Privacy Policy

1. Who we are

Stratpix (“we”, “us”) operates this website as a knowledge platform for AI-assisted UX and product design practice. For the purposes of data protection law we are thedata controller for personal data processed through this site.

Questions about this policy, or requests to exercise your rights, can be sent to the contact address published on our About page.

2. What we collect

We do not collect payment details, government identifiers, or special category data, and we do not run advertising or third-party analytics trackers.

3. Cookies and local storage

We use only what the site needs to function. There are no advertising or profiling cookies.

• Authentication tokens, set by Firebase Authentication to keep you signed in. Strictly necessary.
• XSRF-TOKEN, a cross-site request forgery token protecting form submissions. Strictly necessary.
• Theme preference - stored in your browser’s local storage so the site remembers light or dark mode. It never leaves your device.

Because these are strictly necessary or stored locally on your own device, no consent banner is required under the ePrivacy Directive. If you later add analytics or marketing cookies, you must obtain prior consent and update this section.

4. AI processing

When you request AI insights in the Strategy Builder, the project context you entered - your problem statement, project type, scale, and selected stages - is transmitted to Google’s Gemini API to generate a response.

Do not enter client-confidential information, personal data about third parties, or anything under NDA into these fields. Treat the AI feature as you would any external service. Google’s handling of that data is governed by its own terms; review them before using the feature for commercial work.

5. Service providers

We share data only with the providers needed to run the service:

• Google Firebase - authentication, hosting, and serverless functions.
• Google Gemini API - generation of AI insights, only when you invoke that feature.

We do not sell personal data, and we do not share it with advertisers or data brokers. External links on this site - tools, tutorials, and curated social accounts - lead to third-party services governed by their own privacy policies, over which we have no control.

6. Legal basis for processing

Where the UK or EU GDPR applies, we rely on:

• Contract (Art. 6(1)(b)) - to create and operate your account and deliver features you request.
• Legitimate interests (Art. 6(1)(f)) - to keep the platform secure, prevent abuse, and moderate contributions.
• Consent (Art. 6(1)(a)) - where you voluntarily submit a contribution for publication. You may withdraw consent at any time.

7. Your rights

Subject to your jurisdiction, you may have the right to:

• Access the personal data we hold about you, and receive a copy.
• Have inaccurate data corrected.
• Have your data erased, and your account deleted.
• Receive your data in a portable, machine-readable format.
• Object to, or request restriction of, processing based on legitimate interests.
• Withdraw consent for any processing that relies on it.
• Lodge a complaint with your supervisory authority - in the UK the ICO, in the EU your national authority, or in India the Data Protection Board.

We respond to verified requests within one month, or sooner where the law requires it.

If you are in India, the DPDP section below sets out your rights as a Data Principal, including nomination and grievance redressal, and how to exercise them.

8. Applicable law

Depending on where you are, one or more of the following applies to how we handle your data:

• UK GDPR and the Data Protection Act 2018 - United Kingdom.
• EU General Data Protection Regulation (2016/679), European Economic Area.
• Digital Personal Data Protection Act 2023, India.
• Information Technology Act 2000 and the SPDI Rules 2011 - India, for reasonable security practices.
• California Consumer Privacy Act, as amended by the CPRA - California residents. We do not sell or share personal information as those terms are defined.
• ePrivacy Directive (2002/58/EC) - cookies and local storage, as described above.

9. India: your rights under the DPDP Act 2023

Where we process the personal data of people in India, the Digital Personal Data Protection Act 2023 (“DPDP Act”) applies. In its terms we are the Data Fiduciary and you are the Data Principal. This section sits alongside the rest of this policy; where it gives you more than the sections above, this section governs.

Notice and consent

This policy, together with the request shown to you at the point of collection, is the notice required by section 5 of the Act: it tells you what personal data we collect, the purpose we collect it for, how to exercise your rights, and how to complain to the Data Protection Board of India. You may ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India.

Where we rely on your consent, it is sought for a specified purpose, limited to the data necessary for that purpose, and you may withdraw it at any time with the same ease as you gave it, by writing to the contact address on our About page. Withdrawal does not affect processing carried out before you withdrew, and we will stop processing and erase the data within a reasonable time unless the law requires us to keep it. Some processing instead rests on certain legitimate uses under section 7 — for example, data you voluntarily give us for a purpose you have not objected to, and processing needed to comply with law.

We do not currently operate through a registered Consent Manager. If we adopt one, we will say so here before the change takes effect.

Your rights as a Data Principal

• Access — a summary of the personal data we process about you, the processing activities, and the identities of any other Data Fiduciaries and processors we have shared it with.
• Correction, completion, updating, and erasure of your personal data, unless retention is required for a legal purpose.
• Grievance redressal — a readily available means of raising a complaint with us, described below. You must exhaust it before approaching the Board.
• Nomination — you may nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.

You also have duties under section 15: do not impersonate another person when giving your data, do not suppress material information where the law requires it, and do not file false or frivolous complaints. The Act provides for penalties on Data Principals who breach them.

Children and persons with disabilities

Under the DPDP Act a child is anyone under 18. We do not knowingly process the personal data of a child in India without verifiable consent from a parent or lawful guardian, and we do not carry out tracking, behavioural advertising, or targeted advertising directed at children in any event. The same consent requirement applies to a person with a disability who has a lawful guardian. This platform is built for practising professionals and is not intended for children.

Security, breaches, and retention

We maintain reasonable security safeguards as required by section 8(5) — see the Security section below. In the event of a personal data breach we will notify each affected Data Principal and the Data Protection Board of India in the form and within the timelines the Act and its rules prescribe. We erase personal data, and cause our processors to erase it, once you withdraw consent or the purpose is no longer served, except where retention is required by law.

Grievance officer and complaints

Raise any DPDP-related grievance with our grievance officer at the contact address published on our About page, marked “DPDP grievance”. We will acknowledge it and respond within the period prescribed under the Act. If you are not satisfied with our response, or we do not respond, you may complain to the Data Protection Board of India.

10. International transfers

Our providers operate globally, so your data may be processed outside your country. Where data leaves the UK, EEA, or India, transfers are made under the safeguards those regimes recognise - Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision.

11. Retention

• Account data - kept while your account is active, then deleted within 90 days of closure.
• Published contributions - retained while published, since removing them would break the public record. You may request that your credit be anonymised.
• Rejected submissions, deleted within 12 months of the moderation decision.
• Security logs, retained for up to 12 months for abuse prevention.

12. Security

The site is served over HTTPS with a Content Security Policy, clickjacking and MIME-sniffing protections, a strict referrer policy, and cross-site request forgery tokens on form submissions. Authentication is handled by Firebase rather than by storing credentials ourselves. No system is perfectly secure, and we cannot guarantee absolute security.

To report a security issue, see our security.txt. Crawl rules and the full list of public pages are published in our robots.txt and sitemap.xml.

13. Children

This platform is intended for design and product professionals. It is not directed at children, and we do not knowingly collect data from anyone under 16 (or under 13 where local law sets a lower age). In India the DPDP Act treats anyone under 18 as a child, and the stricter rule in the DPDP section applies there. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy as the platform changes. The ”last updated” date above always reflects the current version, and we will give prominent notice on the site before any change that materially reduces your rights takes effect.

See also our Terms & Conditions.