Privacy Policy

1. What we collect from connected platform accounts

When an account holder connects a platform account to a Strata workspace, we retrieve the following through that platform’s official API, within the permission scopes approved at the time of the connection:

• Profile information. Username or handle, platform account ID, display name, profile picture, biography, and follower and following counts.
• Post and media metadata. Post ID, permalink, media type, thumbnail, caption or title, duration, and publication time.
• Engagement metrics. Impressions, reach, views, likes, comments, shares, saves, and watch time.
• Audience-country breakdowns. The aggregate statistics the platform reports about the connected account’s followers, most often a breakdown by country, and where the platform provides it by age range and gender.

Audience breakdowns are percentages and counts across an audience. We do not receive the identity, contact details, or individual location of any follower.

We refresh this data on a schedule so that the analytics in the workspace stay current.

2. We never collect or store passwords or credentials

Strata never asks for, receives, or stores the password or login credentials of any connected platform account. Connections are made through the platform’s own OAuth flow, where you authenticate on the platform and approve the requested permissions there.

What we receive back is an access token scoped to the permissions you approved, encrypted at rest and never exposed to the browser.

3. Why we collect it

We collect data from a connected account for one purpose: to provide analytics to the organization that connected it. In practice that means showing performance and audience insight about the artist to the label or management company that represents them.

Connected-account data is scoped to the workspace that created the connection. No other organization on Strata can see it.

4. Other information we collect

• Account information. Your name, email address, avatar, role, and workspace memberships.
• Content you upload. Audio, artwork, video, documents, and the metadata you record against them.
• Security logs. Significant actions taken in a workspace, with the IP address and browser user-agent of the request.

We do not use advertising or cross-site tracking cookies. Our cookies keep you signed in and remember interface preferences.

5. Other sources of artist data

Some analytics in Strata come from licensed data providers rather than from connected accounts. That data is handled under this policy on the same terms.

6. How we share information

We do not sell personal data, and we do not share it for advertising.

We do not use connected-account data to train models that serve other customers, and we do not provide it to third parties for model training.

We disclose information only:

• to the organization that connected the account, and to the users it has authorized;
• to service providers who operate the platform under contract and on our instructions, including hosting, storage, authentication, and email;
• where required by law, or to protect the safety and security of users, the public, or Strata.

7. Retention and deletion on disconnection

We keep data from a connected account for as long as the connection is active.

When a connection is removed, we delete the token immediately, stop retrieving data for that account, and delete the profile information, post metadata, engagement metrics, and audience breakdowns we obtained through it.

Workspace content and account records are kept while the organization’s account is active and deleted after it ends. We may retain the minimum data needed to meet a legal obligation.

8. Revoking access

You can disconnect a platform account at any time from Settings in your Strata workspace.

You can also revoke Strata’s access from the connected platform’s own app-permissions settings, without involving us.

Either route takes effect immediately, and we then delete the associated data as described above. If you cannot reach the workspace, email engineering@strata.green and we will disconnect it for you.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, and to withdraw consent. Residents of California and of the EU, EEA, and UK have these rights under the CCPA/CPRA and the GDPR.

Email engineering@strata.green to exercise them. Where a request concerns data we hold on behalf of an organization, we may need to refer it to that organization, and we will tell you if we do.

10. Security

Data is encrypted in transit and at rest. OAuth tokens are encrypted with dedicated keys and are never rendered to the browser. Access is scoped per workspace and per role, and privileged actions are recorded in an audit log.

11. Children

Strata is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16.

12. Changes to this policy

We may update this policy. We revise the date at the top when we do, and we give notice in the product before material changes take effect.

13. Contact us

For any privacy question, data access request, or deletion request, email engineering@strata.green.

Strata Green, Inc. See also our Terms of Service.