Privacy Policy
Last updated: September 08, 2026
This policy explains what personal data Strice processes, why, who we share it with, and how you exercise your rights. It covers both the people who use the platform and the people whose data our customers record in it.
1. Who the controller is
The Strice platform is operated by O2 Serviços de Tecnologia e Inteligência Comercial Ltda., registered under Brazilian tax ID (CNPJ) 61.351.788/0001-75, with its registered office at Av. Doutor Pedro Jordão, 419, Maurício de Nassau, Caruaru/PE, CEP 55.012-640, Brasil("we", "Strice").
Two distinct roles. This determines who you should address each request to, so it comes first:
- We are the controller of data about the people who buy and use the platform: user accounts, billing details, access and usage logs, and visits to this website.
- We are a processor for the data our customers enter into or connect to the platform: their clients, leads, contacts, WhatsApp conversations, documents and calendars. There, the controller is the organisation that subscribed to Strice, and we process that data only on its instructions and under our contract.
If a company that uses Strice contacted you and you want to exercise rights over your data, send the request to that company first. If you do not know who to approach, write to us at privacidade@strice.com.br and we will route it to the relevant controller.
Data Protection Officer (Brazilian LGPD, art. 41): requests addressed to the data protection officer should be sent to privacidade@strice.com.br.
2. Data we process
2.1 Data about platform users
- Account: name, email, phone, profile picture, job title and organisation.
- Authentication: credentials managed by Supabase Auth. We never store passwords in clear text; the session travels in an
httpOnlycookie and never inlocalStorage. - Usage and audit: sign-in timestamps, IP address, user agent and a record of significant actions taken in the platform (who created, changed or deleted what).
- Billing: subscription and payment details. Full card data is handled directly by the payment provider and never passes through our servers.
- Preferences: language, theme, notification settings and browser push subscriptions.
2.2 Data our customers record in the platform
The content below belongs to the organisation that subscribed to Strice. We host and process it on their behalf:
- Clients, leads and contacts: name, company, phone, email, address, commercial history, custom fields the organisation itself defined, notes and pipeline stages.
- WhatsApp conversations: the contact's number and identifier, display name, profile picture, the content of messages sent and received, media files, group details and the team's internal annotations about the conversation.
- Calendar: events, participants, times, meeting links and availability, synchronised with Google Calendar or Outlook when the user connects an account.
- Meeting transcripts: where the organisation enables the integration, the text of transcripts produced by Google Meet or Microsoft Teams for meetings the connected user organised.
- Documents and files: proposals, contracts, task and conversation attachments, and library material.
- Finance and delivery: projects, tasks, time entries, service orders, recurring contracts and charges.
2.3 Data about visitors to this website
This site is static, with no forms and no logged-in area. Only the technical delivery data of the network itself is recorded (IP address, user agent), plus the Cloudflare Turnstile bot check where applicable.
3. Where the data comes from
- Directly from you, when you use the platform or fill in a form inside it.
- From the organisation that subscribed to Strice, when it creates or imports records.
- From the platforms a user connects with their own authorisation: Meta (WhatsApp), Google, Microsoft, Conta Azul and e-signature providers. Every connection requires explicit consent on the provider's own screen.
- Automatically, from platform use: access logs, audit records and technical metrics.
4. What we use it for
- Deliver the subscribed service and the enabled modules.
- Authenticate users and enforce the permissions the organisation defined.
- Synchronise calendar, messages, documents and financial data with the integrations the customer switched on.
- Send operational notifications (email, browser push, in-product alerts).
- Invoice, collect payment, and prevent fraud and abuse.
- Maintain an audit trail and information security.
- Diagnose defects and improve product stability.
- Comply with legal and regulatory obligations.
What we do not do: we do not sell personal data, do not share it for third-party advertising, do not use our customers' content to train artificial intelligence models, and have no generative AI provider processing production data.
