DataStrat LLC builds ARIA, an AI-powered platform that helps organizations assess and improve their data management and AI readiness. This Privacy Policy explains how we collect, use, share, and protect personal information when you visit our website, sign up to learn about ARIA, or otherwise interact with us.

1. About this Privacy Policy

​

DataStrat LLC ("DataStrat," "we," "us," or "our") is a Texas limited liability company. This Privacy Policy applies when you:

​

• Visit datastrat.ai or another website that we operate and that links to this Privacy Policy (each, the "Site");
• Sign up to learn about ARIA or take part in the ARIA Early Access Program (the "Program"), which is open only to people in the United States and Canada;
• Receive or interact with our emails and other communications;
• Attend our webinars, demos, or events, or interact with our pages on social media; or
• Contact or communicate with us in any other way.

​

This Privacy Policy does not apply to personal information that we process for a business customer under a written agreement, such as information in documents that an organization gives us for an assessment. The agreement with that customer governs that processing.

​

More information applies depending on where you live:

​

• Europe (the European Economic Area, the United Kingdom, and Switzerland): see Section 13.
• Canada: see Section 14.
• U.S. states with privacy laws: see Section 15.

​

2. Personal information we collect

​

2.1 Information you give us

​

• Sign-up information: Your first name, last name, work email address, and country, and your confirmation that you are located in the United States or Canada. We use the domain of your email address (for example, "example.com") to identify the organization you work for.
• Communications: Information you give us when you email us, reply to our emails, book a meeting, take part in a call or demo, or contact us in another way, including the content of your messages.
• Program information: If we consider or invite your organization for a complimentary assessment: information about your role and your organization, scheduling details, and other information you give us during that process.
• Event information: If you register for a webinar or event: your registration details, such as your name, work email address, organization, and job title, and whether you attended.
• Preferences and consent records: Your email preferences, and a record of when and how you signed up, confirmed your subscription, or unsubscribed (including the date, time, web page, and IP address).

​

2.2 Information from other sources We may add business information about you from other sources to the information you give us:

​

• Public professional sources, such as your public professional profile (for example, on LinkedIn), your organization's website, and news releases. From these sources, we may collect your job title, seniority, department, employer, industry, work location (city and country), and the web address of your public professional profile.
• Business data providers, which supply business contact and company information, such as job title, department, organization name, industry, organization size, and location.
• Our service providers, such as our email platform, which tells us how recipients interact with our emails.

​

From these sources, we collect only information about your professional role. We do not use them to collect sensitive information about you.

​

2.3 Information we collect automatically When you visit the Site or open our emails, we and our service providers may collect:

​

• Device and connection data, such as your IP address, browser type and version, operating system, device type, language settings, and your approximate location (city, region, or country), which we derive from your IP address.
• Usage data, such as the pages you view, the time you spend on them, the links you click, the website that sent you to the Site, and the date and time of your visits.
• Email interaction data, such as whether you opened our emails and which links you clicked. We do not collect this data from people in the European Economic Area, the United Kingdom, or Switzerland (see Section 13.3).

​

We collect some of this information with cookies and similar technologies. See Section 5 and our Cookie Notice.

​

2.4 Information we ask you not to send

​

Please do not send us sensitive information, such as government identification numbers, financial account numbers, health information, or information about racial or ethnic origin, political opinions, religious beliefs, or union membership. Please also do not send us your organization's confidential documents or data until your organization and DataStrat have signed a written agreement for an assessment.

