1. What we collect
We collect only what we need to provide and improve Stategram:
- Account data: name, email, organization name, billing details (handled by Stripe).
- Service data: state machine definitions you author, object state pointers, decision receipts, and webhook URLs you configure.
- Usage data: API request metadata (timestamps, response codes, endpoint), IP address, browser/SDK version, error logs.
- Marketing data: if you sign up for our waitlist or product updates, your email address and the source you came from.
- Contact requests: if you use the contact form, or leave your email at the end of a page for a walkthrough, what you send (your email, and your name, company, message and the options you pick if you give them) and the page of this website you came from, so we can reply.
- Website visits: only if you allow it, the pages you open on this website and how far you read them, under a random visit number (see section 7).
We do not store the contents of business records (proposals, refunds, support tickets, customer PII) unless you explicitly include them in evidence fields.
2. Legal basis (GDPR)
- Contract — to provide the service you've signed up for, and to answer when you ask us about it.
- Legitimate interest — to keep the service secure, prevent fraud, and improve performance.
- Consent — for product marketing emails, and for measuring your visits to this website if you allow it (section 7). You can withdraw consent at any time.
- Legal obligation — for accounting, tax, and lawful regulator requests.
3. How we use it
- Operate the Stategram service and evaluate transitions you request
- Authenticate you and protect your account
- Send transactional notifications (approvals, alerts, receipts)
- Send product updates and tips (only if you opt in)
- Diagnose issues, monitor abuse, and improve reliability
- Comply with legal obligations
We do not sell your data. We do not use customer data to train AI models.
4. Sub-processors
We use a small set of vetted sub-processors. These third parties may process customer data on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Infrastructure hosting | EU (Frankfurt, Germany) |
| Microsoft | Approval routing (only if you connect Teams) | US |
| Privy | Sign-in, and the signing keys of the people who sign | US |
| Slack | Approval routing (only if you connect Slack) | US |
| Stripe | Card payments (only if you pay by card) | US |
We give 30 days' notice before adding or replacing a sub-processor. Email [email protected] to be told about changes.
5. Data location and retention
Data is stored in the EU by default, on AWS in Frankfurt, Germany. Account and service data is retained while your account is active. Permits and referrals are also kept in a record that nobody can change or delete, our own administrators included. Backups are kept for 7 days. After deletion, all other data is purged from active systems within 30 days and from backups within 60 days.
6. Your rights
Under GDPR you have the right to access, correct, export, restrict, or delete your personal data, and to object to certain processing. To exercise any of these, email [email protected]. We respond within 30 days. You also have the right to lodge a complaint with a supervisory authority — the lead authority for Stategram is the Estonian Data Protection Inspectorate (aki.ee).
7. Cookies and measurement
This website sets no cookies. It loads nothing from other companies: no advertising or social media trackers, no outside analytics, and the fonts come from our own server.
One exception, only when you ask for it. On the contact page, Book a meeting opens the founder's calendar from Cal.com. Nothing from Cal.com loads before you click it. From then on Cal.com receives your IP address and what you enter in the calendar, under its own privacy policy, and may keep cookies of its own.
Measuring visits, only with your consent. On your first visit a box asks whether we may measure your visit. Until you answer, and if you say no, nothing is measured. If you allow it, each page you open sends us the page address, the page you came from, any campaign tag in the link, how far you scroll through each section and how long it stays in view, your time on the page in steps from 15 seconds to 5 minutes, the text of the links and buttons you click, and on the homepage whether you start filling in an email field (never what you type). A random visit number groups the pages of one visit. These records carry no name, email address or IP address, they are not linked to a waitlist signup, and we cannot tell from them who you are. We use them only to see which pages work.
What your browser keeps for this site
| Name | Kept in | What it is for | How long | Consent |
|---|---|---|---|---|
| sg_consent | Local storage | Your answer in the privacy box, so we do not ask on every page | 6 months, then we ask again | Not needed: it keeps your own choice |
| sg_session | Session storage | The random visit number, kept only if you allow measurement | Until you close the tab, or change your answer to no | Needed |
| sg_notrack | Local storage | Set only by opening a link that ends in ?notrack=1, which our team uses to leave its own visits out of the count | Until a link ending in ?notrack=0 removes it | Not needed: set at your request |
Pitch deck links. Opening a pitch deck link counts the opening on our server: the time, the deck and any campaign tag in the link. Nothing is kept in your browser for this, and the count holds no visit number, IP address or browser details, so it contains no personal data.
Delivering the pages. Like any website, the providers that host and deliver this site, Cloudflare among them, receive your IP address in order to send you the pages.
Legal basis and your choice. We measure visits only with your consent (Article 6(1)(a) GDPR, and Article 5(3) of the ePrivacy Directive 2002/58/EC on storing and reading information in your browser). You can change your answer at any time, with Privacy choices at the foot of every page or with this button. Changing to no stops measurement at once and deletes the visit number; it does not undo what was measured while you allowed it.
The Stategram service itself, once you sign in, uses only the strictly necessary cookies that sign-in and security need.
8. Security
TLS 1.2 or 1.3 on every connection, every disk and every backup encrypted at rest, and signed receipts you can check yourself, offline. Security documentation is available under NDA on request from [email protected].
To report a vulnerability, email [email protected]. We acknowledge within one business day and give an initial assessment within ten business days. If a security incident affects your data, we notify you within 72 hours of confirming it and send a written report of its scope, cause and fix.
9. Children
Stategram is not directed to children under 16. We do not knowingly collect data from children.
10. Changes
If we make material changes to this policy, we will notify account holders by email at least 14 days before the change takes effect. Non-material edits will be reflected by updating the "last updated" date below.
11. Contact
- Privacy questions / data requests: [email protected]
- General contact: [email protected]
- Postal: Ideevoog OÜ, Tallinn, Estonia