5. Legal bases
| Processing | Legal basis (LGPD) |
|---|---|
| Providing the platform to the subscribing customer | Performance of a contract (art. 7, V) |
| User accounts and authentication | Performance of a contract (art. 7, V) |
| Connecting Google, Microsoft, Meta and Conta Azul accounts | Consent of the data subject (art. 7, I) |
| Access logs and audit trail | Legal obligation (art. 7, II; Brazilian Internet Act, art. 15) and legitimate interest (art. 7, IX) |
| Security, fraud prevention and defect diagnosis | Legitimate interest (art. 7, IX) |
| Billing and tax obligations | Legal obligation (art. 7, II) |
| Data our customers record about third parties | Determined by the customer as controller. We act as processor. |
6. Third-party integrations
Every integration is optional, switched on by the organisation or the user, and can be disconnected at any time in the platform settings. Access tokens are stored encrypted.
6.1 Meta · WhatsApp Business Platform
When an organisation connects a WhatsApp number, we receive and store the messages exchanged on that number, the contact's identifier and phone number, display name, profile picture, media files, and delivery and read metadata. We use this data solely to display and operate customer service inside that organisation's account.
We do not use WhatsApp data for advertising, do not resell it, and do not share it with other organisations on the platform. Meta's own processing follows Meta's policies.
6.2 Google · Limited Use disclosure
When a user connects a Google Account, we request the following scopes:
| Scope | Why it is needed |
|---|---|
calendar and calendar.events | Read and write the user's events, to keep the Strice calendar and Google Calendar in two-way sync. |
userinfo.email | Identify which account was connected and bind it to the right user. |
meetings.space.readonly | Resolve the Google Meet meeting behind an event, in order to fetch the transcript of a meeting the user themselves organised. |
drive.readonly | Fallback path for reading the transcript file Meet writes to the organiser's Drive when the Meet API does not return it. Used only to locate that transcript artifact. |
Limited Use. Strice's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: data obtained from those APIs is used only to provide and improve user-facing features for the user who granted access; it is not transferred to others except as necessary to provide those features, to comply with applicable law, or as part of a merger or acquisition with proper notice; it is not used for advertising; and no humans read it, except with the user's express consent, for security purposes, to comply with applicable law, or where the data is aggregated and anonymised.
6.3 Microsoft · Graph
When a user connects a Microsoft account, we request:
| Permission | Why it is needed |
|---|---|
Calendars.ReadWrite | Two-way sync of events between Outlook and the Strice calendar. |
User.Read | Identify the connected account. |
offline_access | Refresh access without asking the user to sign in again on every token expiry. |
OnlineMeetings.Read | Resolve the Teams meeting from the event's join link. |
OnlineMeetingTranscript.Read.All | Read transcripts of meetings organised by the connected user. |
The last two permissions are requested only when the organisation enables transcript capture. Without them, the calendar integration works normally.
6.4 Other integrations
- Conta Azul: financial synchronisation, when the organisation connects the account. Client, service and ledger data moves between the two systems.
- ZapSign and D4Sign: electronic signature. We send the document and the signatory details the organisation provided.
7. Who we share it with
We share data only with the processors required to run the service, under contract and limited to the stated purpose. This is the complete list:
| Provider | Purpose | Processing location |
|---|---|---|
| Supabase | Database and authentication | Brazil (São Paulo) |
| Fly.io | Application servers, background processing and cache | Brazil (São Paulo) |
| Cloudflare | CDN, delivery of this site and of the app, file storage (R2) and bot protection (Turnstile) | Global network |
| Resend | Transactional email delivery | United States |
| PostHog | Error diagnostics and session replay for debugging | United States |
| Stripe | Payment processing | United States |
| Meta Platforms | WhatsApp Business Platform | Global network |
| Calendar, Meet and Drive, when connected | Global network | |
| Microsoft | Outlook and Teams, when connected | Global network |
| Conta Azul | Financial integration, when connected | Brazil |
| ZapSign / D4Sign | Electronic signature, when connected | Brazil |
We may also disclose data to comply with a court order or a request from a competent authority, and to exercise or defend rights in legal proceedings. In a corporate reorganisation, data may transfer to the successor under the terms of this policy.