​

3. How we use personal information

​

We use personal information for these purposes:

​

• To respond to your sign-up and tell you about ARIA: We send you the information you asked for, such as product updates, launch news, Program updates, invitations to demos, webinars, and events, and educational content about data management and AI readiness.
• To run the ARIA Early Access Program: We review sign-ups, decide which organizations to invite for a complimentary assessment, communicate with you about the Program, and prepare the written agreement with your organization.
• For marketing and business development: We send marketing emails, tailor them to your role, industry, and interests, measure how our communications perform, and plan our outreach. If you accept advertising cookies, we also use the LinkedIn Insight Tag to measure our LinkedIn advertising and to show our ads on LinkedIn to people who visited the Site.
• To show interest in ARIA to investors, incubators, and accelerators: We create aggregated statistics about sign-ups (for example, the number of sign-ups, industries, organization size ranges, regions, and seniority mix) and lists of the organizations whose employees signed up. Section 4 explains the limits on what we share.
• To operate, secure, and improve the Site: We host and maintain the Site, fix problems, understand how visitors use it, and protect it and our sign-up form against spam, fake sign-ups, fraud, and attacks.
• For legal, compliance, and protection purposes: We comply with laws, including anti-spam laws; keep records of consents and opt-outs; respond to lawful requests; enforce our terms; and establish, exercise, or defend legal claims.
• For business transactions, as described in Section 4.
• To create aggregated or de-identified information: We may create information that does not identify you, such as statistics about sign-ups, and use it for any lawful purpose. We will not try to re-identify it, except as the law allows.

​

Automated tools and AI:

We may use software and AI-enabled tools from our service providers to help us organize sign-ups, analyze trends, and draft communications. A person at DataStrat decides which organizations we invite to the Program. We do not make decisions about you that have legal or similarly significant effects based only on automated processing. When we use AI-enabled service providers, we use business offerings whose terms do not allow the provider to use our data to train its general AI models.

​

4. How we share personal information

​

We share personal information only as described below:

​

• Service providers: Companies that perform services for us, such as website development, hosting, and maintenance; email delivery and marketing automation; customer relationship management; data enrichment; website analytics; cookie consent management; security and spam protection; scheduling and event platforms; and productivity, collaboration, and AI-enabled tools. Our software development contractor is located in Canada. Our service providers may use personal information only to provide services to us, under contracts with us.
• Investors, incubators, and accelerator programs: We share only (a) aggregated statistics about sign-ups (for example, "150 sign-ups from 90 organizations in 12 countries"), and (b) the names of organizations whose employees signed up, which we describe as expressions of interest, not as customers or commitments. We do not give these recipients your name, email address, job title, or other contact details. We do not combine an organization's name with job titles or other details that could identify you, and we do not share an organization's name if it identifies an individual (for example, a business named after its owner). We ask recipients to keep this information confidential.
• Advertising partners: If you accept advertising cookies, LinkedIn receives information about your visits to the Site through the LinkedIn Insight Tag. See our Cookie Notice.
• Framework owners: Some assessments use industry frameworks that belong to other organizations. If we perform an assessment for your organization under a license from a framework owner, the license may require us to tell the framework owner your organization's name and that the assessment took place. We will tell your organization before the assessment starts. We will share anonymized assessment results with a framework owner only if your organization agrees.
• Professional advisers: Such as lawyers, accountants, auditors, and insurers, who must keep the information confidential.
• Authorities and others when the law requires or permits: We may disclose personal information to government authorities, courts, or other parties when we believe in good faith that the law requires it, or that it is necessary to protect the rights, safety, or property of DataStrat or others, or to prevent fraud or security problems.
• Business transactions: If we are involved in an actual or proposed merger, acquisition, reorganization, bankruptcy, or sale of all or part of our business or assets, we may disclose personal information to the other parties and their advisers. We do this under confidentiality obligations and only as needed for the transaction (for example, for due diligence). If another company acquires our business, your personal information will remain subject to this Privacy Policy, unless we notify you otherwise and give you any choices that the law requires. In a financing, investors receive only the information described under "Investors, incubators, and accelerator programs" above.
• With your consent or at your direction.

​

We do not sell your personal information, and we do not give your name or email address to other companies for their own marketing. Some U.S. state laws may treat the use of advertising cookies, such as the LinkedIn Insight Tag, as a "sale" or "sharing" of personal information for targeted advertising. We use advertising cookies only if you accept them, and you can change your choice at any time (see Section 6).

​

5. Cookies and similar technologies

​

We use cookies, pixels, and similar technologies on the Site and in our emails. On the Site, some cookies are necessary to run it, and we use all other cookies only if you accept them. In our emails, we use pixels and tracked links to learn whether emails are opened and links are clicked, except in emails to people in the European Economic Area, the United Kingdom, or Switzerland. When third-party analytics or advertising providers place cookies on the Site, they may collect information about your online activities over time and across different websites. Our Cookie Notice lists the technologies we use and explains your choices.

​

6. Your choices

​

• Unsubscribe: Every marketing email we send includes an unsubscribe link. You can also write to privacy@datastrat.ai. After you unsubscribe, we may still send you messages that are not marketing, such as replies to your questions.
• Cookie Settings: Use the "Cookie Settings" link at the bottom of every page of the Site to accept or refuse optional cookies, or to change your choice later. You can also block or delete cookies in your browser settings.
• Global Privacy Control (GPC): If your browser sends a GPC signal, we treat it as a request to opt out of any "sale" or "sharing" of your personal information for targeted advertising, including through advertising cookies, for that browser.
• Do Not Track: Some browsers send "Do Not Track" signals. Because there is no common standard for these signals, we do not respond to them. We do honor GPC signals, as described above.
• Email images: You can stop email tracking pixels from loading by turning off images in your email program.
• Declining to give information: You do not have to give us personal information. However, we need your name and work email address to sign you up.

​

7. Your privacy rights

​

Wherever you live, you can ask us to:

• Tell you what personal information we hold about you, and give you a copy of it;
• Correct personal information that is wrong or incomplete;
• Delete your personal information;
• Stop sending you marketing emails;
• Stop adding information about you from other sources; and
• Leave your sign-up out of the statistics and organization lists that we share with investors, incubators, and accelerators.

​

You may have more rights depending on where you live. See Sections 13, 14, and 15.

​

To make a request, email privacy@datastrat.ai from the email address you used to sign up, or write to us at the address in Section 12. We may need to verify your identity before we act on your request. Usually, we do this by confirming that you control the email address you gave us. If we cannot verify your identity, we may decline your request. Where the law allows, an authorized agent can make a request for you, but we may ask for proof that you authorized the agent.

​

We aim to respond within 30 days. If we need more time and the law allows it, we will tell you why and how much more time we need. If we decline your request, we will tell you why. You can appeal our decision by replying to our response. We will not discriminate against you for using your privacy rights.

​

8. How long we keep personal information

​

We retain personal information as outlined below:

​

• Sign-up information, information from other sources, and email interaction data: Kept while you are subscribed to our emails. If you do not open, click, or reply to any of our emails for 24 months, we delete or anonymize it. Because we do not track opens or clicks for people in the European Economic Area, the United Kingdom, or Switzerland, we instead ask them every 24 months whether they want to stay subscribed, and we delete or anonymize the information of those who do not confirm.
• Unconfirmed sign-ups: If you do not confirm your email address, we delete your sign-up information within 30 days.
• Information after you unsubscribe: We stop sending you marketing. Within 90 days, we delete or anonymize your sign-up information, except two things: your email address, which we keep on a "do not contact" list so that we respect your choice, and the record of your consent and opt-out.
• Program records: For the duration of the Program and up to 24 months after it ends. If your organization signs an agreement with us, that agreement governs the records related to it.
• Consent and opt-out records: Up to 3 years after your consent ends, so that we can show that we complied with anti-spam laws. We keep the "do not contact" list for as long as we send marketing emails.
• Communications with us: Up to 3 years after our last communication, unless we need them longer for an agreement or a legal claim.
• Website usage and security log data: Up to 14 months in our analytics tool. Up to 12 months in server and security logs, unless we need it longer to investigate a security incident. How long each cookie stays on your device is shown in Cookie Settings (see our Cookie Notice).
• Aggregated or de-identified information: Retained without a time limit, because it does not identify you.

