Privacy Policy

How we handle personal information

Effective date: 28 October 2026 · Version 1.5 · What changed

1. Who we are

Stralos is operated by Stralos Limited (company number 9442335, NZBN 9429053795076), a New Zealand company with its registered office at 105 Verona Place, RD 2, Ohoka 7692, New Zealand ("Stralos", "we", "us").

This policy explains how we collect, use, store, disclose and protect personal information when you visit our website (stralos.app and stralos.co.nz) or use the Stralos platform, our software service for estimating, scheduling and managing civil construction work (the "Service").

We comply with the New Zealand Privacy Act 2020 and its Information Privacy Principles (IPPs). We handle the personal information of everyone who uses Stralos, including people in Australia, in the same way, consistently with the New Zealand Privacy Act.

Our two roles

• For our own information (website visitors, people who register interest, account holders, billing contacts) we decide how the information is used and are responsible for it.
• For information our customers put into the Service (for example details of their staff, crew, clients, suppliers and subcontractors) we hold and process it on behalf of the customer. The customer organisation is responsible for having collected that information lawfully and for telling the people concerned. Under section 11 of the Privacy Act 2020, information we hold solely as our customer's agent is treated as held by the customer. If you are one of those people, please contact the organisation that uses Stralos first; we will help them respond.

2. What we collect

2.1 Website visitors and people who register interest

• Register-interest form: email address, and optionally your name, company, role, company size, type of work, how you heard about us, any comments you choose to add, and whether you want beta access or updates.
• Collected automatically with the form: your country (derived by our hosting provider from your connection), your browser's user-agent string, and first-touch campaign details (UTM tags, ad click identifiers such as gclid, gbraid, wbraid, fbclid, msclkid or li_fat_id, landing page and referring site). The first-touch details are stored in your browser's local storage and sent with a form submission or completed sign-up.
• Open beta sign-ups: for every completed sign-up we store your email address, company name and how you first found us: campaign tags, any ad click identifier (including Google, Meta, Microsoft or LinkedIn click identifiers), the referring site, landing page and first-visit time. We use this to measure which channels lead to sign-ups and paying customers. We keep this sign-up attribution for three calendar months, then delete it from our live database in a daily cleanup.
• Analytics: we use Google Analytics 4 and PostHog to see how the website is used: pages viewed, clicks on buttons and links, sections scrolled into view, errors, how you reached the site (for example a search, a link or an ad), and device and browser information. Google also works out an approximate location (such as your city) from your IP address. They load when you visit, without asking first; you can turn them off at any time (see section 8). We do not send your name, email address or anything you type into a form to Google Analytics or PostHog, and website analytics are not linked to your name or email address.
• Session recordings: PostHog records how visitors interact with pages (mouse movement, clicks and scrolling) so we can improve the site. Everything you type into form fields is masked and is not captured in recordings.
• Advertising measurement: if you reach our website from one of our Google ads, Google Analytics records that, and whether you then sign up for the open beta or ask us to keep you posted, so we can tell which ads work and report those sign-ups to Google Ads. We also send Google Ads the ad click identifier and the time you signed up or registered interest, so we can measure which ads lead to sign-ups even when Google Analytics is blocked or turned off. We do not send your name or email address to Google. This is currently conversion measurement only. We plan to use remarketing, but it is not enabled. Meta Pixel, Meta Conversions API and LinkedIn Insight Tag are not currently installed. Before introducing these features, we will update this policy to describe the data, recipients and controls that are actually in use.
• Bot protection: the register-interest (keep me posted) form and the open beta sign-up form use Cloudflare Turnstile, which processes device and browser signals to tell people from bots.

2.2 Account holders (users of the Service)

• Identity: name, email address, your role and permissions within your organisation, account status, and when you last signed in.
• Sign-in: your password (stored only as a one-way hash by our identity provider, never in readable form), one-time sign-in codes sent to your email, passkeys and authenticator-app settings if you enable them.
• Sessions: for each signed-in device we keep a session record containing a hashed session token and the browser and operating system type. We do not store your IP address or full user-agent string with your session.
• Usage and diagnostics: we use PostHog (EU cloud) in the app for product analytics (pages and features used, clicks, errors, and device and browser information), feature flags (to control which features are switched on for you), and session recordings. This is linked to your name and email so we can support you, fix problems and improve the Service. In app session recordings all text and form input is masked and network requests are not recorded.
• AI assistant conversations: the messages you type to the Stralos assistant, its replies, and a record of any actions it took or proposed on your behalf.
• Support: anything you tell us when you contact us.

2.3 Billing contacts

When your organisation subscribes we collect the billing email address, organisation name, country and billing address. Card details are entered directly into Stripe's hosted payment pages and are never received or stored by Stralos. We store the subscription status and the Stripe customer reference.

2.4 Information customers put into the Service

Customers use Stralos to run their construction business, so the Service holds information about people connected to that business, including:

• Client, supplier and subcontractor companies and their contacts: company and trading names, business numbers, websites, and contact names, roles, email addresses and phone numbers.
• Workforce and crew: first, last and preferred names, email and phone, employee number, role or title, employment type, working days, start and end dates, notes, driver licence classes and their expiry and verification dates, endorsements, competencies and certificates, and periods of unavailability with a reason and notes.
• Projects and sites: project names, job numbers, client references, addresses and map coordinates of project sites, office locations and supplier yards.
• Documents: drawings, specifications, schedules and other files uploaded to Stralos, or opened in Stralos from a Google Drive shared drive or Microsoft SharePoint document library that the customer has connected (see section 6). Documents may contain personal information.
• Connected-drive file details: for each file in a connected drive folder that the customer maps to a project: the file's name, folder path, type, size, version identifiers, a link to it, when it was last modified, and the display name of the person who last modified it.

Sensitive information. The Service is not designed to hold health, medical or other sensitive information. Customers should not record health details in free-text fields such as unavailability notes; record "leave" or "unavailable" instead.

3. How we use personal information

• to provide, operate, secure and support the Service, including signing you in and sending sign-in codes and invitations;
• to process subscriptions and payments and keep financial records;
• to respond to people who register interest, invite them to early access and send product updates they have asked for (you can unsubscribe at any time);
• to understand how the website and Service are used and to fix and improve them, and to measure whether our advertising leads to sign-ups;
• to power AI features when you choose to use them (see section 5);
• to list, open and track versions of files in drives your organisation connects (see section 6);
• to detect and prevent fraud, abuse, malware and security incidents; and
• to comply with our legal obligations.

We do not sell personal information, and we do not use customer data from the Service for advertising. We do not use customer data, whether identifiable, de-identified or aggregated, for benchmarking or to train or improve AI models.

4. Service providers and where your information goes

We use the following service providers (sub-processors) to run Stralos. They act on our instructions and are bound by contract to protect the information. Some are outside New Zealand; see section 7. This table is our current sub-processor list.

Services your organisation connects. Google Drive (part of Google Workspace) and Microsoft SharePoint (part of Microsoft 365) are not our sub-processors. If your organisation connects them, they remain your organisation's own providers, under your organisation's own agreement with Google or Microsoft, and Stralos only reads from them with your organisation's permission (see section 6). To read them, Stralos uses two identity services that hold no file content: a Google Cloud project that holds the Google service account Stralos creates for your organisation, and our Microsoft Entra app, "Stralos Drive Sync". Files that Stralos fetches from your drives are stored with Amazon Web Services in Sydney, like any other document.

We may also disclose information to our professional advisers, to a buyer or successor if our business is sold or restructured (subject to this policy), or where required or permitted by law, for example to a court or regulator.

We will give customers at least 30 days' notice, by email or in the app, before we add or replace a sub-processor, and update this list when we do. You may object to the change, as set out in clause 6 of our Terms of Service.

5. AI features

Stralos includes AI features: the in-app assistant, automatic summaries and classification of uploaded documents, area take-off from drawings, reading supplier rate sheets when you import them, and suggesting which of a project's documents are worth processing. When these features run, we send the model provider named in section 4:

• for the assistant: your messages, the earlier messages in the conversation, your role, and the Stralos data the assistant looks up to answer (for example project names, job numbers, client references, estimates, rates, schedules and office locations);
• for document features: text extracted from the document;
• for rate imports: the contents of the rate workbook or PDF; and
• for document suggestions, only when a user asks for them: the names and folder paths of the project's documents, never their contents.

Files from a connected drive (section 6) are never processed by AI automatically. Their contents are sent to the model provider only when a user chooses to process a file, in the same way as an uploaded document.

We remove sign-in tokens before anything is sent. We use AI providers under terms that do not allow them to train their models on your data. We use Google's paid Gemini API tier. Google does not use our prompts, files or responses to train or improve its products. Google retains prompts and responses for up to 55 days, solely to detect and prevent misuse of its service. We do not log model outputs.

AI output can be wrong. Check anything the assistant produces before relying on it. The assistant proposes changes as drafts for you to confirm.

Assistant conversations are kept for 12 months and the record of assistant actions for 24 months, then deleted by a scheduled deletion job that runs weekly.

6. Connected drives (Google Drive and Microsoft SharePoint)

An organisation admin can connect Google Drive shared drives and Microsoft SharePoint document libraries to Stralos, so that project documents can be used without uploading them again. Connecting is optional. Only an organisation admin can connect a drive; individual users cannot.

What Stralos can access

• Only what your admin grants.
  • Google: Stralos creates a Google service account used only for your organisation (an address ending in @stralos-drive-prod.iam.gserviceaccount.com). It can read only the shared drives that your admin adds it to as a member with Viewer access. Files in someone's personal My Drive are not supported.
  • Microsoft: a Microsoft 365 administrator of your organisation approves our "Stralos Drive Sync" app. The app asks for the Microsoft Graph permission Sites.Selected, plus openid and profile for sign-in. Sites.Selected gives access to nothing by itself. Your admin then grants the app read access to each SharePoint site, one site at a time. Personal OneDrive is not supported.
• Read-only. Stralos never creates, changes, moves, shares or deletes anything in your drives.
• Nothing else. We do not access your email, calendars, contacts or any other Google Workspace or Microsoft 365 data.
• Connecting Microsoft 365. Your admin signs in with a work account so that we can confirm which Microsoft 365 tenant belongs to your organisation. We keep your tenant ID and the domain your admin entered. We do not keep the admin's Microsoft account details from that sign-in.

What we store, and why

• Links, not copies. When your organisation maps a drive or a folder to a project, Stralos checks it regularly (about every 15 minutes) and stores a link and the file details listed in section 2.4 for each file. We use them to show the files in the project, to tell you when a file has changed or been removed, and to let you open it.
• A copy only when a file is opened. Stralos fetches a file's contents only when someone in your organisation opens it in Stralos, or when Stralos prepares documents that a project is already using so that they open faster. The copy goes directly from Google or Microsoft into our Amazon Web Services storage in Sydney, is scanned for malware, and is served from there. Google Docs, Sheets and Slides are converted to PDF or Excel format when they are fetched.
• Versions. Each time a file is opened, Stralos asks the drive whether it has a newer version. A newer version is fetched as a new copy beside the old one, so work already based on the old version is not changed underneath you.
• Purpose. We use this information only to provide the connected-drive features you use in Stralos: listing, opening, version tracking, and any processing you choose (section 5).

Who can see it

• People in your organisation who use Stralos, subject to the permissions your organisation sets. Only admins can connect, add or map drives.
• Stralos staff. Our staff admin portal does not display your documents. Staff can see your company's data in the Service, including files fetched from your drives, only by signing in to your company as one of your users. Only authorised Stralos support staff can do this, and only while your company allows it: your company's admins can turn support sign-in off at any time under Settings → Support access. Each sign-in must state a reason, lasts no more than one hour, and is recorded with the staff member, the user, the company and the reason. Your company's admins can see every support sign-in, and every change our staff make to a person's email address or access, under Settings → Support access in Stralos. We do this only when you ask us to (for example, for support), when it is necessary for security (for example, investigating abuse or a bug), or when the law requires it. Direct access to our production systems is restricted to authorised staff and is logged (section 9). Our Support Access Policy explains this in full.
• We do not give this information to anyone else, except the sub-processors in section 4 that we need to provide these features: Amazon Web Services stores and scans copies, and the AI model provider receives only what section 5 describes.

How long we keep it

• Copies not used in Stralos are deleted 30 days after they were last opened. If you open the file again, Stralos fetches it again.
• Copies used in Stralos (for example, processed, or used in an estimate or schedule) are kept as part of your organisation's data, like an uploaded document, even if the file later changes or is deleted in your drive, because your records depend on them. Stralos tells you when the drive's file has changed or has been removed. You can delete these copies in Stralos.
• Links and file details are kept while the drive stays connected and mapped, and are deleted with the rest of your organisation's data (section 10).

How to disconnect or revoke access

• In Stralos: an organisation admin opens Settings → Shared drives and chooses Disconnect. Stralos stops reading that provider's drives straight away. You can reconnect within 30 days. After 30 days, we delete your organisation's Google service account, or release the link between your organisation and your Microsoft 365 tenant.
• In Google Drive: remove the Stralos address from the shared drive's members.
• In Microsoft 365: remove the Stralos app's grant on a SharePoint site, or remove Stralos entirely by deleting the "Stralos Drive Sync" enterprise application in the Microsoft Entra admin center.

Revoking access stops Stralos reading your drives. It does not delete the links and copies already in Stralos. You can delete those in Stralos, or ask us to (section 11).

Google API Services: Limited Use

Stralos's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace APIs will adhere to the Google Workspace API User Data Policy, including the Limited Use requirements. In particular, for information we receive from Google Drive:

• we use it only to provide the connected-drive features described in this section, which are visible in Stralos;
• we transfer it only to provide those features (to the sub-processors described above), for security purposes, to comply with the law, or as part of a merger, acquisition or sale of our business after obtaining your explicit prior consent;
• we do not sell it, use it for advertising, or use it to decide creditworthiness or for lending;
• we do not use it to create, train or improve any machine learning or artificial intelligence model; and
• our staff do not read it except as described under "Who can see it" above: when you ask us to, for security purposes, or to comply with the law.

Microsoft Graph

Stralos reads SharePoint through Microsoft Graph, under the Microsoft APIs Terms of Use. Information we receive from Microsoft Graph is handled in the same way as information from Google Drive: we use it only to provide the connected-drive features, we do not sell it or use it for advertising, and we do not use it to train AI models.

7. Storage and overseas disclosure

The Service's data, including customer data and documents (including copies fetched from connected drives), is stored in Amazon Web Services' Sydney, Australia region. Your live information and backups are kept in Australia. Our website's register-interest and sign-up attribution data is held by Cloudflare in its Oceania location. Connected drives themselves stay with Google or Microsoft, in the locations your organisation's agreement with them provides.

Some service providers in section 4 process information in the United States, the European Union or elsewhere. Those providers hold and process information only on our behalf, to provide the Service to us, and not for their own purposes. Under section 11 of the Privacy Act 2020 this is not a disclosure to them for the purposes of IPP 12 (cross-border disclosure): we remain responsible for the information, and we use contracts that require each provider to protect it.

Website analytics. PostHog processes website analytics in the European Union. Google processes Google Analytics and Google Ads information in the United States and other countries, as our service provider under its data processing terms. Google may also use some of this information for its own purposes, such as keeping its services secure and improving them, under Google's privacy policy; see how Google uses information from sites that use its services. To that extent it is a disclosure to Google overseas, and the laws of the United States and other countries where Google operates may not protect personal information in a way comparable to the Privacy Act 2020. If you do not want this, you can turn analytics off (see section 8).

8. Cookies and similar technologies

Turning analytics off. Google Analytics and PostHog load when you visit our website; we do not ask first. You can turn them off for the browser you are using. While they are off, neither loads, and turning them off removes their cookies and local storage from this browser. The setting is kept only in this browser, so set it again on another browser or device, or if you clear your browsing data.

You can also use Google's Google Analytics opt-out browser add-on, which stops Google Analytics on every website, and choose how Google uses information for ads in your Google ad settings.

You can also block or delete cookies in your browser settings. Blocking the strictly necessary items will stop you signing in.

9. How we protect information

• Data is encrypted in transit (HTTPS/TLS) and at rest (encrypted databases and file storage).
• Each customer's data is kept separate using database-level row security.
• Passwords are handled by Amazon Cognito and never stored by us in readable form; passkeys and authenticator-app multi-factor sign-in are available.
• Uploaded files, and files fetched from connected drives, are scanned for malware.
• For connected drives, Stralos uses a separate, read-only identity for each customer organisation, and holds no passwords or stored keys for your Google or Microsoft accounts: it uses short-lived credentials issued each time it connects.
• Access to production systems is restricted to authorised staff and is logged.
• Only authorised Stralos support staff can sign in to your company, only while your company allows it, each time with a reason and for no more than one hour, and your company's admins can see every support sign-in and change under Settings → Support access. See our Support Access Policy.

