Privacy Policy

Last updated: 28 April 2026
Website: https://stratforge.co.uk
Support: support@stratforge.co.uk
Support information: https://stratforge.co.uk/support/discovery-agent/

1. Who we are

StratForge provides structured Excel-based delivery tools, command packs, customer account services, and AI-assisted product features for individual professionals, teams, and business customers.

For the purposes of this Privacy Policy, "StratForge", "we", "us" and "our" mean:

• Legal entity: Sector Sage Limited
• Registered address: Unit A397 4 - 6 Greatorex Street, Unit A397, London, England, E1 5NF
• Company number: 14910234
• VAT / tax registration: VAT Number 443507407
• Data protection contact: privacy@stratforge.co.uk
• ICO registration number: ZC134789

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you use our website, products, account services, support services, Excel add-ins, and related communications.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal data processed through or in connection with:

• the public website at https://stratforge.co.uk;
• StratForge product, service, support, privacy, terms, cookie, accessibility, and account pages;
• resource downloads, command pack downloads, Insights content, comments, contact forms, and service enquiry forms;
• the StratForge customer account hub, including account access links, purchases, licences, onboarding, workspaces, and hosted credit balances;
• the StratForge Discovery Agent Excel add-in and its related runtime APIs;
• checkout, subscription, top-up, entitlement, workspace, licence, and customer support workflows;
• AI-assisted features made available through StratForge services; and
• communications we send or receive in connection with any of the above.

This Privacy Policy does not govern personal data processed independently by third parties such as Microsoft, Stripe, HubSpot, OpenAI, or other providers when they act under their own privacy notices. For example, Microsoft may separately process AppSource / Microsoft Marketplace installation data and Microsoft identity data under Microsoft's own terms and privacy notices.

3. Key terms used in this policy

In this Privacy Policy:

• "Services" means the StratForge website, add-ins, account hub, software, APIs, support services, downloadable resources, command packs, and related services.
• "Discovery Agent" means the StratForge Discovery Agent Excel add-in and related backend runtime services.
• "Add-in" means the Excel taskpane add-in made available through Microsoft AppSource / Microsoft Marketplace or another approved distribution route.
• "Workspace" means a customer or team environment used for licence entitlement, member access, hosted credit balances, and related account functions.
• "Hosted mode" means use of StratForge-managed AI access and hosted credit balances.
• "Self-Managed mode" means use of the Discovery Agent or related services with a customer-provided OpenAI API key or account.
• "Customer Content" means workbook content, prompts, files, text, comments, instructions, questions, selections, and other material submitted by or on behalf of a user or customer.
• "Personal data" means information relating to an identified or identifiable person.

4. Roles under data protection law

StratForge may act as a controller, a processor, or both, depending on the activity.

We generally act as a controller for website visitor records, account registration and account hub records, purchases, subscriptions, invoices, Stripe identifiers and billing metadata, customer relationship records in HubSpot, support enquiries, marketing consent and communication preferences, security logs, audit records, abuse-prevention records, service telemetry, internal administration records, and compliance records.

For certain B2B customer workflows, including workbook content, prompts, selected ranges, workbook metadata, and related content submitted by users within a customer-controlled Workspace, StratForge may act as a processor on behalf of the relevant customer where the customer determines the purposes and means of processing. In those cases, the customer is responsible for providing appropriate privacy information to its users and ensuring it has a lawful basis for submitting Customer Content to the Services. A separate data processing agreement may apply.

Where we process operational metadata, billing records, security logs, support records, abuse-prevention records, or aggregated service metrics, we may act as an independent controller even if related to a customer Workspace.

5. Personal data we collect

We collect different categories of personal data depending on how you interact with us.

5.1 Website browsing and server log data

When you visit our website or online services, we may collect:

• IP address or hashed IP address;
• user agent and browser information;
• device and operating system information;
• referrer URL and source page;
• pages viewed and interaction events;
• date, time, request metadata, and server log data;
• approximate location derived from technical network information; and
• analytics events where analytics tooling is enabled.

5.2 Resource download data

If you request a semi-gated resource or command pack download, we may collect:

• first name and last name;
• work email address;
• company or organisation;
• role or job title;
• interest area;
• need state;
• follow-up preference;
• marketing opt-in status;
• consent acceptance records;
• requested asset;
• source page and referrer;
• timestamp;
• hashed IP address and user agent; and
• HubSpot sync status and HubSpot contact ID where CRM sync is enabled.

