Privacy policy

1. About this Privacy Policy

This Privacy Policy explains how we collect, use, store and protect personal data when you visit or use stratiuminsights.com, create an account, read editorial content, contact us or use related digital features (together, the “Service”).

The Service is an editorial and research website providing news, analysis, investigations, reports, commentary and other materials. This Policy applies to visitors, registered users, contributors who communicate with us and any person who submits a request through the Service.

This notice distinguishes active and planned features. Paid subscriptions and checkout are not currently available. Newsletter sign-up and email confirmation are active. Confirmed subscribers receive a weekly localized digest when articles are available in their selected email language; administrators may also send additional newsletter messages. Author-follow email alerts are active after a member follows an author.

2. Data controller and contact details

The service provider is STRATIUM POLICY LAB LTD. Its postal address, company registration number and applicable tax identifiers have not yet been supplied. These details will be added when available.

For general enquiries, contact info@stratiuminsights.com; for legal notices and privacy requests, contact legal@stratiuminsights.com; for account and service support, contact support@stratiuminsights.com. These are monitored service mailboxes. Do not send payment-card details, passwords or other authentication secrets by email.

Website: stratiuminsights.com. The company address and registration details will be updated when supplied.

3. Personal data we may process

Account data. If you create or use an account, we process your email address, internal account identifier, authentication and verification state, preferred interface or email language, account status and security information needed to authenticate and protect the account. Authentication credentials are handled by the authentication system. We do not need your plain-text password.

Subscription and transaction data. Paid checkout is disabled and no subscription payments are currently collected. If subscriptions are introduced, we expect to process plan, start/end dates, renewal and cancellation state, payment outcome, transaction reference, billing country and currency, and information needed to apply taxes or provide support. Full payment-card details are not intended to be stored by STRATIUM.

Technical and usage data. Our systems may process IP address, browser and device information, request timestamps, requested routes, authentication and security events, error diagnostics and operational logs required to serve pages, maintain the Service and protect it from abuse.

Contact communications. If you use the contact form, we process the name and email address you provide, the subject, message, locale and any information you choose to include so that the team can receive and answer your enquiry. The form sends messages to info@stratiuminsights.com, where they are retained under mailbox practices.

Newsletter data. If you tick the separate opt-in and submit the newsletter form, we store your normalized email address, selected language, consent timestamp/version and subscription state in the project database. A confirmation email is sent through the operator-configured SMTP service. Its one-time confirmation token is stored only as a hash and expires after 24 hours. The list is first-party; no external newsletter platform is used. Confirmed subscribers receive a weekly localized digest when their selected language has eligible articles. Administrators may send additional newsletter messages to this confirmed list. Each message contains an unsubscribe link, and you can withdraw newsletter consent at any time.

Author follows and alerts. If you follow an author, the Service stores the member/author relationship and your preferred email language. The active notification worker sends at most one localized email to the verified address for a newly published canonical article from that author. The alert contains the article title, byline and link—not the article body—and is separate from the newsletter. You can unfollow in your account; this stops future alerts and cancels queued alerts.

Privacy and legal requests. If you ask us to exercise a data-protection right or submit a complaint, we may process identity and correspondence information needed to verify, evaluate and answer the request and keep a proportionate compliance record.

4. Purposes and legal bases

We use account data to create and secure accounts, provide requested account features and respond to authentication requests. Where processing is necessary to take steps at your request or perform a contract, the intended legal basis is Article 6(1)(b) GDPR.

We may process records to comply with legal obligations under Article 6(1)(c) GDPR where those obligations apply. This can include responding to valid legal requests and retaining records that the law requires.

We may use limited technical and security information for our legitimate interests under Article 6(1)(f) GDPR, including protecting the Service, detecting abuse, investigating security incidents, enforcing site terms and establishing or defending legal claims. We consider the impact on users and apply safeguards appropriate to the data and purpose.

Contact details and messages are used to receive and answer your enquiry. A reply is based on the steps needed to respond to your request and, where relevant, our legitimate interest in operating the Service.

Newsletter emails are sent only after you give a separate opt-in and confirm your address. You can withdraw that consent and unsubscribe at any time using the unsubscribe link. Other direct electronic marketing and non-essential device technologies will be used only after any consent required by applicable data-protection and electronic-communications law. Withdrawal does not make earlier lawful processing unlawful.

