Effective Date: 11 April 2026 · Last Updated: 14 April 2026
Alfrada is a trading name of Strategize and Insight Practice Limited, a company incorporated in England and Wales (Company No. 14032259), with its registered office at Unit 1 Camboro Business Park, Oakington Road, Girton, Cambridge, England, CB3 0QH (the "Company", "we", "us", or "our").
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the Data Controller of the personal data we collect through our platform at app.alfrada.ai and our marketing websites at alfrada.com, alfrada.ai, and strategize.inc (collectively, the "Service").
Data Protection Contact: privacy@strategize.inc
We collect and process the following categories of personal data:
When you register for an account, we collect your name, email address, and (if applicable) company name. If you subscribe to a paid plan, payment information is collected and processed by our payment processor, Stripe, and is not stored on our servers.
The Service enables you to submit text prompts, upload documents, images, audio files, and other content ("User Content"). User Content may contain personal data if you choose to include it. We process User Content solely to provide the Service to you.
We store your conversation history, AI-generated responses, and contextual memory data to provide a personalised and persistent experience. This data is stored on servers located in the European Union (see Section 6).
We automatically collect limited technical data, including IP address (for rate limiting and security), browser type and version, device information, and timestamps of access. We do not use third-party analytics or tracking services on the Alfrada application (app.alfrada.ai).
On our marketing websites (alfrada.com, alfrada.ai, strategize.inc, strategizelabs.com), we use analytics cookies — only with your consent — to collect aggregated data about page views, traffic sources, scroll depth, and session behaviour. The sole purpose is to understand which marketing channels drive visitors to our site so that we can optimise acquisition spend and control customer-acquisition costs. This data is not linked to your Alfrada application account. See our Cookie Policy for the specific technologies used.
We store third-party credentials in our encrypted Vault. If you connect third-party accounts (e.g., Google Calendar, Microsoft, Slack), OAuth authentication is handled by Composio (Privacy Policy), which manages token exchange and renewal on our behalf. We do not store your passwords for these services.
Under Article 6 of the UK GDPR, we process your personal data on the following legal bases:
| Purpose | Lawful Basis |
|---|---|
| Providing the Service (account management, conversation processing, tool execution) | Contract — Art 6(1)(b): necessary for the performance of a contract to which you are party |
| Processing payments | Contract — Art 6(1)(b) |
| Security, fraud prevention, and abuse detection | Legitimate Interest — Art 6(1)(f): our legitimate interest in protecting the Service and our users |
| Sending transactional communications (e.g., account verification, billing) | Contract — Art 6(1)(b) |
| Complying with legal obligations (e.g., tax, financial regulation) | Legal Obligation — Art 6(1)(c) |
| Marketing website analytics for channel optimisation and cost control | Consent — Art 6(1)(a): analytics cookies are only activated after you click "Accept analytics" in the cookie banner. You may withdraw consent at any time (see Cookie Policy). |
We do not rely on consent as a lawful basis for core Service processing. We rely on consent only for marketing website analytics cookies, which you may withdraw at any time.
We do not:
To provide the Service, we share personal data with the following categories of third-party processors. Each processes data solely on our instructions and subject to contractual data protection obligations.
When you use the Service, your prompts may be sent to one or more AI model providers for inference. These providers act as data processors and contractually commit to not using your data for model training.
| Provider | Location | Data Handling |
|---|---|---|
| OpenAI, LLC | United States | API data not used for training. 30-day abuse monitoring retention. DPA |
| Anthropic (via API / AWS Bedrock) | United States / EU (London) | API data not used for training. 30-day retention. DPA |
| Google (Gemini API, paid tier) | United States | Paid tier: data not used for training. 55-day abuse monitoring. Terms |
| OpenRouter, Inc. | United States | Prompts not stored by default. We set data_collection: deny. Privacy |
We also run open-source AI models locally on our EU-based infrastructure (see Section 6), in which case your data does not leave our servers.
| Provider | Location | Purpose |
|---|---|---|
| Exoscale (Akenes SA) | Switzerland / EU (Frankfurt, DE) | Cloud compute, GPU servers, storage. Privacy · DPA |
| Amazon Web Services (Bedrock) | EU (London, eu-west-2) | AI inference for Anthropic models. DPA |
| Daytona Platforms, Inc. | EU (Frankfurt) | Sandboxed code execution. Privacy |
| Provider | Location | Purpose |
|---|---|---|
| Stripe, Inc. | EU (Ireland) / US | Payment processing. Privacy · DPA |
| ElevenLabs, Inc. | US / Netherlands (auto-routed) | Text-to-speech generation. Privacy |
| Composio (SWE Labs, Inc.) | United States | Third-party app integrations (OAuth). Privacy |
| Tavily (AlphaAI Technologies) | United States | Web search for AI agents. Privacy |
| SearchAPI.io | United States | Search engine results. Privacy |
| Apify, s.r.o. | United States | Web content extraction. Privacy |
| Zyte Group Limited | United States | Web extraction fallback. Privacy |
| Browserbase, Inc. | United States | Cloud browser sessions. Privacy |
| SunoAPI (sunoapi.org) | Not disclosed | AI music generation. Terms |
| Runway AI, Inc. | United States | AI video generation (text-to-video, image-to-video). Privacy |
| Context7 (Upstash) | US / EU | Developer documentation retrieval. Privacy |
| WeatherAPI.com (Zoomash Ltd) | United Kingdom | Weather data lookups. Privacy |
The following providers process data only on our marketing websites (not the Alfrada application) and only after you consent via the cookie banner. Data is used exclusively for marketing channel attribution and cost control.
