Privacy Policy

Last updated: 8 November 2026

This Privacy Policy explains how Strinta (“Strinta”, “we”, “us”) collects, uses, and protects your personal data when you use our task and project management application at strinta.com and app.strinta.com (the “Service”). By using the Service you agree to the practices described here.

Who we are

The data controller for the Service is listed below. For any privacy question or request, contact us at privacy@strinta.com.

Operator

Upsideye.gr

Based in

Greece

Email

privacy@strinta.com

Data we collect

We only collect what we need to run the Service:

• Account information — your name, email address, and a securely hashed password. If you sign in with Google, we receive your basic Google profile (name, email, avatar).
• Content you create — projects, tasks, comments, notes, documents, time entries, tags, and any files you upload as attachments.
• Workspace & team data — memberships, roles, and invitations you send or receive.
• Billing information — if you subscribe to a paid plan: your billing name and address, a VAT number if you provide one, your subscription status, and your invoices. Card details go directly to Stripe and never reach our servers.
• Communications — emails we send you (invitations, notifications, security alerts) and, if you connect it, messages exchanged with our optional Telegram bot.
• Technical data — essential cookies for authentication and preferences, and, if you enable push notifications, a push subscription tied to your browser or device.
• Usage & diagnostics data — privacy-preserving product analytics (pages visited, features used, page performance) and error reports, collected without analytics cookies or cross-site tracking. For signed-in users this is linked to your account so we can understand and fix real problems.

We do not use advertising or tracking cookies, we do not track you across other sites, and we do not sell your personal data.

How we use your data

• To provide, maintain, and secure the Service and your account.
• To send you service communications you have opted into (task reminders, assignment and mention notifications, security alerts).
• To operate features you use, such as the AI assistant, email/Telegram notifications, and push notifications.
• To prevent abuse, enforce rate limits, and protect account security.
• To bill paid plans, issue invoices, and meet our tax and accounting obligations.
• To understand how the Service is used and to detect and fix errors, using the cookieless analytics described above.

AI assistant

When you use the built-in AI assistant, the content you send it (your message, and the tasks, projects, or text you ask it to work with) is processed by our AI provider, Anthropic, to generate a response. Actions that change your data are confirmation-gated — nothing is created or modified without your explicit approval. Your content is not used to train the provider’s models. If you prefer not to share content with the assistant, simply do not use it.

Service providers

We rely on trusted processors who handle data only on our behalf and under their own security and privacy commitments:

• Supabase — authentication, database, and file storage.
• Vercel — application hosting and delivery.
• Cloudflare — DNS, network infrastructure, and routing of email sent to our support address.
• Resend — delivery of transactional and account emails.
• Stripe — payment processing, invoicing, and VAT calculation for paid plans (only if you subscribe).
• PostHog — product analytics and error tracking, hosted in the European Union; runs without analytics cookies. When you delete your account, your profile, events and recordings are deleted there.
• Anthropic — the AI assistant (only when you use it).
• Telegram — only if you choose to connect the optional bot.
• Slack — only if you connect it, to deliver your notifications as direct messages.
• Google — only if you sign in with Google or connect Google Calendar (read-only, to show your events).
• GitHub — only if you sign in with GitHub (name, email, avatar).

Strinta’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to show your own events next to your tasks: we never write to your calendar, sell the data, use it for advertising, or use it to train AI models.

Cookies

We use strictly necessary cookies to keep you signed in, protect your session (including optional two-factor “remember this device”), and store interface preferences. These are required for the Service to function; we do not use cookies for advertising or cross-site tracking, and our product analytics runs entirely without cookies.

Data retention & deletion

We keep your data for as long as your account is active. You can delete your content at any time within the app.

Deleting your account

You can delete your account yourself in Settings → Account. Your account is locked at once: you are signed out and cannot sign in. Apart from signing you out everywhere and forgetting remembered devices, nothing is erased for 14 days. Until then you can change your mind with the link in the email we send you. After the 14 days your data is erased by an hourly job, so it happens within about an hour after the 14 days are over. We email you when it is done.

During the 14 days we can still email you about billing, support and sign-in or security. Paid plans (yours, and those of workspaces only you use) are cancelled when you ask for deletion. The unused period is not refunded, except where the EU right of withdrawal applies (see our Terms); ask support before you delete. Cancelling the deletion does not bring the plans back.

If something stops the erasure, for example you still own a shared workspace or pay for a Team workspace, we hold it, handle it by hand and contact you.

What we erase

• Your name, email address, avatar and password.
• Your sign-in identities (Google and GitHub) and your two-factor data.
• Your integrations (Slack, Google Calendar, Telegram, push notifications).
• Notes only you could see, and your assistant history.
• Your notifications and preferences.
• Workspaces and projects that only you used, with everything inside them.
• We ask PostHog to delete your analytics profile, with its events and recordings. We ask Google to revoke our Calendar access, and Slack to revoke ours unless teammates still use the same Slack connection.

What we keep

• What you added to other people’s projects: tasks, comments, files, hours, documents and messages. They stay for your teammates and show “Former member” instead of your name. The activity log no longer shows your name.
• Notes you shared with a project, and similar content you left there.
• Your name when others typed it into their own text, for example an @mention, and in notifications teammates already received (for example “Alex moved a task”). It stays as they wrote it until they edit it.
• Invoices and payment records, which we keep because tax law requires it. Stripe holds your customer record and invoices.
• Support tickets you sent: the subject and message text stay as you wrote them, as part of our support records. Your email address is removed and the ticket is closed. Technical details attached to a ticket stay with it: the page you were on, recent error messages, your browser, screen size, and analytics and session-replay IDs. They no longer lead to a profile.

Some traces can remain. An email address you used before you changed it may still appear in older support messages, invitations or a beta request, because we match your current address. Files in storage carry an internal account ID in their metadata, which is not your name or email. Copies in our providers’ backups and logs are not edited; they are deleted when those backups and logs expire.

Questions, or want to exercise your rights sooner? Email privacy@strinta.com. We action verified requests within a reasonable period, subject to any legal retention obligations.

Security

Data is transmitted over TLS and stored with access controls that scope each user’s data to their own account and teams. Passwords are hashed, and optional two-factor authentication (TOTP) is available. No system is perfectly secure, but we work to protect your data using industry-standard measures.

Your rights

Depending on where you live (for example, under the EU/UK GDPR), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at privacy@strinta.com. You also have the right to complain to your local data-protection authority.

International transfers

Our providers may process data in the European Union, the United States, or other regions. Where data is transferred across borders, it is protected by appropriate safeguards offered by those providers.

Children

The Service is not directed to children under 16, and we do not knowingly collect their personal data.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, take reasonable steps to notify you.

Contact

Questions about this policy or your data? Email us at privacy@strinta.com.