About session replay. We use PostHog to understand reported defects. The recorder is configured to mask all form inputs and all on-screen text. What leaves the browser is the page structure and the sequence of interactions, not our customers' content.
8. International transfers
The database, application servers and cache are located in Brazil (São Paulo region). Some processors in the table above handle data outside the country, notably in the United States. Those transfers rely on art. 33 of the LGPD and are covered by contractual clauses providing protection equivalent to Brazilian law.
9. How long we keep it
While an organisation's subscription is active, the data it recorded stays available in its account. Some data is additionally purged automatically:
| Data | Window |
|---|---|
| Archived leads | 30 days after archiving |
| Library activity history | 90 days |
| Notification dispatch records | 7 days |
| Idle push subscriptions | 30 days without use |
| Audit trail | 18 months |
Once a subscription ends, account data is deleted as described under Data deletion, except records the law requires us to keep: application access logs for 6 months (Brazilian Internet Act, art. 15) and tax documents for the periods set by tax legislation.
10. Security
- Encrypted traffic in transit (TLS) on every connection.
- Integration credentials encrypted at rest with a dedicated key.
- Session held in an
httpOnly,secure,sameSitecookie; no authentication token is reachable by page scripts. - Tenant isolation enforced at the query layer: every read of customer data is filtered by the requester's organisation.
- Granular access control per module and per record, defined by the organisation itself.
- Audit trail of significant actions, with integrity verification.
- Bot verification and rate limiting on public entry points.
No system is immune to incidents. If a security incident occurs with material risk to data subjects, we will notify the affected controllers and the Brazilian data protection authority (ANPD) under art. 48 of the LGPD.
11. Your rights
Under art. 18 of the LGPD, you may request:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or out-of-date data;
- anonymisation, blocking or deletion of unnecessary data or data processed unlawfully;
- portability to another provider;
- deletion of data processed on the basis of consent;
- information about who we share your data with;
- information about the option not to consent and what follows from it;
- withdrawal of consent;
- objection to processing carried out on the basis of legitimate interest.
Write to privacidade@strice.com.br. We respond within 15 days. We may ask for additional information to verify your identity before acting. That is how we stop someone else from obtaining or erasing your data by impersonating you.
Where the data belongs to one of our customers and we act as processor, we forward the request to the controller and tell you we did.
12. Data deletion
You can request deletion of your data at any time. Full instructions, including per connected platform, are on the dedicated page: Data deletion.
In short:
- Disconnect an integration: in the platform settings. On disconnect, that provider's access tokens are deleted immediately.
- Delete your user account: ask your organisation's administrator, or write to privacidade@strice.com.br.
- Delete the whole organisation account: the request must come from an account owner and is completed within 30 days.
13. Cookies
We use the minimum necessary, with no advertising cookies and no cross-site tracking:
| Type | What for |
|---|---|
| Essential | Keep the authenticated session in the platform and protect against forged requests. |
| Preferences | Remember language, theme and interface choices. |
| Security | Cloudflare Turnstile bot verification. |
| Diagnostics | Identify the session in PostHog error reports, inside the platform. This marketing site does not load that script. |
14. Children
Strice is a business tool and is not directed at anyone under 18. We do not knowingly collect data about children or adolescents. If we identify such data without an adequate legal basis, it is deleted.
15. Changes
We may update this policy. The date of the last revision is at the top of the page. Material changes are announced by email or by an in-product notice before they take effect.
16. Contact
Privacy questions, data subject requests or complaints: privacidade@strice.com.br.
Requests to the data protection officer: privacidade@strice.com.br.
O2 Serviços de Tecnologia e Inteligência Comercial Ltda. · CNPJ 61.351.788/0001-75 · Av. Doutor Pedro Jordão, 419, Maurício de Nassau, Caruaru/PE, CEP 55.012-640, Brasil.
You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD).