Privacy policy
Last updated: 7 July 2026
Who we are
Straptory ("we") is inventory and purchasing software for small businesses, operated by its founder in the United Kingdom; full trading details will be published here when entity registration completes. We are the data controller for your account data and the data processor for the inventory data you store in your workspace. Contact for anything in this policy: ali.kulahci3@gmail.com (a straptory.com address will replace this shortly).
What we collect
| Data | Examples | Why (lawful basis) |
|---|---|---|
| Account data | name, work email, password hash | Run your account (contract) |
| Workspace content | products, stock levels, purchase orders, suppliers, files you upload | Provide the service (contract). This is your data; we process it on your instructions |
| Billing data (after the beta) | plan, subscription status. Card details go directly to Stripe; we never see or store card numbers | Billing (contract) |
| Usage and device data | pages used, browser type, error logs | Keep the service working and improve it (legitimate interest) |
| Beta application data | company, role, SKU range, the problem you describe | Assess beta fit and contact you (legitimate interest / consent) |
We do not sell personal data, run third-party advertising, or use your workspace content for anything except operating the service.
Where your data lives
Application data is stored in Google Cloud (Firebase) in London (europe-west2): database, file storage and server functions. Some sub-processors below may process limited data outside the UK; where they do, transfers rely on the UK IDTA or adequacy mechanisms.
Sub-processors
| Provider | What for | Region |
|---|---|---|
| Google Cloud / Firebase | database, authentication, hosting, functions | UK (europe-west2); Google's authentication infrastructure may process globally |
| Stripe | payments and subscriptions (post-beta) | Global (PCI-DSS; card data never touches Straptory) |
| Transactional email provider | invitation and service emails | Being selected; this table will be updated before invitation emails are sent |
| Sentry | error monitoring (technical logs) | EU/US |
We will update this list before adding a sub-processor that handles your data.
Your rights and retention
- UK GDPR rights apply: access, rectification, erasure, portability, restriction and objection. Email us and we will respond within one month. You can also complain to the ICO.
- Export: your workspace data is exportable self-serve at any time.
- Retention: workspace data is kept while your workspace exists (including the read-only state after the beta). Deleting your workspace deletes its data from the live database, with backups expiring within 35 days. Account data goes when your account is deleted.
Cookies and analytics
The app uses only cookies and storage strictly necessary to sign you in; no ad pixels. This marketing site sets non-essential analytics only after consent (PECR).
Changes
We will email workspace owners about material changes and keep prior versions available on request.