Privacy Policy

Last updated: February 2026

This Privacy Policy describes how Intel Core Strata (“we”, “us”) collects, uses, and protects personal information when you use our website and dashboard (the “Service”). It is written to satisfy the GDPR (EU/UK) and CCPA (California) baseline. If you have specific questions, contact [email protected].

1. Data we collect

• Account data: email address, hashed password, registration date.
• Subscription & billing metadata: Stripe customer ID, plan, subscription status. Card data is handled exclusively by Stripe; we never see it.
• Usage data: login timestamps, IP address (last login), user-agent string, session activity, calendar notes and journal entries you choose to save.
• Analytics: with your consent, anonymised product analytics via PostHog (page views, feature usage). IPs are anonymised and session recording is disabled.
• Campaign attribution: when you arrive via one of our tracked links (e.g. /go/… from a social post) or a link carrying UTM parameters, we record the click — timestamp, campaign source/medium/campaign, referrer URL, user-agent string, and a one-way hashed (truncated SHA-256) IP. We never store your raw IP address for attribution. The campaign source is kept in your browser’s localStorage (first- and last-touch) and, if you register, is saved with your account so we know which channel brought you. This is campaign metadata only — it is never used to profile you and is not shared with the social platforms.

2. How we use it

• To provide, secure, and improve the Service;
• To process your subscription and send transactional emails;
• To detect abuse and enforce our Terms of Service;
• To meet legal, tax, and accounting obligations.

3. Legal bases (GDPR)

We rely on (a) contract for account and subscription processing, (b) legitimate interest for security and fraud prevention, (c) consent for analytics and non-essential cookies, and (d) legal obligation for tax records.

4. Sharing

We share data only with vetted processors needed to run the Service:

• Stripe (payments, billing portal, tax calculation)
• Railway (cloud hosting)
• MongoDB Atlas (database)
• PostHog (anonymised product analytics — only after consent)
• Sentry (error tracking — request scope only, no PII)

We do not sell or rent personal data. We may disclose data when legally required (court order, regulatory request).

5. Retention

• Account & profile: until you delete your account.
• Calendar notes & journal entries: until you delete them or your account.
• Login IP / user-agent: rolling 30 days.
• Campaign click events (hashed IP, referrer, user-agent): auto-deleted after 180 days.
• Acquisition source on your account (first/last touch): until you delete your account.
• Stripe records: retained by Stripe per their policies and tax law (typically 7 years).
• Sentry events: 30 days.
• Server logs: 30 days.

6. Your rights

You have the right to:

• Access & portability: request a machine-readable export via GET /api/auth/export-data (Settings → Export).
• Erasure: delete your account and content via Settings → Delete Account.
• Rectification: update inaccurate information in your profile.
• Withdraw consent: revoke analytics consent via the cookie banner at any time.
• Lodge a complaint: contact your local data-protection authority.

7. Security

We use TLS-encrypted transport, bcrypt-hashed passwords, JWT access tokens, role-based access control on admin endpoints, automatic backups, and Sentry-monitored exception tracking. No system is perfectly secure; please use a strong, unique password.

8. International transfers

Your data is processed in the United States and the European Union. Where data is transferred outside the EEA, we rely on Standard Contractual Clauses with our sub-processors.

9. Children

The Service is not directed to children under 18. We do not knowingly collect personal data from minors.

10. Contact

Questions or requests? Email [email protected].