Privacy policy

1. What this policy covers

This policy covers the website www.k-stra.com, the K-Stra application at www.k-stra.com/a/, its API and MCP server, and the emails we send. It applies to visitors, to the people who use K-Stra on behalf of their organisation, and to people who receive reports or invitations from K-Stra users.

2. Visiting the website

The website sets no cookies, stores nothing in your browser, runs no analytics or advertising scripts and loads nothing from third parties: fonts and images are served from our own server. Like every web server, ours receives your IP address and browser type with each request. We use them to deliver and protect the site and, on our own server, to count visits. For each page served to a browser we record the date, the page, the domain of the website that linked to it, any campaign label in the link and the country derived from the IP address. We also record a short code calculated from your IP address and browser with a key that changes every day and is never stored. The code lets us count distinct visitors in a day. It cannot be linked to you, or to your visits on another day. Your IP address and browser type are not stored. Visits from browsers that send a Do Not Track or Global Privacy Control signal are not counted. If you write to us by email or with the contact form, we use your name, email address, company and message only to answer. The form sends your message from our server to our mailbox through our email delivery provider; the website itself keeps nothing you write, and the IP address is used only to limit repeated messages and is not stored.

3. Using the app

When you use K-Stra we process the following information.

• Account: email address, first and last name, language, display currency, profile photo if you add one, the sign-in method (password, Google or Microsoft) and, for password accounts, a one-way hash of the password. With Google or Microsoft sign-in we receive your name, email and photo from that provider.
• Sign-in and security: one-time codes and links (stored only as hashes), session cookies, successful and refused sign-ins with IP address and browser, and administrative events such as invitations, role changes and API keys.
• Acceptance of our terms: when you accept the terms of use and sale, this policy or the customer data terms, we record your user and organisation identifiers, the company name and your email at that moment, the date and time, the version and a fingerprint of its exact text, the way you accepted and a hash of your IP address.
• Organisation and billing: company name, tax number and, for Australia and New Zealand, GST registration, billing email and address, and the payments made. Card details are handled by Stripe and never reach us.
• Use of the service: the analyses you run with their settings (areas, coordinates, parameters), their results and versions, reports, sharing settings including the email addresses of people you share with, credit movements and the activity log of each action.
• Where you came from: the page of our website, or the campaign label in the link, that first brought you to the app. It is recorded on your session and, if you sign up, on your account and on the actions you run, so that we can tell which pages and campaigns are useful.
• AI assistant: the text of your questions and of the answers, the actions taken, and whether an image of the map was attached.
• Support and communications: messages you send through the in-app support form (delivered to our support mailbox), and your choice about product updates.
• Exploring without an account: a session identified only by a hash of your IP address and browser, never linked to a person; anything uploaded in such a session is deleted after one day.
• Country: the country is derived from the IP address on our server, without storing it, to show prices in your currency.

If you receive a report or an invitation from a K-Stra user, we process your email address to deliver it and to record whether you unsubscribed. A shared report shows its readers the name of the person who created it.

4. Files you upload

K-Stra is not designed to process personal information contained in the files customers upload, and our terms require customers to remove or anonymise it before uploading and never to upload sensitive information. We do not use uploaded files for any purpose other than providing the service to the organisation that uploaded them. If a file nevertheless contains personal information, the uploading organisation is responsible for it and our customer data terms apply.

5. Why we use information, and on what basis

We collect personal information only when it is reasonably necessary for these purposes. We do not sell personal information, do not use it for advertising and do not make decisions about you based solely on automated processing.

6. How long we keep it

7. Who receives it

Personal information is accessed only by the K-Stra administrator and by the providers that run parts of the service for us, under contract and only for that purpose. They are listed with what they receive on the sub-processors page: OVHcloud (hosting and backups in Sydney), Stripe (payments), Brevo (email), Google and Microsoft (sign-in, if you choose them), Google Gemini (the AI assistant, through Google’s paid API, under which content is not used to improve Google’s products), Mapbox (map tiles and, on your confirmation, geocoding of addresses) and the public tax registers that check business numbers. We may disclose information when the law requires it.

8. Who we are

K-Stra is provided by the business whose details you can request by email, the controller of the personal information described here (the “APP entity” for the Australian Privacy Act 1988). For any privacy matter write to info@k-stra.com. We have not appointed a data protection officer.

9. Where it is stored and transfers abroad

K-Stra runs on a dedicated server in Sydney, Australia, hosted by OVHcloud in its SYD03 data centre; the backups are stored in Sydney too. No copy of the database is kept outside Australia. Some providers listed above are based in the United States or in the European Union and receive the information described on the sub-processors page.

If you are in the European Union, your information is stored in Australia and may reach the United States through those providers. Where no adequacy decision applies, these transfers rely on the European Commission’s standard contractual clauses offered by the providers. Under the Australian Privacy Principles, we take reasonable steps to ensure overseas recipients handle the information consistently with them.

10. Security

We protect information with access controls, isolation between organisations, hashed passwords, one-time codes at every password sign-in, encrypted connections and regular backups. The measures are described on the security page. If a data breach is likely to result in serious harm, we notify you and the competent authority as the law requires.

11. Your rights

You can see and correct your account details in the app, withdraw consent to product updates from your account or from any email, and close your account. You can also ask us to access, correct, delete, restrict or export your information, or object to its processing based on legitimate interest, by writing to info@k-stra.com. We answer within 30 days. Closing an account removes your email and access; a full deletion of what you created is done on request. The proof of acceptance described in section 6 is the exception: it is kept for seven years after closure, because it may be needed to establish or defend a legal claim.

12. Questions and complaints

Write first to info@k-stra.com: we answer within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in the European Union, to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority of the country where you live.

13. Changes to this policy

We update this policy when the service or the providers change. The version and effective date are shown at the top; we email account owners before material changes take effect.