| Provider | Location | Purpose |
|---|---|---|
| Google LLC (Google Analytics 4 via Google Tag Manager) | United States / EU | Aggregate page-view and traffic-source analytics. Privacy |
| Microsoft Corporation (Clarity) | United States / EU | Heatmaps, scroll maps, and anonymous session recordings for UX analysis. Privacy |
| LinkedIn Corporation (Insight Tag) | United States | LinkedIn campaign conversion measurement. Privacy |
Our primary infrastructure is hosted by Exoscale in the European Union:
When you use cloud-based AI models (OpenAI, Anthropic, Google, OpenRouter), your prompts are transmitted to servers in the United States (or, for Bedrock, the EU). These transfers are governed by:
For smaller functional service providers where a formal DPA or transfer mechanism is not yet in place, we rely on Article 49(1)(b) of the UK GDPR (transfer necessary for the performance of the contract between you and us) and conduct ongoing assessment of the adequacy of protections offered by those providers.
| Data Category | Retention Period |
|---|---|
| Account data (name, email) | Duration of your account. Permanently deleted immediately upon account deletion. |
| Conversation history | Duration of your account. Deletable by you at any time via the Service. Permanently deleted immediately upon account deletion. |
| AI memory and context | Duration of your account. Deletable by you at any time via the Service. Permanently deleted immediately upon account deletion. |
| Uploaded documents and media | Duration of your account. Deletable by you at any time. Permanently deleted immediately upon account deletion. |
| Payment records | 6 years after the relevant transaction, as required by HMRC record-keeping obligations. This is the only data retained after account deletion. |
| Technical logs (IP, access) | 90 days, then automatically purged. Permanently deleted immediately upon account deletion. |
| OAuth integration tokens | Until you disconnect the integration or delete your account. Permanently deleted immediately upon account deletion. |
| Marketing website analytics data | Governed by each provider's retention policy (Google Analytics: 14 months; Microsoft Clarity: 30 days; LinkedIn: up to 180 days). We do not store analytics data on our own servers. You can prevent collection by rejecting analytics cookies or withdrawing consent. |
Data transmitted to AI model providers is subject to their respective retention policies (typically 30–55 days for abuse monitoring, then deleted). We do not control retention by third-party processors beyond the terms of their DPAs.
Under the UK GDPR, you have the following rights in relation to your personal data:
| Right | Description |
|---|---|
| Access (Art 15) | Request a copy of the personal data we hold about you. |
| Rectification (Art 16) | Request correction of inaccurate or incomplete personal data. |
| Erasure (Art 17) | Request deletion of your personal data ("right to be forgotten"). |
| Restriction (Art 18) | Request that we restrict the processing of your personal data. |
| Portability (Art 20) | Request your data in a structured, commonly used, machine-readable format. |
| Objection (Art 21) | Object to processing based on legitimate interests. |
| Withdrawal of Consent (Art 7(3)) | Where processing is based on consent, withdraw it at any time. |
To exercise any of these rights, please contact us at privacy@strategize.inc. We will respond within one calendar month of receiving your request, as required by law. We may request proof of identity before processing your request.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
We implement appropriate technical and organisational measures to protect personal data, including:
The Alfrada application (app.alfrada.ai) uses only strictly necessary cookies for authentication and session management.
Our marketing websites (alfrada.com, alfrada.ai, strategize.inc, strategizelabs.com) additionally use analytics cookies — with your consent — for the sole purpose of marketing channel optimisation and customer-acquisition cost control. We do not use advertising, retargeting, or behavioural profiling cookies. For full details, including a table of every cookie we set and how to withdraw consent, see our Cookie Policy.
The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that data promptly.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. Material changes will be communicated via the email address associated with your account or via a prominent notice on the Service. The "Last Updated" date at the top of this page indicates when this policy was last revised.
This Privacy Policy and any dispute or claim (including non-contractual disputes or claims) arising out of or in connection with it, its subject matter, or its formation shall be governed by and construed in accordance with the laws of England and Wales.
Each party irrevocably agrees that the courts of England shall have exclusive jurisdiction to settle any such dispute or claim. By using the Service, you submit to the exclusive jurisdiction of the courts of England and waive any objection to proceedings in such courts on the grounds of venue or on the grounds that proceedings have been brought in an inconvenient forum.
If you have any questions about this Privacy Policy or our data practices, please contact us:
© 2026 Strategize and Insight Practice Limited. All rights reserved.