1. Who is responsible
Stack Technology GmbH, Zollergasse 7/1/5, 1070 Wien, Austria, is the data controller for personal data used to operate the STRG website, accounts, billing, security, support and business relationships.
Contact us at . If a data protection officer is appointed or legally required, current contact details will be published here.
2. Scope and our roles
This policy applies to STRG websites, accounts, applications, sales, support and cloud storage services. It does not replace a customer’s own privacy notice for personal data that customer places in STRG buckets.
For personal data contained in Customer Data, the customer generally acts as controller and instructs Stack Technology GmbH as processor. We process that data to provide, secure and support the service under our Terms, any applicable data processing agreement, and the customer’s instructions.
3. Personal data we collect
We collect data you provide, data generated through use of STRG, and limited data from the organization that gives you access or from service providers involved in the transaction.
- Account and identity: name, email address, organization, role, account identifiers and authentication details.
- Billing and transaction: billing contact, address, tax information, plan, usage, invoices, payment status and limited payment-method details received from a payment provider.
- Service and device: IP address, browser and device information, timestamps, pages or features used, region, request metadata and diagnostic events.
- Security and API logs: sign-ins, access-key activity, administrative actions, permissions, API requests, errors and indicators of misuse.
- Communications: support requests, sales inquiries, feedback and other messages.
- AI interactions: prompts, responses, tool calls, approvals and action logs when you use the STRG Assistant, MCP server or related agent features.
4. Why we use personal data
- Provide the service and perform our contract: create accounts, authenticate users, store objects, execute instructions, meter usage, bill accounts and provide support.
- Protect legitimate interests: secure STRG, prevent fraud and abuse, diagnose faults, improve reliability, understand service use and communicate with business customers. We balance these interests against your rights.
- Meet legal obligations: keep accounting records, respond to lawful requests, enforce legal claims and comply with tax, sanctions and other applicable rules.
- Use consent where required: for optional marketing, non-essential cookies or another purpose presented when consent is requested. You may withdraw consent at any time.
We do not use Customer Data, prompts or assistant conversations to train general-purpose AI models.
5. AI and automated actions
When you use an AI feature, we process the prompt, relevant account context, selected Customer Data and tool results to respond or carry out an authorized action. We log actions and approvals for security, support and audit purposes. AI providers acting for us may process this information only to deliver the feature under contract.
STRG’s AI features assist users and execute their instructions; they are not intended to make legal or similarly significant decisions about individuals solely by automated means.
8. Storage regions and international transfers
Customer objects are stored in the region selected for the bucket, subject to replication or transfers the customer configures. Account data, billing records, support communications, security logs and service metadata may be processed outside the selected storage region.
Where personal data is transferred from the EEA to a country without an adequacy decision, we use an approved transfer mechanism such as the European Commission’s Standard Contractual Clauses and apply supplementary safeguards where appropriate.
9. How long we keep data
We retain personal data only as long as needed for the purposes above. Account and contract records are generally kept for the account term and then for the period needed to resolve disputes and enforce claims. Invoices and records subject to Austrian accounting or tax retention duties are generally kept for seven years, or longer when a proceeding requires it.
Security and diagnostic logs are kept for a limited period based on their sensitivity and operational need. Support and sales communications are deleted or anonymized when no longer needed for the relationship. After account closure, Customer Data is deleted through the service’s normal deletion and backup lifecycle, subject to legal holds and written agreements.
10. Your privacy rights
Subject to applicable law, you may request access to, correction or deletion of your personal data; restriction of processing; data portability; or information about processing. You may object to processing based on legitimate interests and withdraw consent at any time without affecting earlier lawful processing.
Send a request to . We may verify your identity and ask for information needed to locate the data. If your request concerns data controlled by a STRG customer, contact that customer first; we will assist it as required.
11. Complaints
You may lodge a complaint with the Austrian Data Protection Authority (Österreichische Datenschutzbehörde) or the supervisory authority where you live or work, or where you believe an infringement occurred. We invite you to contact us first so we can try to resolve the issue.
12. Security
We use technical and organizational measures designed to protect personal data, including encryption in transit, encryption of stored object data, access controls, scoped credentials, logging, monitoring and incident procedures. No service can guarantee absolute security. You are responsible for configuring account permissions, protecting access keys and maintaining any backups your workload requires.
13. Children
STRG is not directed to children. You must be at least 18 years old to create an account. If you believe a child provided personal data to us, contact .
14. Changes to this policy
We may update this policy when our services, providers or legal obligations change. We will post the new version here, change the date above and provide additional notice if a change materially affects how we use personal data.
15. Contact
Privacy questions and rights requests can be sent to or Stack Technology GmbH, Zollergasse 7/1/5, 1070 Wien, Austria.