Privacy Policy

This policy describes how SDG Strategy LLC ("StratLab," "we," "us," or "our") collects, uses, and shares information in connection with the StratLab application (the "Service"), available at stratlab.cc and its subdomains.

Who this applies to

This policy covers two kinds of people. First, the people who hold an account and sign in to the Service — typically employees or contractors of a client organization. Second, people who do not hold an account but are asked to contribute information through a link sent by someone at a client organization — for example, answering a readiness survey or being interviewed about how a workflow actually runs. We refer to both simply as "you" below, and note where something applies to only one group.

Information we collect

Account information. When you sign in, our authentication provider, Clerk, collects your name, email address, and the method you used to sign in (including, if you choose it, a Google account sign-in). We receive your name, email address, and which organization(s) you belong to from Clerk; we do not receive or store your password, and if you sign in with Google we do not receive your Google password or see your other Google account activity.

Content you or your organization provide. The Service is built around documenting how a business actually works and deciding where AI can help. Depending on how your organization uses it, this can include: descriptions of business workflows and who performs them; answers to strategy and readiness assessments; interview transcripts, including ones given by a process owner who does not have an account; and the plans, priorities, and roadmaps your organization builds inside the Service. This content can describe real people who work at your organization, whether or not they ever sign in themselves.

Information collected automatically. Our hosting provider, Cloudflare, processes standard technical information for every request — such as IP address, browser type, and request timing — as part of operating and securing the Service. We do not use advertising trackers or third-party analytics scripts.

How we use information

• To provide the Service: authenticate you, store your organization's content, and show it back to the right people.
• To power the Service's AI features. Certain actions — such as brainstorming opportunities, proposing how to group them, extracting a workflow description from an interview transcript, or drafting a roadmap — send the relevant content to Anthropic, our AI provider, for processing. Anthropic processes this content to generate a response for you; see Anthropic's own privacy policy for how they handle it on their end.
• To maintain the security, integrity, and reliability of the Service.
• To communicate with you about your account or the Service when necessary.

The Service is deliberately built not to send unsolicited outreach on your behalf. For example, when someone asks a process owner to validate or be interviewed about a workflow, the Service produces a link for a person at your organization to send themselves, rather than emailing that person directly.

Who we share information with

We do not sell personal information, and we do not share it with advertisers. We share information with the following service providers, each of whom processes it only to provide their service to us:

• Clerk — authentication, session management, and account/organization data.
• Anthropic — processes content you submit to AI-assisted features, as described above.
• Cloudflare — hosting, database storage, and network security.

We may also disclose information if required by law, or to protect the rights, property, or safety of StratLab, our users, or others.

Data from people without an account

If you were sent a survey or interview link by someone at an organization using the Service, your responses are stored and used the same way as content entered by an account-holder at that organization, including being processed by Anthropic where an AI-assisted feature is used on it. We do not use your responses to contact you unless the person who sent you the link chooses to.

Data retention

We retain information for as long as your organization's account is active, or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. You can request deletion of your personal information as described below.

Your choices

You can request access to, correction of, or deletion of your personal information by contacting us at the address below. If you reached the Service through a survey or interview link and never created an account, you can make the same request; we will need enough information to locate your specific responses.

Security

We use reasonable technical and organizational measures to protect information, including relying on Clerk and Cloudflare's security practices for authentication and hosting. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children's privacy

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal information from children.

International data

Our service providers operate infrastructure in multiple countries. By using the Service, you understand that information may be processed outside the country where you or your organization are located.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the date at the top of this page.

Contact us

Questions about this policy, or requests regarding your information, can be sent to russ@sdgstrategy.com.

Terms of Service →