The legal basis for a particular activity depends on the context. The controller must confirm and document the legal basis for each processing purpose before commercial launch.

5. Payment processing

Paid checkout is currently disabled, no paid subscription can be purchased and no subscription payment is collected through this website.

If paid plans are introduced, an external payment service may process information needed to authorize and settle a transaction, prevent payment fraud and manage refunds or chargebacks. The provider may act as an independent controller for some processing under its own privacy notice.

STRATIUM would receive only the information reasonably needed to confirm payment status and administer access. The identity of any payment provider and the applicable privacy information will be disclosed at or before checkout once selected and configured.

6. Cookies and similar technologies

The Service currently uses a first-party language preference cookie and, when you sign in, authentication cookies. Their names and observed purposes are described in the Cookie Policy. Authentication cookies are marked HttpOnly and use Secure in production; the language preference is a functional preference stored by the browser.

We do not intentionally activate third-party audience-analytics or advertising cookies for ordinary visitors. Optional analytics, advertising or marketing technologies will not be activated where prior consent is required unless that consent has been obtained.

Some article pages may contain a privacy-enhanced YouTube embed. When an embedded player is loaded or used, the browser may communicate with YouTube and information may be processed under YouTube’s own terms and privacy information. The use of an enhanced-privacy domain does not make YouTube a STRATIUM service provider or remove its independent processing.

7. Recipients of personal data

Access to personal data is restricted to authorized people who operate, edit, secure or support the Service and need the information for their work.

The application and its primary database are operated on the project’s VPS infrastructure. Email/password authentication uses the project’s self-hosted Supabase service; Google sign-in uses Google identity services through Auth.js. Contact-form messages are delivered through the configured SMTP/mailbox service. The exact legal entities, locations, contracts and subprocessors for hosting, database, authentication, email, monitoring and other infrastructure are being verified and will be listed or described more specifically before commercial launch.

Newsletter sign-up data is stored in the project PostgreSQL database on its VPS. Only administrators can inspect the read-only subscriber ledger or create campaigns. Confirmation and newsletter messages are sent through the operator-configured SMTP/mailbox service; no separate newsletter platform is used. Payment and analytics providers may receive data necessary for their functions only if those features are enabled, and will be identified before activation.

We may disclose information to competent public authorities where required by law or to protect rights, safety and the security of the Service. We do not sell personal data.

8. International data transfers

The infrastructure and provider locations, applicable data-processing agreements and any international transfers are being verified. We do not claim that all processing currently takes place in the European Economic Area or that a particular transfer safeguard applies until those facts have been confirmed.

Before a provider or feature involving a transfer outside the European Economic Area is used, the controller must identify the destination and put in place an appropriate GDPR transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, and any supplementary safeguards required by the circumstances.

For questions about a specific transfer or safeguard, contact info@stratiuminsights.com.

9. Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, taking account of applicable law, security, dispute handling and operational needs.

Account information is generally retained while an account is active. After account closure, limited information may be retained where necessary to complete deletion, prevent abuse, meet a legal obligation or establish, exercise or defend legal claims.

If paid subscriptions are introduced, transaction and invoice information will be kept for the periods required by applicable accounting, tax and consumer law. No such subscription transactions are currently processed by the Service.

Security and diagnostic logs are retained for a limited operational period and may be kept longer when needed to investigate a security event, suspected fraud or legal dispute. Contact messages remain in the receiving mailbox according to its configured retention practices; no fixed mailbox deletion period is currently promised.

Author-alert delivery records are deleted after 90 days. Unconfirmed newsletter requests are removed during a later sign-up after 30 days; unsubscribed records are removed during a later sign-up after 90 days. Confirmed subscriber records are kept until the person unsubscribes or requests erasure. Newsletter delivery records are kept for up to 400 days for operational history; unsubscribe-token hashes remain while the subscriber record exists.

Requests to exercise legal rights may be retained as needed to document that the request was handled. Retention schedules will be reviewed against the actual deployed systems before commercial launch.

10. Your rights

Subject to the conditions and limitations in applicable law, you may have the right to ask whether we process your personal data and obtain access to it; request correction of inaccurate or incomplete data; request erasure; request restriction of processing; receive certain data in a structured, commonly used and machine-readable format and transmit it to another controller; object to processing based on legitimate interests; and withdraw consent where processing is based on consent.

