Privacy policy

1. Who we are

Aniketh Marian, sole proprietor, trading as DA SUAN ENTERPRISES and Stratum AI ("Stratum", "we", "us") builds and implements software that automates finance back office work for businesses: invoicing, accounts payable, bank reconciliation and month end close. Aniketh Marian is the proprietor of DA SUAN ENTERPRISES and the party responsible for your data under this policy. Stratum was founded in Bangalore, India, by Aniketh Marian (Cofounder and CEO) and Prem Shah (Cofounder and COO). Our team works from New York, USA.

Registered address: DA SUAN ENTERPRISES, Ack Corp, OMBR Layout, Bangalore [area, state and PIN code to be added], India.

Data protection contact: Stratumai.co@gmail.com, phone +1 (516) 613-0509.

Where the law requires us to appoint a representative in the European Union or the United Kingdom, we will name it here.

2. What this policy covers

This policy explains how we handle personal data in three situations.

1. You visit stratumai.co. We decide how that data is used, so DA SUAN ENTERPRISES is the controller (the "data fiduciary" under India's Digital Personal Data Protection Act 2023).
2. You are a business contact: you fill in our contact or booking form, email or call us, pay us, or work at a company that uses or is considering Stratum. DA SUAN ENTERPRISES is the controller for that data too.
3. Your company is a Stratum client and connects its ledger, mailbox or bank data. The personal data inside those systems (for example names and emails of your customers and vendors) belongs to your company. Your company is the controller, and we are its processor (a "data processor" under Indian law, and a "service provider" under US state laws). We handle that data under our Data processing addendum and your company's instructions, and your company's own privacy notice tells people how it uses their data.

This policy does not cover third party websites or services we link to, or the services your company chooses to connect, such as QuickBooks Online, your mailbox provider or your bank. Their own policies apply. Razorpay, which processes our payments, also has its own privacy policy.

3. What we collect

When you visit the website

We use Plausible Analytics to count visits. Plausible sets no cookies and stores no personal data. It records the page viewed, the referring site, the browser and operating system type, the device type and the country, derived from your IP address. To count unique visitors for one day, it combines your IP address and browser details with a random value that changes every 24 hours and stores only the scrambled result. Your IP address itself is not stored. The Cookie policy explains this in more detail.

Our hosting provider, Vercel, processes your IP address and browser details to deliver the page and protect the site from abuse. These technical logs are kept for a short time, and no longer than 90 days.

When you contact us or book a call

Our contact and booking forms ask for your name, work email, company, the accounting software you use, your type of business, the agent you are interested in, and anything you choose to write in the free text box. Please do not put sensitive personal data, bank details or passwords in the free text box.

If you email us or speak with us, we keep the messages and our notes of the conversation.

When you pay us

Payments are processed by Razorpay. When you pay, Razorpay collects your name, email and payment details directly on its own secure checkout. We receive a payment reference, the amount, the payment status, and the name, email and company linked to the payment. We never see, receive or store your full card number, card security code, or PayPal login details.

When your company becomes a client

For the people who use Stratum on behalf of a client, we collect name, work email, role, the approval limits you are given, sign in records, and the approvals and decisions you make in the product. Billing contacts give us their name, email and billing details.

Data inside your connected systems

We read your company's accounting data through QuickBooks Online, using the OAuth connection you approve. We read email or bank data only where your company chooses to connect it. The agents may then see ledger records, invoices, bills, payments, bank transactions and emails. These can contain personal data about your customers, vendors, employees and contacts: names, email addresses, phone numbers, postal addresses, amounts owed or paid, bank account details on vendor records, and whatever people write in emails and documents. We process this data only as your company's processor, as described in the Data processing addendum.

What we do not collect

We do not knowingly collect sensitive personal data such as health, biometric, religious or sexual orientation data. We do not buy personal data from data brokers. We do not use tracking cookies, tracking pixels, advertising networks or cross site tracking.

4. Why we use it, and our legal basis

We use personal data only for the purposes below. Under India's Digital Personal Data Protection Act 2023, we rely on your consent, or on a legitimate use the Act allows, such as data you give us voluntarily for a specific purpose (for example asking us to contact you) or data we must keep to comply with law. If you are in the European Economic Area or the United Kingdom, the right hand column gives the legal basis under the GDPR or the UK GDPR.

Where we rely on your consent, you can withdraw it at any time by emailing Stratumai.co@gmail.com. Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time.

We do not use personal data to make decisions about you that have legal or similarly significant effects based solely on automated processing. Inside the product, the agents act for our client under the client's own rules and approval thresholds, and a person at the client approves before any money moves.

5. How we treat client data

Data that comes from a client's connected systems is the client's data. For that data we commit to the following, and these commitments are also written into our Terms of service and Data processing addendum.

• We use it only to provide the service to that client and on that client's instructions.
• We never sell it and never share it for cross context behavioral advertising.
• We never use it to train AI models, ours or anyone else's. Our model provider is contractually barred from training on it.
• The agents never move money. A person at the client approves before any money moves, and releases payments in the client's own bank.
• We keep each client's data logically separate from every other client's.
• We delete it within 30 days of termination when the client asks in writing.

If you are a client's customer, vendor or employee and want to exercise your rights over data in that client's systems, please contact that company. If you contact us, we will pass your request to the company promptly and help it respond.

6. Who we share it with

We do not sell personal data, and we have not sold or shared personal data for cross context behavioral advertising in the last 12 months. We share personal data only with:

• Our subprocessors, the service providers listed below that help us run Stratum, bound by written terms to use the data only to serve us.
• Services your company chooses to connect, when the agents act in them on your company's instructions.
• Professional advisers such as lawyers and accountants, under a duty of confidentiality.
• Authorities, courts or other parties where the law requires it. Where the law allows, we tell the affected client first and disclose no more than is required.
• A buyer or successor if Stratum is involved in a merger, acquisition or sale of assets. The data stays protected by this policy, and we will tell you before it becomes subject to a different policy.

