1. What this policy covers
This policy covers the website www.k-stra.com, the K-Stra application at www.k-stra.com/a/, its API and MCP server, and the emails we send. It applies to visitors, to the people who use K-Stra on behalf of their organisation, and to people who receive reports or invitations from K-Stra users.
2. Visiting the website
The website sets no cookies, stores nothing in your browser, runs no analytics or advertising scripts and loads nothing from third parties: fonts and images are served from our own server. Like every web server, ours receives your IP address and browser type with each request. We use them to deliver and protect the site and, on our own server, to count visits. For each page served to a browser we record the date, the page, the domain of the website that linked to it, any campaign label in the link and the country derived from the IP address. We also record a short code calculated from your IP address and browser with a key that changes every day and is never stored. The code lets us count distinct visitors in a day. It cannot be linked to you, or to your visits on another day. Your IP address and browser type are not stored. Visits from browsers that send a Do Not Track or Global Privacy Control signal are not counted. If you write to us by email or with the contact form, we use your name, email address, company and message only to answer. The form sends your message from our server to our mailbox through our email delivery provider; the website itself keeps nothing you write, and the IP address is used only to limit repeated messages and is not stored.
3. Using the app
When you use K-Stra we process the following information.
- Account: email address, first and last name, language, display currency, profile photo if you add one, the sign-in method (password, Google or Microsoft) and, for password accounts, a one-way hash of the password. With Google or Microsoft sign-in we receive your name, email and photo from that provider.
- Sign-in and security: one-time codes and links (stored only as hashes), session cookies, successful and refused sign-ins with IP address and browser, and administrative events such as invitations, role changes and API keys.
- Acceptance of our terms: when you accept the terms of use and sale, this policy or the customer data terms, we record your user and organisation identifiers, the company name and your email at that moment, the date and time, the version and a fingerprint of its exact text, the way you accepted and a hash of your IP address.
- Organisation and billing: company name, tax number and, for Australia and New Zealand, GST registration, billing email and address, and the payments made. Card details are handled by Stripe and never reach us.
- Use of the service: the analyses you run with their settings (areas, coordinates, parameters), their results and versions, reports, sharing settings including the email addresses of people you share with, credit movements and the activity log of each action.
- Where you came from: the page of our website, or the campaign label in the link, that first brought you to the app. It is recorded on your session and, if you sign up, on your account and on the actions you run, so that we can tell which pages and campaigns are useful.
- AI assistant: the text of your questions and of the answers, the actions taken, and whether an image of the map was attached.
- Support and communications: messages you send through the in-app support form (delivered to our support mailbox), and your choice about product updates.
- Exploring without an account: a session identified only by a hash of your IP address and browser, never linked to a person; anything uploaded in such a session is deleted after one day.
- Country: the country is derived from the IP address on our server, without storing it, to show prices in your currency.
If you receive a report or an invitation from a K-Stra user, we process your email address to deliver it and to record whether you unsubscribed. A shared report shows its readers the name of the person who created it.
4. Files you upload
K-Stra is not designed to process personal information contained in the files customers upload, and our terms require customers to remove or anonymise it before uploading and never to upload sensitive information. We do not use uploaded files for any purpose other than providing the service to the organisation that uploaded them. If a file nevertheless contains personal information, the uploading organisation is responsible for it and our customer data terms apply.
5. Why we use information, and on what basis
| Purpose | Basis (GDPR) |
|---|---|
| Creating and running your account, providing analyses, reports, sharing, the assistant and support | Performance of the contract |
| Billing, invoices and tax records | Contract and legal obligation |
| Security: sign-in codes, logs, fraud and abuse prevention (including limits on welcome credits) | Legitimate interest in protecting the service and its users |
| Assistance and service statistics from the activity log, read by the K-Stra administrator | Legitimate interest in running and improving the service |
| Visit statistics for the website, and which pages and campaigns bring people to the app | Legitimate interest in understanding which content is useful |
| Keeping proof of the terms you accepted | Legitimate interest in establishing, exercising and defending legal claims |
| Product updates and commercial emails | Consent, which you can withdraw at any time |
| Contacting people in their professional role about K-Stra, for example on LinkedIn, and keeping a record of those conversations | Legitimate interest in offering K-Stra to businesses |
Business contacts. When we look for organisations that could use K-Stra, we may write to people in their professional role, mainly through LinkedIn. We use only what they publish there — name, role, organisation and profile link — and keep a record of our messages and their replies. We do not buy contact lists. Anyone can ask us to stop at any time by replying to our message or writing to info@k-stra.com: we then stop contacting them and delete the record, keeping only what we need to make sure we don't write again.
