Privacy Policy

What we collect

We collect only what the service needs:

• Account: your email address, your name, and the identifier Apple or Google gives us if you sign in with them. We don't use passwords.
• Your profile: what you choose to add, such as your title, company, career history, city, education and your digital card settings.
• People you save: names, companies and titles, and the details you add: phone numbers, email addresses, birthdays, notes, how you met and who introduced you. Phone numbers, email addresses and notes are encrypted before they're stored.
• Your activity in Strazu: tasks and promises, reminders, meetings you log and their notes, events and trips (city level only), and the messages you send to the assistant. Meeting notes and assistant messages are encrypted.
• Connected calendars: if you connect Google Calendar or Microsoft Outlook (Pro), the events of the calendars you choose and their attendees, as described under “Connected calendars” below.
• Imports: when you import your LinkedIn data or phone contacts, the files are read on your device or in memory and discarded. We keep only the people and fields you choose to keep. Business card photos are read on your phone and never uploaded.
• Links you share: when you share a job link, our server reads the title and short description of that one public page to find the company and role. Nothing else from the page is kept. When you share a LinkedIn profile of someone who isn't in your import or your People yet, the Strazu app on your phone reads that profile's public preview (name, headline, company, city) to fill in the form; this request goes from your phone, not our servers, and only what you save reaches us.
• Subscription: whether you have Pro, the plan and its renewal dates, as reported by the App Store and Google Play. We never see your card details.
• Device and technical data: push notification tokens, app version, language, time zone, and logs that keep the service secure and working. When you sign in on the web with your phone, the browser, system and approximate city of that computer are shown on your phone and kept for an hour.
• Messages to support: what you write to us, with the device and app version attached when you write from the app.

How we use it

We use your information to:

• provide Strazu: store your people and notes, answer your questions, write drafts and send the reminders and summaries you asked for;
• keep your account secure, prevent abuse and fix problems;
• manage your subscription, gifts and referral rewards;
• send service emails (sign-in links, the morning summary you can turn off, important changes);
• understand overall use in aggregate (for example how many people use a feature), never by reading your notes or contacts.

We don't sell your data, we don't show ads and we don't use your notes or contacts to train AI models.

The AI assistant

When you use the assistant (including meeting briefs, tidying meeting notes into notes and tasks, message drafts, job-post lookups and questions about your network), the text you write or share and the parts of your Strazu data the answer needs (names, companies and titles of the people involved, and your notes and meetings with them) are sent to Anthropic, PBC in the United States, the maker of the Claude AI model, to produce the answer. The app asks for your permission before anything is sent for the first time; you can withdraw it at any time in Account, and without it the AI features don't run. Anthropic processes this data only on our behalf, under a contract that doesn't allow it to train its models on your data and that requires the same level of protection as this policy.

The assistant can only propose changes. It shows you what it will save before saving, every change can be undone, and it never sends messages to anyone. Drafts open in your own messaging or mail app.

Assistant messages are kept for 90 days so you can see your history, then deleted automatically. You can clear the history earlier.

If you connect another assistant to Strazu (for example Claude or ChatGPT, through Strazu MCP), that app can read your Strazu data when you ask it to, and with Pro add notes, tasks and meetings. What it receives is then handled under that provider's own terms. Connected apps can't delete anything or change your account, and you can remove their access at any time in Account.

When you ask the AI to tidy a meeting's notes, it receives what you wrote together with the meeting's title, date and place and the names and titles of the people in it. It returns tidied notes and suggested tasks; nothing is saved until you approve it, and your original notes are kept as you wrote them.

Connected calendars

With Pro you can connect a Google Calendar or Microsoft Outlook account in Account › Connections. Strazu only reads it: it never creates, changes or deletes events, and it never reads your email.

From the calendars you choose, Strazu reads events from 30 days back to 180 days ahead: title, time, place, whether it's an online meeting, your response, and the attendees' names and email addresses. Titles and places are encrypted before they're stored. Attendees' email addresses are kept only as a one-way fingerprint, used to recognise people you've already saved; names, and a company name taken from a work email domain, are kept so that attendees you don't know yet can appear in your network index. We keep the access token Google or Microsoft gives us, encrypted, and use it only to read your calendar.