​

We may keep personal information for longer if the law requires it, or if we need it to establish, exercise, or defend legal claims.

​

9. How we protect personal information

​

We use reasonable administrative, technical, and physical safeguards to protect personal information. These include access controls, multi-factor authentication, encryption of data in transit, and contracts that require our service providers to protect personal information. However, no method of internet transmission or electronic storage is completely secure, so we cannot guarantee absolute security. If a security incident affects your personal information, we will notify you and the authorities as the law requires.

​

10. International transfers

​

DataStrat is based in the United States. We and our service providers store and process personal information in the United States, Canada, and other countries. These countries may have data protection laws that are different from the laws where you live. When we transfer personal information across borders, we protect it as described in this Privacy Policy. Section 13.8 has more information for users in Europe, and Section 14 for users in Canada.

​

11. Children

​

The Site and our services are for business professionals. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe that a child has given us personal information, contact us at privacy@datastrat.ai and we will delete it.

​

12. Other websites, changes, and how to contact us

​

• Other websites: The Site may link to websites and services that other companies operate, such as LinkedIn. Their privacy policies, not this one, apply to those websites and services.
• Changes: We may update this Privacy Policy. We will post the new version on the Site and change the effective date at the top. If we make material changes, we will tell you by email or by a clear notice on the Site before the changes take effect. If the law requires your consent to a change, we will ask for it.
• Contact us: If you have questions about this Privacy Policy, or you want to use your privacy rights, contact our Privacy Officer:
  
  Email: privacy@datastrat.ai
  Mail: DataStrat LLC, Attn: Privacy Officer, 5900 Balcones Drive, Suite 100, Austin, TX 78731, United States

​

13. Notice to users in Europe

​

13.1 Scope

​

This Section applies if you are in the European Economic Area (the "EEA"), the United Kingdom (the "UK"), or Switzerland. It adds to the rest of this Privacy Policy. The ARIA Early Access Program is open only to people in the United States and Canada, and we do not accept sign-ups from the EEA, the UK, or Switzerland. If we learn that we hold sign-up information about a person in those places, we delete it. This Section still applies to any personal information about you that we process, for example when you visit the Site or contact us. In this Section, "personal information" means "personal data" as defined in the EU General Data Protection Regulation (the "GDPR"), the UK GDPR, and the Swiss Federal Act on Data Protection (together, "European data protection law").

​

13.2 Controller

​

DataStrat LLC is the controller of the personal information described in this Privacy Policy. Our contact details are in Section 12.

​

LinkedIn Insight Tag: If you accept advertising cookies, DataStrat and LinkedIn are joint controllers for the collection of data through the LinkedIn Insight Tag on the Site and for its transmission to LinkedIn. LinkedIn is responsible for its own processing of that data after it receives it, as described in LinkedIn's Privacy Policy. You can use your rights under European data protection law against either of us.

​

13.3 Legal bases for processing

​

European data protection law requires us to have a legal basis for each purpose for which we use your personal information. Our legal bases are:

​

• Purpose: Sending you the information about ARIA that you asked for when you signed up
• Personal Information: Sign-up information; preferences and consent records
• Legal Basis: Consent. You give consent when you sign up and confirm your subscription. You can withdraw it at any time by unsubscribing.
• Purpose: Tailoring our emails and adding business information from other sources
• Personal Information: Sign-up information; information from other sources
• Legal Basis: Legitimate interests: to send relevant information to professionals who asked to hear from us.
• Purpose: Running the ARIA Early Access Program
• Personal Information: Sign-up information; information from other sources; Program information; communications
• Legal Basis: Legitimate interests: to run a fair and manageable Program and to invite suitable organizations.
• Purpose: Showing interest in ARIA to investors, incubators, and accelerators
• Personal Information: Sign-up information and information from other sources, used only to create aggregated statistics and organization lists
• Legal Basis: Legitimate interests: to obtain funding and support for our business. We limit what we share to aggregated statistics and organization names.
• Purpose: Operating and securing the Site, including strictly necessary cookies
• Personal Information: Device and connection data; usage data
• Legal Basis: Legitimate interests: to provide a secure Site that works properly.
• Purpose: Analytics cookies
• Personal Information: Device and connection data; usage data
• Legal Basis: Consent.
• Purpose: Advertising cookies (LinkedIn Insight Tag)
• Personal Information: Device and connection data; usage data; online identifiers
• Legal Basis: Consent.
• Purpose: Responding to your messages and requests
• Personal Information: Communications; contact details
• Legal Basis: Legitimate interests: to respond to you. Legal obligation, for requests under data protection law.
• Purpose: Keeping records, complying with the law, and handling legal claims
• Personal Information: Any relevant information
• Legal Basis: Legal obligation. Legitimate interests: to show that we comply with the law, and to establish, exercise, or defend legal claims.
• Purpose: Business transactions
• Personal Information: Any relevant information
• Legal Basis: Legitimate interests: to evaluate and carry out business transactions.