7. Our subprocessors

On top of these, the agents work inside the ledger, bank and mailbox providers that each client chooses to connect. The Subprocessors page gives full details and explains how we tell clients before we add a new one.

8. Where data lives and international transfers

DA SUAN ENTERPRISES is registered in India, and our team operates from New York, USA. Our website and application are hosted in the United States, and our main subprocessors are there too. Razorpay processes payment data in India. Plausible Analytics stores its aggregated counts in Germany. So your personal data is processed mainly in India and the United States. Our team accesses client data and business contact data only to provide and support the service.

Transfers of personal data out of India are allowed under the Digital Personal Data Protection Act 2023, except to countries the Government of India restricts. We will follow any such restriction.

When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to India or the United States, we rely on the European Commission's Standard Contractual Clauses (2021), with the UK International Data Transfer Addendum and Swiss adjustments where they apply. For a subprocessor certified under the EU US Data Privacy Framework and its UK Extension, we may also rely on that certification. You can ask for a copy of the relevant safeguards at Stratumai.co@gmail.com.

9. How long we keep it

We may keep data longer where the law requires it or to establish or defend a legal claim, and only for as long as that need lasts.

10. Deletion on request

You can ask us to delete your personal data at any time by emailing Stratumai.co@gmail.com. We will delete it, and tell our subprocessors to delete it, unless we must keep it to comply with law (for example payment records we must keep for tax) or to establish or defend a legal claim. If we keep anything, we will tell you what and why.

11. How we protect it

We encrypt data in transit and at rest, limit access to the people who need it, require multifactor sign in, log every agent action and every access to client data, and review our controls regularly. We do not hold a SOC 2 report or any security certification. The Security page describes our commitments in full.

No system is perfectly secure. If a personal data breach affects your company's data, we will tell your company without undue delay and within 72 hours of becoming aware of it, and we will notify authorities and affected people where Indian or other law requires it.

12. No tracking cookies

This website sets no tracking cookies and uses no advertising trackers. If you pay on our payment page, Razorpay's checkout may set its own cookies that it needs to process the payment and prevent fraud. The Cookie policy explains this.

13. Your rights

Whatever the law where you live, you can ask us to tell you what personal data we hold about you, give you a copy, correct it, or delete it, and you can opt out of our product news at any time. We will not treat you differently for asking. The laws below give you specific rights on top of that.

India

If you are in India, the Digital Personal Data Protection Act 2023 gives you the right to a summary of the personal data we process about you and the processing activities, to know who we have shared it with, to correction, completion, updating and erasure, to withdraw consent, to grievance redressal, and to nominate another person to exercise your rights if you die or become incapable. You can bring a grievance to our Grievance Officer (details below). If you are not satisfied with our response, you may complain to the Data Protection Board of India.

European Economic Area and United Kingdom

You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests or used for direct marketing. Where we rely on consent, you can withdraw it at any time. You can also complain to your local data protection authority, or in the UK to the Information Commissioner's Office. We would be grateful for the chance to resolve your concern first.

California

To the extent the California Consumer Privacy Act applies to us, California residents have the right to know what personal information we collect, use and disclose; to access and delete it; to correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for using these rights.

In the last 12 months we collected these categories: identifiers (name, email), professional information (company, role, business type), commercial information (the service you are interested in or buy, and payment records), and internet activity (hosting logs). We collected them from you, from your employer, from Razorpay and from our systems, for the purposes in the table above, and disclosed them only to the service providers and parties listed in Who we share it with. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. We treat a Global Privacy Control signal as a valid opt out request.

Other US states

Residents of Virginia, Colorado, Connecticut and other states with comprehensive privacy laws have similar rights to access, correct, delete and port their data and to opt out of targeted advertising, sale and profiling. We do not do targeted advertising, sale or profiling. If we decline your request, you can appeal by replying to our decision. If you are unhappy with the result of the appeal, you can contact your state attorney general.

14. How to exercise your rights

Email Stratumai.co@gmail.com with your request, or call +1 (516) 613-0509 (Monday to Friday, 9:00 to 18:00 New York time). Tell us what you want us to do and how we can reach you.

• We confirm receipt within 10 working days.
• We answer as soon as possible and within the time the law sets: within one month for EU and UK requests, within 45 days for US state requests, and within the period set by the Indian rules for Indian requests. If a request is complex, we may extend this as the law allows and will tell you why.
• We may ask for information to confirm your identity. We use it only for that purpose.
• You can use an authorized agent or nominee. We may ask for proof of their authority and confirm the request with you.
• Requests are free. We may decline or charge a reasonable fee only for requests that are manifestly unfounded or excessive, and we will explain why.

If your request concerns data held in a Stratum client's systems, we will forward it to that client, because the client decides how its data is used.

15. Children

Stratum is a service for businesses. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, email Stratumai.co@gmail.com and we will delete it.

16. Changes to this policy

We will update this policy when our practices change. The version number and date at the top will change with it. If a change materially affects how we use personal data we already hold, we will tell clients by email at least 30 days before it takes effect and, where the law requires, ask for consent.

17. Contact

For anything about privacy, data requests, or this policy: Email Stratumai.co@gmail.com. Phone +1 (516) 613-0509 (Monday to Friday, 9:00 to 18:00 New York time). Post: DA SUAN ENTERPRISES, Ack Corp, OMBR Layout, Bangalore [area, state and PIN code to be added], India.

Grievance Officer: Aniketh Marian, Stratumai.co@gmail.com