Privacy notice: how we use your data
Last updated 3 November 2026
This notice explains what personal data Cloud Adept Limited ("we") collects when you use the Strays website and app, why, how long we keep it, and your rights. We're a company registered in England and Wales (company number 09216333), with our registered office at Hazlemere, 70 Chorley New Road, Bolton, Lancashire, BL1 4BY, United Kingdom. We're registered with the Information Commissioner's Office (ICO), the UK's data protection regulator, under number ZC272649. Contact us about privacy at support@getstrays.com, or write to our registered office.
Two roles
- For your account with us (your name, email, sign-in, billing, support emails) and for visits to our website, we are the controller.
- For data Strays finds or handles for your organisation (for example a resource owner's email in a tag, an IAM user name in CloudTrail, the people in a leaver report or an access review, messages to owners in Slack or Teams, and people in a directory you connect), your organisation is the controller and we're its processor, under our data processing terms. If you're one of those people, your organisation decides how that data is used: please ask it first. We'll pass on any request we receive about it.
What we collect, and why
| Data | Why | Legal basis |
|---|---|---|
| Name, email, organisation, role in Strays, and the version and time of the terms accepted when the organisation was created | To give you an account, run the service, and keep a record of the agreement | Contract |
| When each person last used the app (to the hour) | So we can see who's getting value from Strays and offer help to organisations that have stopped using it | Legitimate interests |
| Sign-in records, IP addresses, browser type (in security logs) | To keep the service secure and stop abuse | Legitimate interests |
| A one-way fingerprint (hash) of your email address, kept after an organisation is deleted | So the free trial is used once per person. It can't be read back as an address, but someone who already knows your address could check it against the fingerprint, so we treat it as personal data | Legitimate interests |
| Billing name, address and any tax number (held by Stripe), and the payments made | To take payment and keep tax and accounting records | Contract; legal obligation |
| Emails and in-app messages you send to support | To help you | Contract; legitimate interests |
| Notes our staff keep about your organisation (for example what support you've asked for) | To give you consistent support | Legitimate interests |
| Where you came from when you signed up: the source, medium and campaign of the link you followed, if any | To see which links lead to sign-ups | Legitimate interests |
| Product emails (risk alerts, the weekly digest, access reviews, leaver reports, invitations) | Part of the service; admins choose the risk-alert level in Settings | Contract |
Where we rely on legitimate interests, we've weighed them against your interests, and you can object (see Your rights). We don't sell personal data, use it for advertising, use third-party tracking or analytics on the website or app, or make decisions about you by automated means alone. We don't send marketing emails.
What our staff can see
A few named Cloud Adept Limited staff run Strays through an operator console, signed in with MFA. For each organisation it shows its name, plan and payments, its members' email addresses, roles, when they joined and when they last used the app, the AWS accounts connected and whether scans are working, which tools are connected, and our private notes. It doesn't show findings or reports. Our staff get an email when a new organisation signs up (its name and the email of the person who created it), and a daily email when organisations may need help (for example a trial that hasn't connected an AWS account). Everything staff change in the console is recorded in a log with who did it and why. To fix a problem, our engineers can reach the service's data in AWS; that access is limited to named staff with MFA.
Cookies
The app uses only cookies it needs to work: a session cookie that keeps you signed in (12 hours) and a short-lived one while you sign in (10 minutes). Our sign-in pages (Amazon Cognito) set their own essential cookies too. All are strictly necessary for the service you've asked for, so we don't ask for consent. The website sets no cookies. It stores nothing in your browser unless you ask it to stop counting your visits (below), when it remembers that choice.
Counting visits to this website
A small script on our own website (not a third party's) tells our app which page you opened, the name of the website you came from (not the full address), the utm_ campaign tags in the link you followed, if any, and nothing else you typed or did. Our app adds one to a count for the day under that page, source, campaign, your country (from the network, as CloudFront reports it) and your device type (phone, tablet or computer, worked out from your browser's name, which we then discard). We leave out robots, visits from cloud and hosting networks (going by your network's number, as CloudFront reports it, which we then discard) and anyone signed in to Strays: if you're signed in, your browser sends its sign-in cookie with the count, and our app checks it only to leave you out. We don't store your IP address, your browser's full name, your network or any identifier, and the counts can't be traced back to you. We use them only to see how the website is used and which pages and links bring people to Strays, so we can improve it; they're kept for 400 days. If you create an account, the source of the link you followed is kept with your organisation (see above).
Because the script runs in your browser, the law treats it like a cookie used for statistics: it doesn't need consent, but you can object, for free. The script does nothing if your browser sends Do Not Track or Global Privacy Control, or if you press the button below.
The request goes through our web firewall, whose logs (see Where it's kept) include IP addresses like any other request.
Who we share it with
Only the service providers that run Strays for us, under contracts that protect your data: Amazon Web Services (hosting, sign-in, email), Stripe (payments) and the provider of the mailbox our staff read support email in. If your organisation connects them, Strays also sends data to and reads data from your own Slack, Microsoft (Teams, Microsoft 365), Google Workspace, Jira or Linear accounts, under your organisation's agreements with those providers. Our data processing terms list who processes what, and where. We'd also share data if the law required it, or with a buyer if our business were sold, under the same protections.
Where it's kept
In the UK (AWS London), except: support email arrives in AWS Ireland, where each message is kept for 30 days and forwarded to our support mailbox; web firewall logs (IP addresses and request details, kept for a year) are in the US (AWS N. Virginia), where AWS runs the firewall for its global network; on the Business plan, the AI features send findings, resource names and team members' email addresses to Claude on Amazon Bedrock in the EU, which doesn't keep them; and Stripe processes payment data in the EU and the US. Transfers to the EU rely on the UK's adequacy regulations for the EEA; transfers to the US rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified to it, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU's standard contractual clauses in the provider's data processing terms.
How long
- Your organisation's data (members, connected accounts, findings, decisions, reports, our notes): while the organisation exists. An admin can delete it at any time in Settings → Your data, which deletes it straight away (cancel any subscription first), or you can ask us and we'll delete it within 30 days. Deleted data leaves our database backups within 35 days and our file storage within 30 days.
- Each scan's full results and leaver reports: 400 days.
- Sign-in accounts: deleted with the organisation. If you sign up but never create or join an organisation, ask us and we'll delete your sign-in.
- Security logs and web firewall logs: one year. Raw support email in AWS: 30 days. Support conversations in Strays: kept with your organisation, and deleted with it.
- The fingerprint of your email for the free trial, and our staff's log of console actions (which names the organisation): kept after the organisation is deleted, so the trial can't be repeated and we have a record of what our staff did.
- Billing records: six years, because tax law requires it. Stripe keeps its own records under its own privacy notice.
- Website visit counts: 400 days.
Your rights
You can ask for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Admins can download their organisation's data any time from Settings → Your data, and delete the organisation there too; the download leaves out keys, tokens and our private notes, which we'll give you on request. Email support@getstrays.com or write to our registered office. We'll reply within one month (we may extend that by up to two months for complex requests, and tell you why), and may need to confirm who you are first.
Complaints
If you think we've handled your personal data wrongly, please tell us first: email support@getstrays.com with "Privacy complaint" in the subject, or write to us at our registered office. We'll acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome. If you're not satisfied, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
Changes
If we change this notice in a way that matters, we'll email account admins before it takes effect.