Privacy Policy

1. Who we are

Sublime Traders SAS
122 Rue Amelot, 75011 Paris, France
SIREN: 917 821 340 · SIRET: 917 821 340 00010
VAT: FR13 917 821 340
Email: account@ostrata.io

2. Scope

This policy applies to visitors of our public website, users who create or access an account, workspace members invited by an administrator, and individuals whose data is stored in a customer workspace (for example contacts or companies entered by our customers).

When a workspace administrator stores personal data about third parties in OSTRATA, that administrator is generally the data controller for that CRM data. We act as a processor on their instructions, subject to our agreement with the workspace owner.

3. Data we collect

Account and profile data

When you register or are invited, we may collect your name, email address, username, phone number, profile photo, authentication identifiers, and workspace role.

Workspace and CRM data

You and your teammates may create records, files, notes, views, permissions, and configuration data in your workspace. The content depends on how your organization uses the Service.

Usage and technical data

We collect logs and metadata needed to operate and secure the Service, such as IP address, browser type, device information, timestamps, API requests, error reports, and actions taken in the product.

AI-assisted features

If you use Pilot or other AI features, we process the messages, commands, and relevant workspace context needed to respond. Do not submit sensitive personal data unless your organization has approved that use.

Integrations

If you connect third-party services (for example Google Calendar or Google Drive), we receive the data you authorize through those integrations, such as calendar events or file metadata and content needed to provide the feature.

Communications

If you contact us or join a waitlist, we process the information you provide, such as your email address and message content.

4. How we use data

We use personal data to:

• provide, maintain, and improve the Service;
• authenticate users and enforce permissions and workspace isolation;
• operate AI-assisted workflows you request;
• connect authorized third-party integrations;
• respond to support requests and product communications;
• monitor security, prevent abuse, and comply with legal obligations;
• analyze aggregated or de-identified usage to improve reliability and features.

5. Legal bases (EEA and UK users)

Where applicable law requires a legal basis, we rely on:

• Contract — to create and administer your account and deliver the Service;
• Legitimate interests — to secure the platform, prevent fraud, and improve the product, balanced against your rights;
• Consent — where required for optional communications or integrations;
• Legal obligation — where we must retain or disclose information under law.

6. Sharing and processors

We do not sell your personal data. We share data only with service providers that help us operate the Service, such as hosting, database, authentication, email delivery, analytics, and AI infrastructure providers. These providers process data on our instructions and under appropriate contractual safeguards.

We may also disclose information if required by law, to protect rights and safety, or in connection with a merger, acquisition, or asset sale, subject to applicable law.

7. International transfers

Your data may be processed in countries outside your own, including within the European Economic Area and other jurisdictions where our providers operate. Where required, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms.

8. Retention

We retain personal data for as long as needed to provide the Service, fulfill the purposes described in this policy, resolve disputes, enforce agreements, and comply with legal obligations. Workspace data is retained while the workspace remains active and for a limited period afterward unless deletion is requested earlier in accordance with our Terms of Service.

9. Security

We implement technical and organizational measures designed to protect personal data, including access controls, encryption in transit, tenant isolation, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Your rights

Depending on your location, you may have rights to access, rectify, erase, restrict, object to, or port your personal data, and to withdraw consent where processing is based on consent. You may also lodge a complaint with your local supervisory authority.

In France, the supervisory authority is the CNIL (www.cnil.fr).

To exercise your rights, contact us at account@ostrata.io. If your data is stored in a customer workspace, you may also need to contact that workspace administrator.

11. Cookies and similar technologies

We use essential cookies and local storage needed for authentication, session management, security, and theme preferences. We may use additional analytics or functional technologies as the Service evolves; where required by law, we will provide appropriate notice and choices.

12. Children

The Service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

13. Changes

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the “Last updated” date. Material changes may also be communicated through the Service or by email where appropriate.

14. Contact

Questions about this policy or our data practices can be sent to account@ostrata.io.