​

We do not track whether people in the EEA, the UK, or Switzerland open our emails or click links in them. You can ask us for more information about how we balanced our legitimate interests against your rights.

​

13.4 Information from other sources

​

As Section 2.2 explains, we may add business information about you from public professional sources and business data providers. This information may include your job title, seniority, department, employer, industry, work location, organization size, and the web address of your public professional profile. You can object to this at any time (see Section 13.6).

​

13.5 How long we keep personal information

​

See Section 8.

​

13.6 Your rights

​

Under European data protection law, you have the right to:

​

• Access your personal information and receive information about how we process it;
• Correct inaccurate or incomplete personal information;
• Delete your personal information in certain cases;
• Restrict our processing of your personal information in certain cases;
• Data portability: receive the personal information that you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another organization, where our processing is based on your consent and is carried out by automated means;
• Object to processing based on our legitimate interests, on grounds relating to your particular situation. You can object to direct marketing at any time, for any reason, and we will stop; and
• Withdraw your consent at any time. This does not affect processing that took place before you withdrew it.

​

To use these rights, contact us as described in Section 7. We will respond within one month. For complex or numerous requests, we may extend this by up to two more months, and we will tell you if we do.

​

13.7 Complaints

​

You can complain to us at privacy@datastrat.ai. We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to lodge a complaint with a data protection supervisory authority, in particular where you live or work or where you believe an infringement took place:

​

• EEA: see the list of national authorities on the European Data Protection Board website.
• UK: the Information Commissioner's Office, ico.org.uk, telephone 0303 123 1113.
• Switzerland: the Federal Data Protection and Information Commissioner, edoeb.admin.ch.

​

13.8 International transfers

​

When you submit information through the Site, it goes to DataStrat in the United States. When we transfer personal information that is subject to European data protection law to service providers in other countries, we use one of these safeguards:

​

• Adequacy decisions: We transfer personal information to countries that the European Commission, the UK government, or the Swiss Federal Council has found to provide adequate protection, such as Canada, where our development contractor is located. For U.S. service providers that are certified under the EU-U.S. Data Privacy Framework, the UK Extension to it, or the Swiss-U.S. Data Privacy Framework, we rely on that certification.
• Standard contractual clauses: In other cases, we use the standard contractual clauses approved by the European Commission, together with the UK International Data Transfer Addendum or the Swiss amendments where needed.

​

You can ask us for more information about these safeguards, or for a copy of them, at privacy@datastrat.ai.

