mode): 90 days (a stock count waiting for its review until it is decided).

Backups: deleted data disappears from our backups within 12 months as they expire.

Your company remains responsible for keeping its own accounting and tax records for the period required by law (for example at least 3 years in Uzbekistan); please export them before closing your account.

11. Your rights

Depending on the law where you live, you can ask to access, correct, export or delete your personal data, and to object to or restrict how it is used.

For information your employer entered about you, please contact your company first: it decides about that data, and we will help it respond.

Company owners can download the company's records (one spreadsheet file per list) at any time, and a copy of any one person's records. Uploaded files are not included in this download.

You can complain to the data protection authority in your country (in the UK, the Information Commissioner's Office). We would appreciate the chance to resolve your concern first.

12. Cookies

STRATIVA uses only the cookies and browser storage needed to sign you in securely and remember your settings: your sign-in session, your language on the sign-in pages, the automatic sign-out after inactivity, a random browser identifier for new-device alerts, a short-lived cookie while you connect a Google or Microsoft file account, and, in your browser only, your light or dark display, whether you chose a plain background and whether you have seen the install notice.

For storekeepers, drivers and site staff who use Field (offline mode), the browser also keeps Field's page and code and, encrypted, the lists it needs and the entries not sent yet (see How we protect your data); nobody else's browser keeps any of it.

We do not use advertising, analytics or tracking cookies, and STRATIVA loads no tracking scripts. [check: the strativa.uk website, which is not part of the app]

13. Children

STRATIVA is a service for businesses and is not intended for anyone under 18.

14. Changes to this policy

We will update this policy when our service or the law changes. If a change is important, we will tell company owners in STRATIVA or by email before it takes effect.

Each person is asked to read this policy and accept it the first time they sign in, and again after an important change. We keep the date and the version each person accepted.

15. Contact us

For any question or request about your data: privacy@strativa.uk [create this address, or use info@strativa.uk]. Strativa Systems Ltd, [registered office address].