Privacy Policy
1. Who we are
StrategySOS ("StrategySOS", "we", "us", or "our") is a software platform that helps organizations develop, evaluate, connect and manage strategic decisions and related strategic and functional plans.
If you have questions about this Privacy Policy or how we handle personal information, contact us through our Contact form:
2. What this Privacy Policy covers
This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you:
- create or use a StrategySOS account
- use StrategySOS on behalf of an organization
- invite or collaborate with other users
- use StrategySOS's AI-assisted features
- subscribe to paid services
- contact us
- otherwise interact with the StrategySOS website or service
StrategySOS is primarily a business-to-business service. Organizations may enter business, strategic, operational or other information into the platform that may contain personal information relating to their employees, customers, partners or other individuals.
Where an organization uses StrategySOS to process personal information on its behalf, the organization may determine the purposes for which that information is processed. In those circumstances, StrategySOS processes that information as part of providing the service to the organization and in accordance with the organization's instructions and applicable agreements.
3. What we collect
Account information
When you create an account, we may collect:
- your name
- email address
- account and organization information
- authentication and sign-in information
- information associated with your membership or role within an organization
Authentication is provided through our sign-in provider.
Your organization's work
When you use StrategySOS, we store the information you choose to enter into the platform. This may include:
- organization and company information
- industry and business context
- strategic objectives and tasks
- Limitations
- Parameters of Change
- scores and assessments
- Strategic Directions and Strategy Statements
- Corporate, Business and Functional strategies
- plans and dependencies
- assumptions
- risks
- comments and proposals
- competitive and market information
- saved sessions and checkpoints
- other content you choose to create or upload
This information may contain confidential business information and, depending on what you or your organization enters, personal information about individuals.
Team information
If you invite another person to an organization or workspace, we may collect that person's:
- name
- email address
- organization membership
- role
- information necessary to manage their access
You are responsible for ensuring that you have the appropriate authority to provide personal information about people you invite to your organization.
Billing information
If you subscribe to a paid StrategySOS service, payment information is processed by our payment provider, Stripe.
We do not store your full payment card number on StrategySOS's systems. Stripe processes payment information in accordance with its own privacy and data-processing terms.
Integration information
If StrategySOS allows you to connect an external service through an Integration, we may receive and store the credentials, tokens or other authorization information necessary to maintain that connection and provide the requested functionality.
Where supported, connection credentials are encrypted when stored.
You control whether you connect an external service. We do not access external services except as necessary to provide the functionality you have requested or as otherwise permitted by applicable law or your agreement with us.
Technical information
We may collect limited technical information necessary to operate, secure and troubleshoot the service, including:
- error logs
- timestamps
- information about pages or functions that generated an error
- authentication and security events
- other technical information reasonably necessary to operate the service
We do not currently use advertising cookies or advertising technology to profile you for targeted advertising.
4. How we use personal information
We use personal information for the following purposes:
- to create and manage accounts
- to provide StrategySOS and save your work
- to maintain separation between organizations and users
- to provide collaboration and workspace functionality
- to provide AI-assisted features when you request them
- to process subscriptions and payments
- to send account, security, service and invitation emails
- to respond to support requests
- to maintain, secure and troubleshoot the service
- to detect, investigate and prevent misuse, fraud or security incidents
- to comply with legal and regulatory obligations
- to otherwise provide the services you or your organization have requested
We do not sell your StrategySOS work or use it for advertising.
We do not use your organization's strategy content to create advertising profiles about you.
5. AI features
StrategySOS includes optional AI-assisted features.
When you explicitly request an AI feature, the relevant information needed to perform that request may be sent to our AI provider, Anthropic. Depending on the feature, this may include portions of your strategy, Limitations, Parameters of Change, scores, plans, assumptions, competitive information, or other content relevant to the request.
AI processing occurs when you use an AI feature. StrategySOS does not continuously send your strategy to Anthropic simply because your strategy is stored in the platform.
Anthropic provides commercial API services to StrategySOS. Under Anthropic's current commercial terms, Anthropic states that inputs and outputs from its commercial products, including its API, are not used to train its models by default. Anthropic may use information where a customer explicitly opts into applicable model-improvement programs or explicitly submits material through feedback mechanisms.
StrategySOS does not intentionally opt your organization's content into Anthropic's model-training programs.
AI-generated content may be inaccurate, incomplete or unsuitable for your circumstances. You remain responsible for reviewing and deciding whether to use AI-generated content.
6. Who processes your information
We use third-party service providers to operate StrategySOS. Depending on how you use the service, these providers may process information on our behalf.
These currently include:
- Clerk — authentication, account management and organization membership
- Neon — database hosting and storage of StrategySOS application data
- Stripe — payment processing and subscription billing
- Anthropic — AI processing for AI features that you explicitly request
- Vercel — application hosting and related infrastructure used to operate the StrategySOS application
- Resend — delivery of transactional email (account, billing and notification emails)
- Cloudflare — bot and spam protection on public forms (Turnstile)
- Google Analytics — usage analytics for the strategysos.com website (pages viewed, general location, device type) — not your organization's stored strategy content
We will update this Privacy Policy when material changes to our providers or data-processing practices require an update.
Our service providers are permitted to process information only as necessary to provide their services to us, subject to their applicable contractual, privacy and security obligations.
