Privacy Policy

Stride Labs Ltd. ("Stride", "we", "us") makes a people platform: an admin console for organizations, a member portal for their employees, work tracking, and optional company email on the organization's own domain. This policy explains what personal information we handle when you visit our website or use the hosted service, and what we do with it.

If your organization runs Stride on its own servers, that organization, not Stride Labs Ltd., decides how the data is used and is responsible for it. Ask your administrator for their privacy notice.

We act in two different capacities, and the difference matters for your rights:

• Controller. For information about the people who sign up for or manage a Stride account (names, work emails, billing contacts), website visitors, and the security of the service, we decide why and how the data is used.
• Processor. For the HR and workspace data an organization puts into Stride about its own people (profiles, leave, teams, projects, mailboxes), we process it only on that organization's instructions under our agreement with it. The organization is the controller of that data.

If you are an employee and want to see or correct your own HR data, ask your employer first. We will help them respond.

Information you or your organization give us:

• Account details: name, work email address, password (stored only as a salted hash), role, profile picture and language, theme and time-zone preferences.
• Organization details: organization name, handle, logo and brand colours, and which email domains it connects.
• People data an organization enters: job title, department, manager, employment dates, phone and address, emergency contact, team membership, leave requests and decisions.
• Work data: projects, issues, comments and attachments created in work tracking.
• Email: messages, drafts and attachments in mailboxes the organization sets up on its own domain, and the DNS records and DKIM keys that make that work.
• Messages you send us: support requests and sales enquiries.

Information collected automatically:

• Sign-in and session records: the time, IP address, browser and operating system for each session, so you can review and sign out devices.
• Audit records: who did what, when, and the before and after values of changes made in the admin console, which administrators can review.
• Basic technical logs: request time, path, status and a request identifier, kept to run, secure and debug the service.

We do not buy personal information about you from data brokers.

• To provide the service: authenticate you, show your organization's workspace, route email, and apply the permissions your administrators set.
• To keep it secure: detect and block abuse, rate-limit sign-in attempts, lock out brute-force attacks and investigate incidents.
• To communicate with you: verification codes, password resets, leave decisions and other notifications the product sends on your organization's behalf, plus service announcements.
• To support you and improve the product, using aggregated or de-identified information wherever possible.
• To meet legal obligations and to establish, exercise or defend legal claims.

We do not sell personal information, and we do not use the content of an organization's HR data, work data or email for advertising or to train machine-learning models.

Where data protection law requires a legal basis, we rely on:

• Contract, to provide the service to you or your organization.
• Legitimate interests, to secure and improve the service and to communicate about it, balanced against your rights.
• Legal obligation, where the law requires us to keep or disclose information.
• Consent, in the few cases we ask for it. You can withdraw it at any time.

We share personal information only as needed to run the service:

• Infrastructure providers that host our databases, servers and backups.
• Resend, which delivers transactional email such as verification codes and password resets.
• Amazon Web Services (Amazon SES), which relays outbound mail sent from an organization's own email domain.
• Professional advisers, auditors and insurers under duties of confidentiality.
• Authorities, when we are legally required to, or to protect people's safety or the security of the service. Where we can, we will tell the affected organization first.
• A successor, if we are involved in a merger, acquisition or sale of assets, with the same protections for your information.

Within an organization, information is visible according to the roles and permissions its administrators configure. For example, colleagues can see the people directory, but only people with the right permission can see leave queues or audit logs. We keep a current list of sub-processors; ask [email protected] for it.

Stride Labs Ltd. operates from Lisbon and London, and our providers may process data in other countries. When personal information leaves the EEA or the UK, we rely on an adequacy decision or on standard contractual clauses and additional safeguards where needed.

We use a small number of cookies and browser storage entries, all of them necessary to run the product or remember your choices:

• A session cookie that keeps you signed in. It is HTTP-only and expires after a period of inactivity or when you sign out.
• A short-lived cookie that carries your progress while you set up a new workspace.
• Preference entries, such as light or dark theme and whether the sidebar is collapsed.

We do not use advertising or cross-site tracking cookies. Because these cookies are strictly necessary, we do not show a cookie banner for them.

• Account and workspace data: for as long as the organization's account is active, and for a short period afterwards so it can export or recover it.
• Deleted users: when an administrator deletes a person, we remove their access and replace their name and email with anonymous values, keeping only the records an organization needs to preserve its own history (for example, who created an issue).
• Sessions: they expire automatically, and you can end them yourself at any time.
• Audit records: kept for as long as the organization's account is active, unless a shorter retention period is configured for the service.
• Email: kept until the organization or the mailbox owner deletes it.
• Backups and logs: deleted on a rolling schedule.

We may keep information longer when the law requires it or when needed to resolve a dispute.

• Passwords are hashed with a modern, salted algorithm and are never stored in readable form.
• Connections are encrypted in transit. Sensitive secrets such as email signing keys and mailbox credentials are encrypted at rest.
• Each organization's data is isolated from every other organization's, and access inside an organization is limited by role and permission.
• We rate-limit and lock out repeated sign-in attempts, sanitize email content before display, and keep audit trails of administrative actions.

No system is perfectly secure. If we learn of a breach that affects your information, we will notify the organization and, where required, the authorities, without undue delay.

Depending on where you live, you may have the right to access your information, correct it, delete it, restrict or object to some processing, receive a portable copy, and withdraw consent. You can also lodge a complaint with your local data protection authority.

• To use a right over data about your employment or your use of your organization's workspace, contact your organization's administrator.
• To use a right over information we hold as a controller, email [email protected]. We may need to verify your identity, and we will reply within the time the law allows.
• You can review and end your own sessions from your account settings, and you can change your name, picture and preferences there.

Stride is a workplace product for adults. It is not directed to children, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

Stride is open source and can run on your own infrastructure. In that case Stride Labs Ltd. does not receive your workspace data. The organization that operates the deployment is the controller and is responsible for its own privacy notices, security and retention.

We will post updates here and change the date at the top. If a change is significant, we will also notify organization administrators by email or in the product before it takes effect.

Questions or requests about privacy: [email protected].

Stride Labs Ltd., Lisbon and London.