Crofts Hill Holdings LLC ("StratumCXI", "we", "us", or "our") operates StrataIQ Lens, the StrataIQ platform (including Capture Core and related modules), and stratumcxi.com. This Privacy Policy explains what personal data we collect as a controller, how we use it, and your rights. It applies globally to visitors and users wherever we offer the services.
When we process Customer Data on behalf of StrataIQ platform customers, our Data Processing Addendum applies. Cookies and browser storage are detailed in our Cookie & Storage Policy.
1. StrataIQ Lens — Browser Extension
What Lens collects before you opt in
Nothing leaves your browser. All analysis runs client-side. No personal data is transmitted to our servers until you explicitly submit the opt-in form.
What Lens collects when you opt in
When you submit your name and email to receive a full report, we collect:
- Your full name and work email address
- Company name (if provided)
- The site URL you chose to scan (needed to deliver and view the report)
- Aggregated site health scores and related metrics from that scan
- Analytics tools detected (e.g. "GA4 detected" — not configuration secrets)
- Core Web Vitals scores per page type where available
- Anonymized benchmark contribution data (if opted in)
What Lens never collects
- Personally identifiable information of visitors to the analyzed site
- Passwords, payment details, or form field values
- Browser history outside your active session
- Data from sites you did not actively analyze
Extension permissions
Lens requests activeTab, tabs, storage, scripting, alarms, sidePanel, and offscreen, plus host access to http://*/* and https://*/* (and https://app.stratumcxi.com/* for optional report delivery).
Host access is used only after you start a scan, and only to inject the analyzer and fetch pages on the site under scan (for example pages discovered via sitemap or same-origin links). Lens does not monitor browsing in the background, does not read unrelated sites, and does not send page content to our servers unless you explicitly request email delivery of the full report.
2. StrataIQ Platform (Capture Core and modules)
When you create a StrataIQ account, we collect account information (name, work email, organization name) and authentication session data. The platform processes product telemetry you configure (interaction events from the Capture Core SDK), Destination credentials you connect (encrypted at rest), and usage/billing metadata for your organization.
Payment card data is collected and processed by Stripe, Inc. We do not store full card numbers on our servers. See Stripe's privacy policy for payment data handling.
Capture Core events may include pseudonymous identifiers (session, anonymous, and device IDs — random UUIDs, never tied directly to a person) and coarse contextual signals such as locale, timezone, device class, and viewport size. We do not collect GPS or precise location. Where geographic enrichment is enabled, it is limited to coarse country/region derived server-side; the source IP address is not stored on the event record.
End-user events on your properties are Customer Data you control. We process them as your processor under the DPA — not as an independent marketing controller of those end users.
3. Marketing site and contact
If you email us or use contact forms, we process the content of your message and contact details to respond. Server logs (IP address, user agent, timestamps) may be collected for security and reliability.
4. How we use personal data
- Deliver Website Health Reports and online report viewer links
- Operate StrataIQ accounts, ingest, labeling, Destinations, and dashboards
- Process subscriptions and invoices via Stripe
- Send transactional and (where permitted) product follow-up email — marketing opt-out in every marketing message
- Improve Lens and industry benchmarks using anonymized or aggregated signals
- Secure the services, prevent abuse, and comply with law
We do not sell your personal data. We do not share it with third parties for their independent advertising.
5. Legal bases (EEA/UK and similar)
Where GDPR or UK GDPR applies, we rely on:
- Contract — to provide accounts, reports, and paid services you request
- Legitimate interests — security, product improvement, limited B2B follow-up related to a Lens report or account, balanced against your rights
- Consent — where we ask for it (e.g. optional benchmark contribution, or marketing where required)
- Legal obligation — tax, accounting, and lawful requests
6. Service providers
We use processors to operate the product, including:
- DigitalOcean — application hosting, databases, cache (United States)
- Vercel — marketing site hosting
- Stripe — payments
- Anthropic — AI-assisted semantic labeling when that path is used
- Email / CRM providers as configured (e.g. Loops, HubSpot for Lens leads)
Destinations you connect (e.g. GA4) receive data under your instructions and are not our advertising partners.
7. International transfers
We are based in the United States. If you access the services from the EEA, UK, Switzerland, or other regions, your personal data may be processed in the United States. Where required, we use appropriate safeguards (such as standard contractual clauses) with processors. Contact privacy@stratumcxi.com for transfer documentation available to customers.
8. Data storage and security
Platform data is hosted primarily on DigitalOcean in the United States. We use TLS in transit, encryption for Destination credentials at rest, access controls, and least-privilege practices. No method of transmission or storage is 100% secure.
9. Retention
Lens report data is retained for 12 months from generation, then deleted. Account and platform Customer Data are retained for the life of the account plus a limited period for backups and legal obligations, unless you request earlier deletion. Billing records may be kept longer as required by law.
10. Your rights
Depending on your location (including GDPR, UK GDPR, and US state laws such as CCPA/CPRA), you may have rights to access, correct, delete, port, restrict, or object to certain processing, and to opt out of "sale" or "sharing" as those terms are defined by law (we do not sell personal data in the conventional sense). California residents may designate an authorized agent as permitted by law.
Email privacy@stratumcxi.com. We will respond within 30 days (or sooner if required by applicable law). You may also lodge a complaint with your local supervisory authority.
11. Cookies and storage
See our Cookie & Storage Policy. In short: no advertising cookies on the marketing site; dashboard uses a necessary session cookie; Lens uses extension storage; Capture Core may use local/session storage for identifiers.
12. Children
Services are not directed to children under 16 (or under 13 where that is the applicable standard). We do not knowingly collect personal data from children.
13. Changes
We may update this policy by posting a revised version with a new "Last updated" date. Material changes will be communicated via the email associated with your report or account where practicable.
14. Contact
Crofts Hill Holdings LLC
Florida, United States
privacy@stratumcxi.com