Privacy Policy
Last updated Oct 11, 2026
1. Scope and our role
This Privacy Policy explains how [StratosOpX, LLC] ("StratosOpX," "we," "us") collects, uses and shares personal information through stratosopx.com, our sales and support channels, and the StratosOpX platform and AI agents (the "Services"). StratosOpX serves businesses, not consumers.
Our role depends on the data:
| Data | Our role | Whose terms govern |
|---|---|---|
| Website visitors, prospects, account administrators and billing contacts | Controller (we decide how it is used) | This Privacy Policy |
| Customer Data processed in the platform, such as purchase orders, ERP records, RFP packages and the contact details inside them | Processor / service provider acting on the customer's instructions | The customer's agreement and Data Processing Addendum (DPA) |
If your information appears in a document a StratosOpX customer sends us (for example, a buyer's name on a purchase order), that customer controls it. Please contact that business first; we will help them respond to your request.
2. Information we collect
| Category | Examples | Source |
|---|---|---|
| Contact and business details | Name, job title, company, business email, phone, address | You, forms, demo requests, events, referral partners |
| Account and authentication | Username, role, MFA settings, SSO identifiers, login history | You and your organization's administrator |
| Billing | Billing contact, invoices, payment status, tax ID of the business | You; payment card details are handled by our payment processor, not stored by us |
| Communications | Emails, support tickets, call notes, discovery and ROI worksheets | You |
| Usage and device data | IP address, browser, pages viewed, feature use, timestamps, error logs | Automatically, via cookies and logs |
| Agent activity records | Actions requested, approvals, approver identity, results, audit logs | Generated by the Services |
| Customer Data (as processor) | POs, change orders, ERP customer and item records, price lists, inventory levels, RFP packages, certifications, capability statements, and contact details within them | Our customers and their connected systems |
We do not knowingly collect sensitive personal information (such as health, biometric, precise geolocation or government ID data) and ask customers not to submit it unless a signed addendum permits.
3. How we use information
We use personal information we control to:
- Provide, operate and support the Services, including onboarding, implementation and customer support.
- Authenticate users, enforce approval workflows, keep audit trails, and detect and prevent fraud, abuse and security incidents.
- Bill, collect payment and manage accounts.
- Respond to inquiries, send service notices, and, with an opt-out, send product updates and marketing to business contacts.
- Measure and improve the Services using aggregated or de-identified usage metrics.
- Comply with legal obligations and enforce our agreements.
We process Customer Data only to provide the Services to that customer, as instructed in their agreement and DPA.
AI processing and model training. Our AI agents process Customer Data to extract fields, validate orders, compare bid requirements and draft Output. We use third-party AI model providers under contracts that prohibit them from training their models on Customer Data. We do not use Customer Data to train or fine-tune AI models for other customers. Any customer-specific tuning (such as item-matching rules) is used only for that customer.
Automated decisions. Our agents assist business operations; they do not make decisions with legal or similarly significant effects about individuals. Orders and bid recommendations are subject to customer review and approval controls.
We do not sell personal information and do not share it for cross-context behavioral advertising.
4. How we share information
We share personal information only as follows:
- Subprocessors and service providers that help us run the Services, under written contracts requiring confidentiality, security and use only on our instructions. Categories include cloud hosting, AI model providers, email delivery, customer support, payment processing and analytics. Our current subprocessor list is at [stratosopx.com/subprocessors], and customers receive at least 30 days' notice of new subprocessors that process Customer Data.
- Customer-connected systems — when a customer directs us to post orders to its ERP or export results, data flows to systems that customer controls.
- Professional advisers such as lawyers, accountants, auditors and insurers, under confidentiality duties.
- Legal and safety — to comply with law, valid legal process or government requests; to protect rights, safety and security; or to investigate fraud. Where lawful, we notify the affected customer before disclosing Customer Data.
- Business transfers — in a merger, acquisition, financing or sale of assets, subject to this Policy's protections.
- With consent or at the direction of the customer.
5. Security, retention and deletion
Security. We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit and at rest, multi-factor authentication, least-privilege access, separate development and production environments, server-side tenant isolation, secrets stored in a managed vault and kept out of AI model context, centralized logging, and scoped, short-lived credentials for agent actions where supported. No method of transmission or storage is completely secure.
Incidents. If we confirm a security incident affecting personal information, we will notify affected customers without undue delay and as required by law and contract, and cooperate in any required notices.
Retention.
| Data | Retention period |
|---|---|
| Customer Data | Duration of the subscription, plus 30 days for export; then deleted within 30 days, and from backups on normal rotation |
| Agent audit logs | Per plan (standard [12] months; extended on Scale) or as the customer's agreement requires |
| Account and billing records | Life of the account plus [7] years for tax and accounting |
| Prospect and marketing contacts | Until you opt out, or [24] months of inactivity |
| Website usage logs | [13] months |
We may keep information longer where law requires or to resolve disputes, and we keep de-identified data that can no longer identify anyone.
6. Your privacy rights
Depending on where you live and whether a law applies to us, you may have the right to:
- Know what personal information we hold about you and receive a copy in a portable format.
- Correct inaccurate information.
- Delete your information, subject to legal exceptions.
- Opt out of marketing emails (use the unsubscribe link at any time).
- Opt out of sale, targeted advertising or profiling (we do none of these).
- Appeal our decision on your request.
- Not be discriminated against for exercising your rights.
Several U.S. state laws (for example, in California, Virginia, Colorado, Connecticut, Texas and others) grant these rights to residents, and some apply to business contacts. [Counsel to confirm which laws apply based on StratosOpX's revenue and data-volume thresholds.]
How to make a request. Email privacy@stratosopx.com with your name, company and request. We will verify your identity using information we already hold and respond within 45 days (extendable once where the law allows). An authorized agent may submit a request with your signed permission. If we deny your request, you may appeal by replying to our decision; if the appeal is denied, you may contact your state attorney general.
For information we process on behalf of a customer, we will forward your request to that customer and assist them in responding.
7. Cookies, children, international users, changes and contact
Cookies. Our website uses strictly necessary cookies to run the site and keep you signed in, and analytics cookies to understand site use. We do not use advertising cookies. You can control cookies through your browser and our cookie banner, and we honor Global Privacy Control signals as an opt-out where required. The platform uses only cookies needed for authentication, security and preferences.
Children. The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect children's information; contact us if you believe we have, and we will delete it.
International users. We are based in the United States and process information in the U.S. [and other locations listed on the subprocessor page]. Where required, we use appropriate transfer safeguards, such as standard contractual clauses in the DPA.
Links. Third-party sites and integrations (including your ERP provider) have their own privacy practices.
Changes. We may update this Policy and will post the new version with its effective date. For material changes, we will notify account administrators by email or in the Services at least 30 days in advance.
Contact
[StratosOpX, LLC] — Attn: Privacy [Street address], [City], Georgia [ZIP] privacy@stratosopx.com · stratosopx.com