01 Scope and our role

This Policy applies to Strover-controlled websites, applications, demonstrations, events, sales and support interactions, and the Strover cloud platform. It does not apply to third-party sites or services that publish their own privacy notices.

For account, business-contact, website, and operational data, Strover generally determines why and how the data is processed. For personal data contained in cloud findings, logs, evidence, configurations, tickets, or other content submitted by an enterprise customer (“Customer Content”), Strover generally processes that data on the customer’s instructions under the applicable agreement. The customer remains responsible for its notices, lawful basis, permissions, and instructions.

02 Personal data we collect

• Business and account details, such as name, work email, phone number, organization, role, username, and authentication information.
• Sales, contract, billing, procurement, partner, event, and customer-success information.
• Support requests, feedback, survey responses, meeting records, correspondence, and files you choose to share.
• Job-application or contractor information when you apply to work with Strover.

• Cloud-account identifiers, resource metadata, security findings, compliance evidence, configurations, risk context, ownership tags, remediation records, and audit trails.
• Integration credentials or tokens, which are protected and used only to operate authorized connections.
• User roles, approvals, workflow history, and actions taken within the platform.

• IP address, browser and device information, timestamps, pages or features used, referring pages, cookie identifiers, and approximate location derived from IP.
• Application, authentication, performance, diagnostic, and security logs.

03 How we use personal data

• Provide, configure, authenticate, support, secure, and maintain the platform and related services.
• Ingest and analyze authorized cloud-security and compliance signals; prioritize risk; generate recommendations; support governed remediation; and produce reports and evidence.
• Manage accounts, contracts, billing, procurement, partnerships, demonstrations, training, and customer communications.
• Monitor reliability, detect misuse or security threats, investigate incidents, and enforce agreements.
• Improve product quality and user experience using aggregated, de-identified, or otherwise permitted information.
• Send product, event, and marketing communications where permitted; recipients can opt out of marketing messages.
• Comply with legal obligations, respond to lawful requests, protect rights, and resolve disputes.

04 Legal grounds

Depending on the jurisdiction and context, we rely on one or more lawful grounds: performance of a contract or steps requested before entering one; consent; compliance with law; protection of legitimate interests such as service security, product operation, fraud prevention, and business communications; or another ground permitted by applicable law. Where processing is based on consent, consent may be withdrawn, subject to lawful limitations.

05 AI-assisted processing

Strover uses machine learning, language models, retrieval, structured memory, and policy logic to analyze authorized data and generate summaries, risk explanations, recommended actions, and related outputs. These outputs can be incomplete or incorrect and are intended to support—not replace—authorized human judgment.

• Customer Content is processed only for the service and purposes authorized by the customer and applicable agreement.
• Strover does not sell Customer Content or use it to train public or general-purpose AI models unless the customer expressly agrees in writing.
• Where third-party AI providers are used, Strover applies contractual and technical safeguards appropriate to the processing and configuration.
• Customers determine whether and how recommendations are approved or executed in their environments.

06 How we disclose personal data

We do not sell personal data. We may disclose it only as reasonably necessary:

• To authorized Strover personnel and group entities with a legitimate need to know.
• To vetted providers supporting cloud hosting, security, communications, analytics, support, payments, professional services, and AI capabilities.
• To customer-authorized integrations, partners, resellers, or advisors.
• To auditors, insurers, lawyers, accountants, and other professional advisers under confidentiality obligations.
• To government authorities or other parties when legally required, or to protect rights, safety, systems, customers, or the public.
• In connection with financing, reorganization, merger, acquisition, or sale, subject to appropriate confidentiality and legal safeguards.

07 Cookies and analytics

We may use essential cookies for authentication, security, preferences, and service operation. We may also use analytics or similar technologies to understand website and product usage. Where required, non-essential cookies are used only with consent. Browser controls may block cookies, but some functions may then be unavailable.

08 International processing

Strover and its providers may process data in India and other countries where we or they operate. Where required, we use contractual, organizational, and technical safeguards for cross-border transfers. Enterprise customers may request details relevant to their deployment and agreement.

09 Data retention and deletion

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, the customer’s instructions, the applicable agreement, security and audit requirements, dispute resolution, and legal obligations. Retention periods vary by data type, account status, contract, and applicable law. When retention is no longer required, data is deleted, anonymized, or securely isolated from routine use, subject to backup cycles and lawful preservation requirements.

10 Security

We use administrative, technical, and organizational safeguards designed to protect data against unauthorized access, loss, misuse, alteration, or disclosure. These include measures such as access controls, encryption, logging, vulnerability management, secure development, and incident response, as appropriate. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11 Your choices and rights

Depending on applicable law, you may have rights to request access, correction, completion, deletion or erasure, restriction, objection, portability, withdrawal of consent, grievance redressal, or nomination of another person to exercise rights. You may also opt out of marketing communications.

Requests can be sent to Hello@strover.ai. We may verify identity and authority, and we may retain information necessary to document the request. If your data is part of Customer Content, contact the relevant customer first; we will support the customer as required by contract and law.

12 Children’s privacy

Strover’s services are designed for businesses and are not directed to children. We do not knowingly collect personal data directly from children through the platform or website. If you believe a child has provided personal data without appropriate authorization, contact us so we can assess and take appropriate action.

13 Third-party links and services

Our services may link to or integrate with third-party products. Their processing is governed by their own terms and privacy notices, except where they act as our contracted service providers.

14 Changes to this Policy

We may update this Policy to reflect changes in law, technology, services, or business practices. We will post the updated version with a new effective date and provide additional notice when required. Material changes do not retroactively reduce customer rights under an existing written agreement.