​

13.9 Other information

​

You do not have a legal or contractual obligation to give us personal information. However, if you do not give us your name and work email address, we cannot sign you up. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

​

14. Notice to users in Canada

​

• Consent: We collect, use, and disclose your personal information with your consent, as described in this Privacy Policy, or as the law otherwise permits. You can withdraw your consent at any time, subject to legal or contractual restrictions, by unsubscribing or by contacting us. If you withdraw consent, we may not be able to send you information about ARIA or consider your organization for the Program.
• Commercial electronic messages: We send commercial electronic messages only with your consent or as Canada's Anti-Spam Legislation otherwise allows. Each message identifies DataStrat, includes our contact information, and contains an unsubscribe mechanism. We process unsubscribe requests within 10 business days.
• Storage outside Canada: We and our service providers store and process personal information in the United States and other countries. When your information is outside Canada, it is subject to the laws of those countries, and courts, law enforcement, and national security authorities there may be able to access it.
• Access and correction: You can ask to access and correct your personal information as described in Section 7.
• Privacy Officer: Our Privacy Officer is responsible for our compliance with this Privacy Policy and can be reached at privacy@datastrat.ai.
• Complaints: If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca). If you are in Quebec, you can also contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

​

15. U.S. state privacy rights

​

15.1 Scope

​

Several U.S. states, such as California, Colorado, Connecticut, Texas, and Virginia, have consumer privacy laws ("State Privacy Laws"). Some of these laws may not apply to DataStrat, or to information about you in your professional role. Even so, we offer everyone the rights described in Section 7. This Section gives additional information that State Privacy Laws require, where they apply.

​

15.2 Your rights

​

Depending on your state, you may have the right to:

• Know the categories and specific pieces of personal information we collected about you, the categories of sources, our purposes, and the categories of third parties to whom we disclosed it;
• Access your personal information and get a portable copy of it;
• Correct inaccurate personal information;
• Delete your personal information;
• Opt out of the "sale" or "sharing" of your personal information, and of its processing for targeted advertising;
• Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in this kind of profiling);
• Limit the use of sensitive personal information (we do not collect it);
• Appeal our decision on your request; and
• Not be discriminated against for using these rights.

​

To use these rights, see Section 7. To opt out of targeted advertising, use the "Cookie Settings" link or send a GPC signal (see Section 6). If we deny your appeal, you can contact your state attorney general.

​

15.3 Information about our practices

​

We collect the following categories of personal information. We collect them from the sources described in Section 2, use them for the purposes described in Section 3, and keep them for the periods described in Section 8:

​

• Category: Identifiers
• Examples: Name, work email address, IP address, online identifiers
• Disclosed for a business purpose to: Service providers; professional advisers; authorities when the law requires
• Sold or shared for targeted advertising: None, except online identifiers collected by LinkedIn through the LinkedIn Insight Tag, and only if you accept advertising cookies
• Category: Professional or employment-related information
• Examples: Job title, seniority, department, employer, organization size, industry
• Disclosed for a business purpose to: Service providers; professional advisers
• Sold or shared for targeted advertising: None
• Category: Internet or other electronic network activity
• Examples: Pages viewed, links clicked, referring website, email opens and clicks
• Disclosed for a business purpose to: Service providers
• Sold or shared for targeted advertising: None, except Site activity collected by LinkedIn through the LinkedIn Insight Tag, and only if you accept advertising cookies
• Category: General location
• Examples: City, region, or country, derived from your IP address or from public sources
• Disclosed for a business purpose to: Service providers
• Sold or shared for targeted advertising: None
• Category: Inferences
• Examples: Your likely interest in ARIA, based on your role and engagement
• Disclosed for a business purpose to: Service providers
• Sold or shared for targeted advertising: None

​

With investors, incubators, and accelerators, we share only aggregated or de-identified information, including organization names that do not identify you (see Section 4). We do not collect sensitive personal information. We do not knowingly sell or share the personal information of consumers under 16 years of age.

​

15.4 Other state notices

​

• California "Shine the Light": We do not disclose personal information to third parties for their own direct marketing purposes.
• Nevada: We do not sell covered information, as Nevada law defines those terms.
• De-identified information: We keep and use de-identified information without attempting to re-identify it, except as the law allows.

DataStrat LLC builds ARIA, an AI-powered platform that helps organizations assess and improve their data management and AI readiness. This Privacy Policy explains how we collect, use, share, and protect personal information when you visit our website, sign up to learn about ARIA, or otherwise interact with us.