You may object at any time to processing of personal data for direct marketing. The right to erasure, objection, portability and other rights are not absolute and depend on the relevant legal basis and circumstances.

Send rights requests to info@stratiuminsights.com. We may request information reasonably necessary to verify your identity. We will respond within the period required by applicable law and explain any lawful extension or reason we cannot fulfil a request.

You may lodge a complaint with the supervisory authority competent under the GDPR. Where the Polish authority is competent, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).

11. Account deletion

You may request deletion of your account and personal data by writing to info@stratiuminsights.com. A self-service deletion control may be added where technically available.

A deletion request does not require erasure of information that must be retained under applicable law or is necessary to establish, exercise or defend legal claims. We will delete or anonymize other information when the applicable retention conditions are met.

Paid subscriptions are not currently available. If recurring subscriptions are introduced, users will be told how account deletion interacts with cancellation; deleting an account will not be presented as a substitute for cancelling future billing.

12. Security

We use technical and organizational safeguards intended to protect personal data against unauthorized access, loss, destruction, alteration or disclosure. Depending on the processing, safeguards include encrypted connections, access controls, protected authentication, restricted administrative access and operational security monitoring.

No internet service can guarantee absolute security. If you believe that your account or personal information has been compromised, contact info@stratiuminsights.com promptly. Do not include passwords, access tokens or payment-card details in your message.

13. Children

The Service is general editorial content and is not specifically designed for children. Paid subscriptions are not available at present. If a paid service is introduced, eligibility and the capacity to enter a contract will be stated in its terms and checkout, including any requirements concerning parental or guardian authorization.

We do not knowingly seek to collect children’s personal data beyond what is necessary for ordinary operation of the website. A parent or guardian who believes a child has provided personal data may contact info@stratiuminsights.com.

14. Automated decision-making

We do not currently intend to make decisions about users that produce legal or similarly significant effects solely through automated processing within the meaning of Article 22 GDPR.

A future payment, authentication or security provider may use automated systems within its own service. Its privacy information will apply to processing for which it acts as an independent controller.

15. External websites and embedded content

Editorial pages may link to external websites or contain an embedded third-party player. STRATIUM does not control independent websites and is not responsible for their privacy practices. Review the privacy information of the relevant provider before using its service.

An external link does not imply endorsement. Embedded YouTube content may cause your browser to communicate directly with YouTube when loaded or played.

16. Changes to this Privacy Policy

We may update this Policy when the Service’s processing, technologies, providers or legal obligations change. We will update the effective date and communicate material changes through the Service or another reasonable method where required by law.

This Policy must be reviewed whenever a material feature, provider, international transfer, cookie, newsletter, payment or retention practice changes.

17. Supervisory authority

You have the right to lodge a complaint with a competent data-protection supervisory authority if you believe that processing of your personal data infringes applicable law. If the Polish authority is competent, the authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).

Google sign-in

If you choose to sign in with Google, Google authenticates you and returns basic identity details to us: your email address, name, profile image if available, and a stable Google account identifier. We request only the basic OpenID Connect identity scopes (openid, email and profile); we do not request access to Gmail, Drive, Calendar, contacts or other Google services. We use the verified email and provider identifier to authenticate your member account and preserve its existing member profile where the verified email matches. Google processes the sign-in interaction under its own terms and privacy information. Email/password access remains available separately.

Following authors

Following an author is a separate opt-in to publication alerts. We store the member/author relationship and preferred email language in your account. The active worker sends at most one alert to your verified email address for a newly published canonical article, in your selected email language. The alert contains the article title, byline and link, not the article body; later translations do not trigger another alert. You can change your email language or unfollow an author in your account. Unfollowing cancels queued alerts. Terminal delivery records are deleted after 90 days. These alerts are separate from the newsletter.

Contact channels

General enquiries: info@stratiuminsights.com. Legal notices and privacy requests: legal@stratiuminsights.com. Account and service support: support@stratiuminsights.com. These mailboxes are monitored service contacts. Do not send passwords, authentication codes or full payment-card details by email. The service is identified on this website as STRATIUM POLICY LAB LTD; its postal address and registration numbers will be added when available.