5.3 Contact and service enquiry data

If you submit a contact form, support request, or service enquiry, we may collect:

• first name and last name;
• email address;
• phone number if provided;
• organisation;
• role title;
• capability, product, or service interest;
• delivery context;
• package interest;
• delivery timescale;
• repository, tooling, or technical context;
• sponsor access context;
• delivery mode preference;
• challenge summary, notes, and message content;
• preferred contact method;
• marketing opt-in status;
• consent acceptance records;
• source page, referrer, and CTA source;
• timestamp;
• hashed IP address and user agent; and
• HubSpot sync status and HubSpot contact ID where CRM sync is enabled.

5.4 Insights comments

If you submit a comment on an Insights post or similar content feature, we may collect:

• author name;
• author email address;
• comment body;
• consent acceptance records;
• related post;
• submission timestamp;
• moderation status, such as pending, approved, rejected, or spam;
• reviewer and review timestamp;
• hashed IP address;
• user agent; and
• Cloudflare Turnstile or other anti-bot verification result where configured.

Approved comments may display your author name, comment body, and submission date publicly. We do not intentionally display your email address publicly.

5.5 Purchase, billing, and licence data

If you purchase a StratForge product, subscription, licence, hosted plan, or top-up, we may collect or receive:

• customer email address;
• first name and last name where available;
• organisation or company name where provided;
• product code, plan code, and plan name;
• billing model;
• AI access mode;
• seat model;
• Workspace pooled credit flag;
• included hosted credits and purchased credit pack amounts;
• Stripe checkout session ID;
• Stripe customer ID;
• Stripe subscription ID;
• Stripe payment intent ID;
• Stripe price ID;
• amount, currency, invoice, and purchase metadata;
• source page and CTA source;
• purchase reference;
• webhook event ID and event type;
• provisioning status and provisioning error information;
• HubSpot deal/contact sync status and identifiers where enabled; and
• support, billing, renewal, cancellation, and entitlement history.

Stripe Checkout handles payment card entry and payment processing. We do not intentionally store full payment card numbers or full card security codes on StratForge systems. Stripe may provide payment status, payment identifiers, customer identifiers, subscription identifiers, invoice data, and payment lifecycle events.

5.6 Customer account hub data

If you use the customer account hub, we may process:

• customer email address;
• first name and last name;
• organisation;
• Workspace membership and role;
• purchases, licences, subscriptions, and entitlements;
• hosted credit balances;
• credit grants, credit consumption events, and adjustments;
• onboarding stage;
• account access tokens;
• session cookies;
• sign-in and sign-out events; and
• support and account administration records.

The account hub uses passwordless email access links. Access-link tokens are time-limited. Session tokens may be stored in an HttpOnly cookie named sf_agent_account_session, which is set as Secure in production and SameSite=Lax. The current session maximum age is 30 days unless changed or revoked earlier.

5.7 Microsoft AppSource, Microsoft identity, and Microsoft Graph data

If you install the Discovery Agent through Microsoft AppSource / Microsoft Marketplace or link a Microsoft account during onboarding, Microsoft may separately process information about you, your device, your tenant, and the installation.

Where Microsoft account linking is enabled, we may process Microsoft identity information, including:

• Microsoft user ID;
• email address or user principal name;
• display name;
• given name;
• surname;
• OAuth authentication results;
• account-match status against the purchase or onboarding email; and
• Microsoft 365 group assignment status where enabled.

OAuth scopes may include openid, profile, email, User.Read, and offline_access. Where configured, we may use Microsoft Graph to verify profile information and to add a matched user to a configured Microsoft 365 access group.

Your organisation or Microsoft tenant administrator may control whether the Add-in is available to you and may have access to Microsoft-side deployment or usage information.

5.8 Discovery Agent usage, workbook, and AI-related data

When you use AI-enabled features in the Discovery Agent, the Add-in may send limited workbook-related information to StratForge's backend systems so that we can validate licences, recognise supported workbooks, operate AI-assisted features, provide safe preview-before-write workflows, and maintain operational telemetry.

Depending on the feature used, this may include:

• workbook and sheet metadata needed to identify supported workbooks;
• active sheet or stage;
• selected cell or range metadata;
• selected cell content where needed for Ask, Review, Write, or related features;
• user prompts, questions, and instructions;
• review findings;
• proposed write targets and draft content;
• safety and gating metadata, including formula, protected, read-only, header, governed-area, and workbook-state indicators;
• write-preview events;
• user-approved write-commit events;
• undo events;
• Hosted credit consumption events; and
• operational telemetry used for entitlement, reliability, audit, and support purposes.

