01Two roles, two datasets
For account holders and users (name, email, login and usage data) Stretto is the controller. For the customer records you store (contacts, companies, tickets, email content) you are the controller and Stretto is your processor, under the Data Processing Agreement.
This policy covers both. Where they differ, the section says so.
02What we collect about you
Name, email, password hash, role and account membership. Device and usage information: IP address, browser, pages used, actions taken, needed for security, support and to make the product better. Billing details are held by our payment provider; we see the last four digits and the invoice history.
03What you store about your customers
Whatever your team enters or imports: contact details, company data, notes, email content, tracking events from your website and custom properties. You decide what to collect and must have a lawful basis for it. We provide the tools to help you honour your customers' rights: consent properties, suppression lists, export and deletion.
04Why we process it
To run the service you signed up for; to keep it secure and stop abuse; to bill you; to answer support; to send operational email such as invites, password resets and incident notices. Marketing email to you is opt-in and easy to leave.
05AI processing
When a user asks the assistant, the relevant records they may see are sent to our model provider to produce the answer, then discarded. Prompts and outputs are not used to train any model, ours or theirs. The provider is listed among sub-processors.
06Where data lives
In the region chosen at account creation, the EU (Frankfurt) or Brazil (São Paulo), including backups. Support staff access from outside the region only with your request, and it is logged.
07Who else sees it
Sub-processors that host, deliver email, run the AI model and track errors, each under a contract that binds them to this policy. The current list is in the DPA; owners are emailed 30 days before a new one is added. We do not sell data and we do not share it with advertisers.
We disclose data to authorities only when legally compelled, and we tell you unless the law forbids it.
08Cookies and tracking
stretto.app uses a session cookie and a preference cookie; no third-party advertising cookies. The website tracking snippet you may install on your own site sets a first-party cookie under your domain, after your consent banner permits it, and reports to your account only.
09How long we keep it
User and customer data: while the account exists; deleted when it is cancelled. Invoices are kept for the period tax law requires. Logs: 12 months.
10Your rights
Access, correction, export, deletion and objection, under the GDPR and the LGPD. Users exercise them from settings or by writing to privacy@stretto.app. Your customers exercise them with you; we help you respond within the legal deadlines.
You may complain to your data-protection authority: the CNPD in Portugal or the ANPD in Brazil.
11Contact
Data protection officer: dpo@stretto.app. Stretto Software Lda., Lisbon, Portugal · Stretto Tecnologia Ltda., São Paulo, Brazil.
Questions about this document: legal@stretto.app. Earlier versions are available on request.