For example, Clerk's current Data Processing Agreement provides for processor/sub-processor arrangements and international transfer mechanisms where applicable. Stripe also maintains a Data Processing Agreement governing its processing of personal data.
Separately, if your organization chooses to connect a third-party account (currently Google Analytics, HubSpot, Salesforce or QuickBooks Online) under Integrations, StrategySOS reads data from that account on your behalf, using credentials your organization explicitly authorizes and can revoke at any time. That connection is initiated by your organization, not something StrategySOS does by default, and the data read is whatever that connected account already contains — it is not sent to any additional third party beyond the provider you connected.
7. Business and strategic information
StrategySOS is designed to store organizational strategy and planning information.
Your organization's strategy, plans, assessments and related content may be confidential or commercially sensitive. We treat this information as information belonging to the organization or user that provided it, subject to our Terms of Service and applicable agreements.
We do not use customer strategy content to advertise to other customers or publicly disclose it.
We may process customer content through service providers, including our AI provider, when necessary to provide functionality that you or your organization have requested.
8. Confidentiality
We recognize that information entered into a strategy platform may be commercially sensitive.
Our use and disclosure of your information is governed by this Privacy Policy, our Terms of Service and, where applicable, agreements with your organization.
We do not disclose your organization's strategy content to unrelated third parties except:
- when necessary to provide the service
- when you or your organization instructs us to do so
- when required by law or legal process
- when necessary to protect the rights, security or property of StrategySOS, our users or others
- with your consent
9. Cookies and similar technologies
StrategySOS uses technologies that are necessary to operate and secure the service.
These may include:
- cookies required for authentication and session management
- browser storage used for limited preferences
- technologies necessary to maintain security and service functionality
We do not currently use advertising cookies.
We also do not currently use third-party advertising technology to track users across unrelated websites.
If we introduce analytics, advertising or other non-essential tracking technologies that require additional consent under applicable law, we will update our practices and provide appropriate controls.
10. How long we keep information
We retain account and organizational information for as long as reasonably necessary to provide StrategySOS, maintain your account, comply with our legal obligations, resolve disputes and enforce our agreements.
For active accounts, your strategy and related work remain available to you and your organization.
When an account or organization is deleted:
- access to the account and its work is removed or disabled promptly
- we generally permanently delete the associated data within 30 days
- certain information may be retained for longer where necessary to comply with legal, accounting, tax, fraud-prevention, security or other legitimate obligations
Backups and disaster-recovery systems may retain copies for a limited additional period before they are overwritten or deleted in accordance with our backup processes.
Where information is retained because of a legal or legitimate business requirement, we will continue to protect it and will not use it for unrelated purposes.
11. Your rights
Depending on where you live and the law that applies to your information, you may have rights concerning your personal information, including the right to:
- request access to personal information we hold about you
- request correction of inaccurate or incomplete information
- request deletion of personal information, subject to legal and other permitted exceptions
- request an export or copy of certain information
- object to or request restrictions on certain processing
- withdraw consent where processing is based on consent
- make a complaint to the applicable privacy or data-protection authority
Canadian privacy law, including PIPEDA where applicable, provides individuals with rights concerning access to and control of their personal information and requires organizations to maintain appropriate safeguards and transparent privacy practices.
To exercise a privacy right or ask a privacy question, contact us through our Contact form:
We may need to verify your identity before responding to a request.
If you use StrategySOS through an organization, some requests concerning organizational data may need to be directed to that organization because the organization may control the relevant personal information.
12. International processing
StrategySOS is operated from Canada, but our service providers may process information in Canada, the United States or other countries where they or their service providers operate.
As a result, personal information may be transferred to and processed outside your province, territory, country or jurisdiction.
Where applicable, we use contractual, organizational or other safeguards designed to protect personal information when it is transferred internationally.
For example, where GDPR requirements apply, appropriate transfer mechanisms may include the European Commission's Standard Contractual Clauses or other legally recognized safeguards.
By using StrategySOS, you acknowledge that information may be processed internationally as described in this Privacy Policy.
13. Security
We take reasonable measures appropriate to the nature and sensitivity of the information we process to protect it against unauthorized access, use, disclosure, alteration or destruction.
Our measures include, as applicable:
- encryption of information in transit
- protection of authentication credentials
- encryption of stored integration credentials
- access controls
- separation of organizational data within the application
- monitoring and logging designed to identify technical or security problems
No internet-based service can guarantee absolute security.
If we determine that a privacy or security breach has occurred that requires notification under applicable law, we will provide notifications as required by that law.
14. Children
StrategySOS is a business software service and is not directed toward children.
You must be legally able to enter into the applicable agreement to use StrategySOS. We do not knowingly collect personal information from children where such collection is prohibited by applicable law.
If you believe a child has provided personal information to us improperly, please contact us through our Contact form:
15. Privacy and third-party services
StrategySOS may contain links to or integrate with third-party services.
When you interact directly with a third-party service, that service may collect and process information under its own privacy policy and terms.
StrategySOS is not responsible for the privacy practices of third-party services that we do not control.
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to StrategySOS, our service providers, our data practices or applicable legal requirements.
If we make a material change, we may notify you through the service, by email, or by another appropriate method before or when the change takes effect, where required by law.
The "Last updated" date at the beginning of this Privacy Policy indicates when the current version took effect.
17. Contact us
If you have questions about this Privacy Policy, want to exercise a privacy right, or have a concern about how StrategySOS handles personal information, contact us through our Contact form: