Privacy Policy

1. Who this policy covers

This policy describes how STRACT, Inc. processes information through its Services. Different contexts involve different information and responsibilities; not every category is collected from every person.

• Website visitors and prospects who contact STRACT.
• Customer administrators and Authorized Users.
• Suppliers and supplier personnel.
• Candidates and submitted talent.
• Contractors, consultants and engagement personnel.
• Client personnel and other business contacts.

2. Controller and processor roles

STRACT may act as a controller or business for its own website, account administration, business communications, security and legal obligations. When processing Customer Data on behalf of an enterprise Customer, STRACT acts as a processor or service provider under the applicable agreement and documented instructions.

The relevant Customer may determine the purposes and lawful basis for candidate, workforce and engagement processing. Its notices and the applicable Data Processing Addendum govern that processing. An organization’s administrator cannot grant access beyond the permissions actually assigned.

3. Information categories

Depending on the service and enabled workflow, information may include the following:

• Identifiers and contact details: names, business email, telephone numbers, professional identifiers, employer and role.
• Professional and employment information: resumes, skills, qualifications, education, certifications, work history, availability and other authorized recruiting information.
• Account and authentication information: account identifiers, profile details, membership, roles, permissions and acceptance records where collected.
• Organization and supplier information: company details, business contacts, agreements and authorized compliance documents.
• Requirements and submissions: job requirements, candidate evidence, submissions, interview and selection information.
• Engagement and delivery information: assignments, dates, managers, deliverables and enabled time, expense or delivery records.
• Communications: inquiries, support requests, messages, feedback and related business correspondence.
• Technical and security information: device and browser information, IP addresses, session information, logs, security events and service usage.
• Analytics, billing and business transactions where applicable: invoices, rates, budgets, payment status and records handled by authorized payment providers.
• Derived information where applicable: comparisons, summaries, scores, rankings, recommendations and other outputs from authorized Pulse or Signal workflows.

4. Sources of information

We may receive information directly from you, from Customers and their Authorized Users, from suppliers and other authorized business partners, through approved integrations, and from operating the Services. Information must be supplied only with appropriate authority.

Sources and permitted data categories depend on the relationship and enabled workflow. Customers and suppliers are responsible for giving notices and obtaining permissions required for the information they submit.

5. Purposes and legal basis

We process information to provide and support contracted Services, authenticate users, apply permissions, manage authorized workforce workflows, communicate with users and prospects, produce requested reporting and assistance, handle applicable business transactions, protect the Services, maintain appropriate records and comply with legal obligations.

For our own processing, applicable legal bases may include performance of a contract, legitimate business interests, legal obligations or consent where required. For processing on behalf of a Customer, the Customer determines the lawful basis and gives instructions under its agreement. Information should not be repurposed in conflict with those instructions.

6. Disclosures and service providers

Information may be shared with the relevant Customer, authorized personnel and suppliers within their assigned scope, service providers supporting the Services, professional advisers, or authorities where required or lawfully appropriate. Corporate transactions may involve disclosure subject to applicable safeguards and law.

Service-provider categories may include hosting, storage, authentication, payments, analytics, communications, security and AI. Request the current deployment-specific provider and subprocessor information for diligence; this policy is not a verified complete subprocessor list.

A role or workspace selection is not permission to see another organization’s information. Access and disclosure remain subject to applicable membership, permissions, agreements and law.

7. AI, Signal and candidate information

Authorized AI workflows may process submitted information and selected context to generate assistive summaries, comparisons, scores, rankings or recommendations. Relevant information may be sent to an approved model or service provider where the applicable workflow and agreement permit it.

Humans remain responsible for reviewing evidence, correcting material errors and making consequential decisions. Signal does not make employment, engagement, compensation or termination decisions on behalf of users.

Provider-specific processing, retention and training terms depend on the applicable deployment and agreements. This policy does not provide a blanket no-training or provider-retention guarantee. Ask STRACT about AI processing and available customer controls before enabling a workflow involving sensitive or confidential information.

8. Cookies and optional analytics

The Services may use session and authentication technologies needed for authorized access and operation. On the public website, the cookie notice provides a choice about optional analytics. Optional analytics should be enabled only after the applicable consent choice; declining it does not prevent reading the public website.

You may use the website’s cookie settings and browser controls to manage relevant choices. Blocking essential technologies may affect sign-in or Platform functionality. Contact privacy@stract.us about applicable opt-out rights or browser-signal requests; available controls depend on the technologies deployed.

9. Retention and deletion

Retention depends on the purpose of processing, the applicable Customer agreement, legal requirements and legitimate security, dispute and recordkeeping needs. This policy does not establish a universal retention period for every category of information.

Deletion or account termination may involve staged handling of active records, retained audit history, backups and legally required records. A removed interface record or closed account is not a guarantee of immediate erasure from every retained copy. Contracted export, return and deletion obligations must be confirmed for the applicable deployment.

10. Security and international processing

STRACT uses access controls and other measures intended to protect information. No service can guarantee absolute security. The Data Processing & Security Overview describes the approach without making unverified claims about standards, certifications, audit status or recovery guarantees.

Providers and authorized users may process information in different locations where permitted by the applicable arrangement. Request confirmed locations and any required transfer mechanism through the customer diligence or DPA process. This policy does not promise a specific data-residency region or private infrastructure.

11. Privacy choices and requests

Depending on applicable law and context, you may have rights to access, correct, delete or obtain a portable copy of information, withdraw consent, object to or restrict processing, or opt out of certain processing. Where required, you may appeal a decision on a request or contact the relevant supervisory authority.

Send a request to privacy@stract.us or use the STRACT contact form. Describe the request and relevant relationship without sending credentials or unnecessary sensitive documents. We may need to verify identity and authority, clarify scope, or direct a request to the Customer responsible for the information.

Requests are subject to applicable legal exceptions, response requirements and the rights of others. For candidate or engagement data controlled by a Customer, contact that organization or ask STRACT to help route the request. Correcting a profile does not necessarily change prior decision or audit records.

12. Children and sensitive information

The Services are intended for business and authorized workforce use, not for children. Do not submit children’s information or regulated or highly sensitive categories unless STRACT has expressly agreed to process them in the applicable service and appropriate safeguards and authority are in place.

13. Updates and contact

Policy changes will identify the revised version and dates. Applicable notice, consent and contractual obligations govern material changes. Contact privacy@stract.us for privacy requests or security concerns and legal@stract.us for legal questions. The STRACT contact form provides another inquiry path.