Privacy Policy

The data controller for personal data processed via strgy.com is STRGY AI Oy (Y-tunnus 3559076-8), Erottajankatu 2, 00120 Helsinki, Finland.

For data protection questions, contact [email protected].

We collect the following categories of personal data:

• Email captures. When you submit your email to receive an analysis, request a demo, or contact us — we store the email address, the timestamp, and the company you asked about.
• Analysis requests. Company name, the requester's email, and any free-text context you provide.
• Technical data. IP address, user agent, and basic usage logs collected by our hosting and security infrastructure for the legitimate purpose of preventing abuse.

• Service delivery (contract / pre-contractual steps, Art. 6(1)(b)). To respond to your demo request and deliver the analysis you asked for.
• Legitimate interests (Art. 6(1)(f)). To monitor service health, prevent abuse, and improve the product in aggregate.

We retain personal data only as long as needed for the purpose it was collected for:

• Email captures and analysis requests: for as long as needed to deliver the requested analysis, respond to follow-up questions, and operate our marketing relationship — or until you ask us to delete it.
• Job applications. If you apply for a role, we keep your CV, your interview answers, and the assessment we make of them for 12 months after we tell you our decision, long enough that we can explain and stand behind that decision if you ask us to. If we have not told you anything, the clock runs from the decision itself, so waiting to hear from us never shortens how long you have to ask. Applications that are started but never submitted are deleted after 30 days. After either period we delete the CV file, the text taken from it, your answers, and the assessment; we keep only a record that an application existed, with nothing in it that identifies you. Internal notes about your application, including anything our hiring assistant writes about you when our team asks it questions, go when your application does, and within 90 daysin any case. If you are hired, your data moves into your employment record and is kept under separate terms we will give you at the time.
• CVs that reach us another way. We advertise our openings in more places than this site, so a CV may reach us through a job board, a recruiter, or someone who passed it on. When we add one to our hiring records, it is held on exactly the clocks above and deleted the same way, and the record notes where it came from and which of us added it. You have the same rights over it: write to us and we will tell you what we hold, or delete it.
• Technical logs: only as long as needed for service health, abuse prevention, and security monitoring.

When you apply for a role, an AI reads your CV, writes the interview questions you are asked, and produces a scored assessment against criteria published in the job description.

• A person decides. The assessment is advice to our hiring team and nothing more. No decision about your application — shortlisting, rejection, or an offer — is ever made automatically. A named person records every decision.
• You can ask what it said about you. Every score we hold carries the criterion it was given for, the weight that criterion has, and a quote from your own words or CV that it was based on. Write to us and we will tell you.
• It assesses what you have done. The assessment is instructed to score only against the published criteria, and never to draw inferences from your name, nationality, age, gender, family situation, religion, disability, or where you studied. Writing in non-native English is not treated as a negative, and neither is a career break or a non-linear path.
• A CV on its own is assessed as a CV. If your CV reached us without you sitting the interview, the assessment is made from the CV alone. It is marked that way for the person reading it, the criteria a CV cannot evidence are recorded as unevidenced rather than guessed at, and the AI is instructed that it cannot give its strongest recommendation on that basis.
• You can object. If you would rather your application were assessed without AI involvement, tell us when you apply or at any point afterwards and we will handle it manually.

We use the following sub-processors. Each operates under a Data Processing Agreement (DPA) and only processes data on our instructions:

• Microsoft Azure — infrastructure.
• Plausible Analytics — analytics.

Prompts sent to Azure OpenAI are not used to train models.

Where personal data is transferred outside the European Economic Area, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses, supplemented by additional safeguards where required.

Under GDPR you have the right to:

• Access the personal data we hold about you (Art. 15).
• Have inaccurate data corrected (Art. 16).
• Request deletion (Art. 17), subject to legal retention obligations.
• Restrict or object to processing (Art. 18, 21).
• Receive your data in a portable format (Art. 20).
• Withdraw consent at any time, without affecting prior processing.

To exercise any of these, email [email protected]. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).

We protect personal data with industry-standard technical and organizational measures: encryption in transit and at rest, role-based access control, audit logs, and regular security review. No system is perfectly secure, but we treat your data with care.

We will update this policy as our practices evolve. Material changes will be communicated via the site or email. The "last updated" date at the top reflects the most recent revision.