Privacy breaches. If we have a privacy breach that it is reasonable to believe has caused or is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and affected people as soon as practicable, as required by Part 6 of the Privacy Act 2020. Where the breach affects customer data we hold on a customer's behalf, we will tell the customer within 72 hours of becoming aware of it and help them meet their own obligations.

10. How long we keep information

How deletion works

When a user deletes something in Stralos, it is first removed from view and kept so it can be restored and so project history stays accurate (for example, records referenced by a submitted estimate). Projects are archived rather than deleted. This means an in-app "delete" does not immediately erase the information.

If you ask us to erase personal information, or a customer asks us to erase its data when it leaves, we will permanently delete or de-identify it from our live systems within 30 days of confirming the request, except where we must keep it by law. Confirmed erasure requests are carried out by our team within 30 days. Scheduled deletion jobs run weekly to enforce the retention periods above. Copies in point-in-time database backups are overwritten as the 30-day backup cycle runs. From November 2026, copies in our locked monthly and yearly database backups are kept for 12 months and 7 years and cannot be deleted before then.

11. Your rights

You have the right to ask for access to the personal information we hold about you (IPP 6) and to ask us to correct it (IPP 7). You can also ask us to delete it or to stop sending you marketing. Email privacy@stralos.co.nz. We will respond within 20 working days, as the Privacy Act requires. We may need to verify your identity. There is no charge for most requests.

If your information is held in a customer's Stralos account (for example you are an employee or a contact of one of our customers), please contact that organisation. If you contact us, we will pass your request to them and help them respond.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

12. Children

Stralos is a business service and the website is not directed at children. We do not knowingly collect personal information from anyone under 16.

13. Changes to this policy

We may update this policy. We will post the new version here with a new effective date and, for material changes, tell account holders by email or in the app before the change takes effect.

Version history

• Version 1.5, 28 October 2026: describes first-touch attribution for every completed open beta sign-up, the email and company stored with it, and its three-month retention. Confirms that planned remarketing and Meta/LinkedIn tracking are not enabled. Sections 6 and 9 explain the support sign-in controls, customer-visible access records and new Support Access Policy.
• Version 1.4, 22 October 2026: our website now uses Google Analytics 4 and PostHog when you visit, without asking first, and section 8 explains how to turn them off in your browser. Section 2.1 describes website analytics, session recordings and Google Ads conversion measurement, including the campaign details and ad click identifier we keep with an open beta sign-up, and the click identifier and sign-up or register-interest time we send to Google Ads. Section 4 adds Google Analytics and Google Ads to the sub-processor list. Section 7 says where website analytics are processed and when Google may use them for its own purposes. Section 8 lists the analytics cookies and how long they last.
• Version 1.3, 21 October 2026: section 10 now describes our database backups as they are: point-in-time backups kept for 30 days on a rolling basis and, from November 2026, a locked monthly copy kept for 12 months and a locked yearly copy kept for 7 years, which cannot be deleted early. "How deletion works" says how long deleted information can remain in each kind of backup. Section 7 now says that your live information and backups are kept in Australia.
• Version 1.2, 28 September 2026: added section 6 on connected drives (Google Drive and Microsoft SharePoint): what Stralos can access, what it stores and why, who can see it, how long it is kept, and how to disconnect or revoke access, with Google's Limited Use disclosure and our handling of Microsoft Graph data. Section 4 now says that Google Drive and SharePoint are services your organisation connects, not our sub-processors; the sub-processor list is otherwise unchanged, and section 4 now points to your right to object to a new sub-processor in our Terms of Service. Section 5 adds AI suggestions of which documents to process, which use file names and folder paths only. Section 10 adds retention periods for connected-drive copies, links and connections. Sections 6 to 13 are renumbered 7 to 14.
• Version 1.1, 27 September 2026: described how deletion and retention work as built, including when deleted customer data leaves our live systems and that billing contacts remain on invoices already issued.
• Version 1.0, 26 September 2026: first published.

14. Contact our Privacy Officer

Privacy Officer: Graeme Ainsworth, Director
Email: privacy@stralos.co.nz
Post: Privacy Officer, Stralos Limited (company number 9442335, NZBN 9429053795076), 105 Verona Place, RD 2, Ohoka 7692, New Zealand

To report a security concern or suspected unauthorised access, email security@stralos.co.nz.