We collect personal information only when it is reasonably necessary for these purposes. We do not sell personal information, do not use it for advertising and do not make decisions about you based solely on automated processing.
6. How long we keep it
| Information | Kept for |
|---|---|
| Account, organisation, analyses, reports, and where you first came from | Until you delete them or close the account |
| Sign-ins and refused sign-ins | 365 days |
| Activity log of actions | 365 days |
| Administrative events and background jobs | 24 months |
| Website visit statistics | 24 months |
| AI assistant requests and answers | 180 days |
| Webhook deliveries and API enrichment results | 30 days |
| Expired sign-in codes and links | 7 days after expiry |
| Exploration without an account, and its uploads | 1 day |
| Datasets marked “session only” | 24 hours after upload |
| Hash of the IP address that created an organisation | 30 days |
| Server logs (email addresses masked) | Rotated, at most 14 archives |
| Backups | Overwritten as they rotate, about four months |
| Invoices and payment records | As long as tax law requires |
| Proof of acceptance of the terms, this policy and the customer data terms (only the details listed in section 3) | 7 years after the account or the organisation is closed, kept apart from everything else — about one year beyond the usual six-year limitation period for contract claims in Australia |
| Business contacts and our conversations with them | Up to 24 months after the last exchange, unless the person becomes a customer or asks us to stop |
| Unsubscribe list | Kept after account closure, so that we never write to you again |
7. Who receives it
Personal information is accessed only by the K-Stra administrator and by the providers that run parts of the service for us, under contract and only for that purpose. They are listed with what they receive on the sub-processors page: OVHcloud (hosting and backups in Sydney), Stripe (payments), Brevo (email), Google and Microsoft (sign-in, if you choose them), Google Gemini (the AI assistant, through Google’s paid API, under which content is not used to improve Google’s products), Mapbox (map tiles and, on your confirmation, geocoding of addresses) and the public tax registers that check business numbers. We may disclose information when the law requires it.
8. Who we are
K-Stra is provided by the business whose details you can request by email, the controller of the personal information described here (the “APP entity” for the Australian Privacy Act 1988). For any privacy matter write to info@k-stra.com. We have not appointed a data protection officer.
9. Where it is stored and transfers abroad
K-Stra runs on a dedicated server in Sydney, Australia, hosted by OVHcloud in its SYD03 data centre; the backups are stored in Sydney too. No copy of the database is kept outside Australia. Some providers listed above are based in the United States or in the European Union and receive the information described on the sub-processors page.
If you are in the European Union, your information is stored in Australia and may reach the United States through those providers. Where no adequacy decision applies, these transfers rely on the European Commission’s standard contractual clauses offered by the providers. Under the Australian Privacy Principles, we take reasonable steps to ensure overseas recipients handle the information consistently with them.
10. Security
We protect information with access controls, isolation between organisations, hashed passwords, one-time codes at every password sign-in, encrypted connections and regular backups. The measures are described on the security page. If a data breach is likely to result in serious harm, we notify you and the competent authority as the law requires.
11. Your rights
You can see and correct your account details in the app, withdraw consent to product updates from your account or from any email, and close your account. You can also ask us to access, correct, delete, restrict or export your information, or object to its processing based on legitimate interest, by writing to info@k-stra.com. We answer within 30 days. Closing an account removes your email and access; a full deletion of what you created is done on request. The proof of acceptance described in section 6 is the exception: it is kept for seven years after closure, because it may be needed to establish or defend a legal claim.
12. Questions and complaints
Write first to info@k-stra.com: we answer within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the European Union, to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority of the country where you live.
13. Changes to this policy
We update this policy when the service or the providers change. The version and effective date are shown at the top; we email account owners before material changes take effect.
Provider details: write toinfo@k-stra.com