Privacy Policy - StratoNext

StratoNext, Inc. ("StratoNext," "we," "us," or "our") provides infrastructure that gives AI agents governed access to production systems. This Privacy Policy explains how we collect, use, share, and protect personal information when you visit stratonext.com or use the StratoNext platform (together, the "Services").

This Policy does not apply to third-party websites or services we link to, or to the cloud environments you connect to the Services, which remain under your control.

1. Two roles: our data and your data

It matters which kind of data we are talking about.

Information we control. Account details, billing information, support correspondence, and website usage. We act as the business or controller for this information, and this Policy describes how we handle it.
Customer Data. The infrastructure metadata, logs, configurations, runbooks, and other content you or AI Agents submit to the Services, or that we collect from environments you connect. We process Customer Data on your behalf and under your instructions, as a service provider or processor. If Customer Data contains personal information, your own privacy notice governs how it may be used, and we handle it under our agreement with you.

2. Information we collect

Information you provide to us:

Account and contact information such as name, work email address, company name, and job title, including when you apply for early access or book a demo.
Communications you send us, including support requests, feedback, and email.
Billing information if you purchase paid Services. Payment card details are handled by our payment processor; we do not store full card numbers.
Integration credentials and configuration you supply so the Services can connect to your cloud accounts and systems. See Section 6.

Information we collect automatically:

Usage data such as pages viewed, features used, actions taken in the platform, timestamps, and referring URLs.
Device and connection data such as IP address, browser type, operating system, and language.
Audit records of operations performed through the Services, including which identity requested access, what was granted, and what was executed. These records exist so that agent activity is accountable, and they may include the identity of the person who approved an action.
Cookies and similar technologies. See Section 4.

Information from third parties:

Identity providers and single sign-on services you use to authenticate.
Analytics and marketing providers, and publicly available business sources.

3. How we use information

To provide, operate, maintain, and improve the Services.
To authenticate users and agents, evaluate access requests, and execute approved operations.
To maintain security, detect and prevent fraud and abuse, and investigate incidents.
To provide support and respond to your requests.
To communicate with you about the Services, including updates, security notices, and administrative messages.
To send marketing communications where permitted. You can opt out at any time using the unsubscribe link or by emailing us.
To analyze usage and develop new features. We use aggregated or de-identified data for this purpose where we can.
To comply with legal obligations and enforce our Terms of Service.

We do not use Customer Data to train generally available machine learning models.

4. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the Services are used.

Our website uses Google Analytics, which sets cookies and collects usage and device information on our behalf. You can learn more at Google's partner sites notice and opt out using the Google Analytics opt-out browser add-on .

Most browsers let you refuse or delete cookies. Blocking some cookies may affect how the Services function. We currently do not respond to browser Do Not Track signals, but we honor Global Privacy Control signals as an opt-out of sharing where applicable law requires it.

5. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose information only as follows:

Service providers and subprocessors that host our infrastructure, process payments, send email, provide analytics, and supply model inference, under contracts limiting their use of the information to providing those services. We can provide a current subprocessor list on request.
Within your organization. Administrators of your workspace can see account and activity information for users and agents in that workspace, including audit records.
At your direction, including integrations you enable.
Legal and safety, when we believe disclosure is required by law or legal process, or is necessary to protect the rights, property, or safety of StratoNext, our users, or the public. Where permitted, we will notify you first.
Business transfers, in connection with a merger, acquisition, financing, or sale of assets. This Policy will continue to apply to the transferred information until it is replaced.
Aggregated or de-identified data that cannot reasonably identify you.

6. Credentials and access to your environments

The Services are built so that agents receive narrowly scoped, time-limited access rather than standing credentials. Where we hold credentials or secrets you provide to enable a connection, we encrypt them in transit and at rest, restrict access to personnel who need it to operate the Services, and use them only to perform operations you or your policies authorize.

You control which environments are connected and can revoke that access at any time from the platform or by removing our access at the provider.

7. Data retention

We keep personal information for as long as needed for the purposes described in this Policy, and afterward as required to comply with legal obligations, resolve disputes, and enforce our agreements. Audit records are retained longer than other operational data because their purpose is accountability. Retention periods for Customer Data are governed by your agreement with us. When information is no longer needed, we delete or de-identify it.

8. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, least-privilege practices, and logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Report a suspected vulnerability or incident to security@stratonext.com.

9. Your choices

Account information. You can review and update your account details in the platform or by contacting us.
Marketing email. Unsubscribe using the link in any marketing message. We will still send service and security notices.
Cookies. Manage them through your browser, or use the Google Analytics opt-out described in Section 4.

10. U.S. state privacy rights

Depending on where you live, you may have the right to:

know or access the personal information we hold about you;
request deletion of your personal information, subject to exceptions;
correct inaccurate personal information;
obtain a portable copy of information you provided to us;
opt out of the sale or sharing of personal information, and of profiling with legal or similarly significant effects; and
not be discriminated against for exercising any of these rights.

California residents. Under the California Consumer Privacy Act as amended, in the past 12 months we have collected the following categories of personal information: identifiers; commercial information; internet or other electronic network activity; professional or employment-related information; and inferences drawn from the above. We collect these from you, automatically through the Services, and from third parties as described in Section 2, and use and disclose them for the purposes in Sections 3 and 5. We do not sell or share personal information, and we do not knowingly collect or sell the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes requiring a right to limit.

Residents of other states, including Colorado, Connecticut, Virginia, Texas, Oregon, and Utah, have similar rights under their state laws, including a right to appeal a denied request.

How to exercise your rights. Email support@stratonext.com. We will verify your identity before responding, usually by confirming control of the email address associated with your information. An authorized agent may submit a request on your behalf with proof of authorization. If we deny your request you may appeal by replying to our response with the word "Appeal."

If your personal information appears in Customer Data controlled by one of our customers, direct your request to that customer. We will assist them in responding.

11. Children's privacy

The Services are for business use and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

12. International users

We are based in the United States and process information there. Privacy laws in the United States may differ from those where you live. If you access the Services from outside the United States, you understand that your information will be transferred to and processed in the United States.

13. Changes to this Policy

We may update this Policy from time to time. We will revise the date at the top and, if changes are material, provide additional notice through the Services or by email. Continued use of the Services after the effective date means you accept the updated Policy.

14. Contact us

StratoNext, Inc.
Delaware, United States
support@stratonext.com