This Data Processing Addendum ("DPA") forms part of the Terms of Service between Crofts Hill Holdings LLC, d/b/a StratumCXI ("Processor", "we", "us") and the customer entity that uses StrataIQ platform services ("Controller", "Customer", "you"). It applies when we process Personal Data on your behalf in providing Capture Core, Tag Guardian, and related platform modules, for Customers worldwide.
Our Privacy Policy covers data we process as an independent controller (for example StrataIQ Lens lead capture and marketing site visitors). This DPA does not replace that policy.
1. Definitions
- Customer Data — data you or your systems submit to StrataIQ, including SDK events, properties, semantic labels, Destination configuration metadata, and related telemetry.
- Personal Data — Customer Data that relates to an identified or identifiable natural person under applicable privacy law (e.g. GDPR, UK GDPR, CCPA/CPRA, LGPD).
- Processing — any operation on Personal Data (collection, storage, labeling, transmission to Destinations you configure, deletion).
- Destination — a third-party system you connect (for example GA4) to receive events you authorize us to deliver.
2. Roles and scope
For Customer Data processed in the StrataIQ platform, you are the Controller (or a processor acting for your own customers) and we are the Processor. We process Personal Data only to provide the services, on your documented instructions (product configuration, APIs, Destinations you connect, and written instructions), and as required by law.
You are responsible for the lawfulness of your collection and use of Personal Data (notices, consent or other legal bases, cookie/SDK deployment on your properties, and Destination policies).
3. Nature and purpose of processing
Purpose
Operate StrataIQ: ingest and store events, apply semantic labeling (including AI-assisted classification where enabled), enforce quotas, display dashboards, deliver events to Destinations you configure, and provide support, security, and reliability for the account.
Categories of data subjects
End users and visitors of Customer digital properties where the Capture Core SDK (or related modules) is installed; Customer personnel who use the dashboard.
Types of Personal Data
Typically: anonymous or pseudonymous identifiers, page URLs/paths, interaction and device/browser signals, optional attributes you configure, and semantic labels. We design the product so you can avoid sending known sensitive categories; you must not instruct us to process special-category data unless we agree in writing.
4. Customer instructions
Your instructions are: (a) use of the services as documented; (b) Destination connections and credentials you supply; (c) API and dashboard actions by authorized users; (d) erasure and account-deletion requests via documented endpoints or email to privacy@stratumcxi.com. We will inform you if an instruction appears to violate applicable law (unless legally prohibited).
5. Confidentiality and security
We restrict personnel access to Customer Data on a need-to-know basis and require confidentiality. Technical and organizational measures include encryption in transit (TLS), encryption of Destination credentials at rest, network and access controls on hosted infrastructure, and authentication for the dashboard. No security program eliminates all risk; report suspected incidents to privacy@stratumcxi.com.
We will notify you without undue delay after becoming aware of a Personal Data breach affecting your Customer Data, with information reasonably available to help you meet your notification duties.
6. Subprocessors
You authorize us to engage subprocessors to deliver the services. Current core subprocessors:
- DigitalOcean — application hosting, managed PostgreSQL, Redis (United States)
- Stripe, Inc. — subscription payment processing (account billing data; not event payloads)
- Anthropic — AI-assisted semantic labeling when that feature path is used
- Vercel — marketing site hosting (not the Capture Core data plane)
- Email / CRM providers we configure for account or lead workflows (e.g. Loops, HubSpot) — as applicable
Destinations you connect are yourprocessors or independent controllers — not our subprocessors. We remain responsible for our subprocessors' performance relative to this DPA. Material subprocessor changes will be reflected on this page; continued use after the update constitutes acceptance unless you object in writing and terminate the affected services as permitted by the Terms.
7. International transfers
Primary processing for the StrataIQ platform occurs in the United States. If you require a specific transfer mechanism (e.g. SCCs) for GDPR or UK GDPR, contact privacy@stratumcxi.com — we will work in good faith on commercially reasonable documentation for paying customers.
8. Assistance with data subject rights
Taking into account the nature of processing, we will assist you with reasonable requests related to access, deletion, and similar rights for end-user Personal Data in Customer Data, including via documented erase-user and account-deletion APIs where available. You remain responsible for verifying the requester and responding to data subjects.
9. Retention and deletion
We retain Customer Data for the life of the active account and for a limited period afterward for backups, security logs, and legal obligations, unless you request earlier deletion. Upon account deletion or written request, we will delete or anonymize Personal Data in Customer Data within a commercially reasonable period, except where retention is required by law or needed to resolve disputes. Data already delivered to your Destinations is outside our control once accepted by those systems.
10. Audits
Upon reasonable written notice, no more than once per twelve months (unless a confirmed breach), we will provide information reasonably necessary to demonstrate compliance with this DPA (for example security summaries or questionnaire responses). On-site audits require mutual agreement and are at Customer's expense unless required by a confirmed material breach attributable to us.
11. Liability and term
Liability under this DPA is subject to the limitations in the Terms. This DPA remains in effect while we process Customer Data for you and survives termination for provisions that by nature should survive (including deletion, confidentiality, and liability).
12. Order of precedence
If this DPA conflicts with the Terms on Processing of Personal Data in Customer Data, this DPA controls. A signed enterprise MSA or order form may supersede both for that customer.
13. Contact
Crofts Hill Holdings LLC
Florida, United States
privacy@stratumcxi.com