We use this to show your meetings in the agenda, link them to the people you've saved, and turn meetings that have ended into meetings waiting for your notes. Notes about people you write on a meeting stay on that meeting; they aren't copied to anyone's card.

Turning a calendar off removes its events from Strazu. Disconnecting an account also revokes our access with Google or Microsoft and deletes its calendars, events, attendees and tokens, and the people it added to your network index that you haven't saved; meetings you've already logged, their notes and tasks stay. You can also remove Strazu's access in your Google or Microsoft account settings at any time.

Strazu's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, calendar data is used only to provide the features described here; it isn't sold, used for advertising or used to train AI models, and no one at Strazu reads it unless you ask us to, it's needed for security or the law requires it. The same rules apply to data from Microsoft.

Separately, if you turn on the calendar link in Account, your calendar app (for example Google Calendar or Outlook) fetches your meetings, tasks with a date and contacts' birthdays from a private address: names and titles only, never notes. Turning it off or making a new link stops the old address.

Information about other people

The people you save in Strazu are private to you. We don't contact them, we don't build profiles of them across accounts, and other users can't see what you saved about them.

If someone you saved also uses Strazu, their own profile (for example a new job title) can update the card you keep for them, only when they choose to share it. Your notes about them are never shared.

Please only save information you're entitled to keep, and keep it accurate.

Legal bases

Where data protection laws such as the GDPR, Brazil's LGPD or Türkiye's KVKK apply, we rely on: performing our contract with you (providing the service); our legitimate interests (security, fixing problems, aggregate statistics, and processing the details of the people you save so the service works); legal obligations (tax and accounting records); and your consent where we ask for it (for example notifications, or access to your contacts, calendar or camera, which you can withdraw in your device settings).

Who processes it

We use carefully chosen service providers to run Strazu. They process data only on our instructions and under contracts that protect it. They fall into these categories: hosting and database, AI, email delivery, push notifications, error monitoring, and subscription management. If you want to know who they are, write to privacy@strazu.com.

We disclose information to authorities only when the law requires it, and we push back on requests that are too broad.

Where it's stored

Your Strazu database is hosted in the European Union. Some providers, such as our AI, email and hosting providers, process data in the United States or other countries. Where that happens we rely on appropriate safeguards such as the EU Standard Contractual Clauses and, for Türkiye, the standard contracts and procedures required by the KVKK.

How long we keep it

• Your account data: for as long as you have an account.
• Assistant messages: 90 days.
• Calendar events and access tokens from a connected calendar: while it's connected; deleted when you turn the calendar off or disconnect the account.
• Read notifications: 180 days.
• Support messages: until a year after they're closed.
• Imported files and business card photos: not kept at all.
• After you delete your account: your data is deleted. Encrypted backups are overwritten within 30 days. Records we must keep by law (for example invoices from stores) are kept for the legally required period.

Security

Data is encrypted in transit. Free-text notes and contact details are additionally encrypted before they're stored. Access to production systems is limited to the people who run Strazu, and our admin tools are built so that they never show your contacts, notes or assistant messages.

No system is perfectly secure. If a breach affects you, we'll tell you and the relevant authorities as the law requires.

Your rights

You can see, correct and export your data in the app, and delete your account from Account › Delete account. Depending on where you live you also have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent. Users in Brazil have the rights in Article 18 of the LGPD; users in Türkiye, those in Article 11 of the KVKK.

To use these rights, write to privacy@strazu.com. We answer within 30 days. You can also complain to your data protection authority (in Türkiye, the Personal Data Protection Authority).

If you're in the EEA, the UK or Switzerland

The GDPR (and the UK GDPR) applies to how we handle your data. Strazu is the controller. The legal bases, the providers' categories, transfers outside your country, how long we keep data and your rights are described above.

You can access, correct, export or delete your data, restrict or object to processing, and withdraw consent at any time, by writing to privacy@strazu.com. You also have the right to complain to the data protection authority where you live or work.

Children

Strazu is not meant for anyone under 16, and we don't knowingly collect their data. If you think a child has an account, tell us and we'll delete it.

Changes

If we change this policy in a meaningful way, we'll tell you in the app or by email before the change applies. The date at the top shows the latest version.

Contact

Strazu · privacy@strazu.com