The taskpane is designed to route AI requests through the StratForge backend rather than calling OpenAI directly from the client. Where AI features are used, we send the relevant prompt, selected workbook context, and necessary metadata to OpenAI or another configured AI service provider to generate responses, review findings, proposed workbook content, or other AI-assisted outputs.

The Add-in is designed to use the minimum workbook context reasonably necessary for the feature being used. The Add-in does not need to send an entire workbook for every request. You are responsible for deciding what workbook content you select or submit for AI-assisted processing.

StratForge does not retain AI prompts or workbook content by default after an AI request has been processed, unless retention is necessary to provide the service, investigate a security or abuse issue, comply with law, or handle a support request where you have chosen to provide that content. Operational logs may record metadata about AI requests, such as action type, timestamp, user or Workspace identifier, model or service used, request status, error status, token or credit usage, and safety-gating outcomes. We aim to avoid recording raw workbook content, prompts, API keys, secrets, or unnecessary personal data in operational logs.

StratForge does not use Customer Content, workbook content, prompts, selected workbook context, or AI outputs to train AI models unless expressly agreed with the customer or user.

5.9 Hosted credit and usage ledger data

For Hosted mode, we may process:

• Workspace ID and Workspace name;
• organisation and billing email;
• hosted wallet status;
• included credit balance;
• purchased credit balance;
• credit period start and end;
• credit grants;
• credit consumption events;
• action type, such as chat, review, write preview, write commit, undo write, expiry, or adjustment;
• credits consumed;
• balance after consumption; and
• source event or reference.

We use this data to enforce hosted usage limits, show credit balances, support top-ups, investigate billing or support issues, and reconcile commercial activity.

5.10 Self-Managed OpenAI key data

If you use Self-Managed mode, you may provide your own OpenAI API key or related credential. The Discovery Agent does not call OpenAI directly from the Excel taskpane. Instead, requests are routed through the StratForge backend, which relays relevant prompts and workbook context to OpenAI using the customer-provided key.

Self-Managed OpenAI API keys are stored in encrypted server-side form where persistent storage is required to provide the service. We do not store OpenAI API keys in the Excel workbook, browser local storage, or client-side code, and we do not intentionally log raw API keys.

You can replace or remove your Self-Managed API key through the relevant account or settings process. When a key is removed or the relevant Self-Managed service ends, we will delete the key material unless temporary retention is required for security, legal, or incident-investigation purposes.

5.11 Support, audit, CMS, and administration data

When we operate our CMS, support, internal review, comment moderation, billing support, licence troubleshooting, workspace support, hosted credit adjustments, and admin tooling, we may process:

• administrator, editor, reviewer, and support-user identity data;
• support messages and attachments;
• account, purchase, licence, workspace, and credit records;
• comment moderation records;
• audit logs and access logs;
• error reports, operational logs, and provisioning logs;
• internal notes where necessary for support or administration; and
• security investigation records.

Internal access is intended to be role-based and limited to personnel, contractors, or service providers who need access for legitimate business, technical, support, legal, or security purposes.

Support is email-only at launch. Support requests are handled through support@stratforge.co.uk and related email workflows unless and until a dedicated support platform is introduced.

6. Sources of personal data

We may receive personal data from:

• you, when you browse, submit forms, comment, purchase, use the account hub, use the Add-in, contact support, or communicate with us;
• your organisation, Workspace owner, Workspace administrator, Microsoft tenant administrator, or other authorised representative;
• Microsoft, where AppSource installation, Microsoft identity, Microsoft Graph, or Microsoft 365 group assignment features are used;
• Stripe, where checkout, payment, subscription, invoice, or payment lifecycle events occur;
• HubSpot, where CRM sync or marketing/contact records are enabled;
• OpenAI or another AI provider, where AI requests, responses, and related metadata are processed;
• anti-spam, security, analytics, and hosting providers; and
• public or business contact sources where permitted by law.

7. Purposes and lawful bases

We use personal data only where we have a lawful basis under applicable data protection law. The lawful bases that may apply include performance of a contract, steps before entering a contract, legitimate interests, consent, compliance with legal obligations, and, in limited circumstances, another lawful basis permitted by law.

Where we rely on legitimate interests, we balance those interests against your rights, freedoms, and reasonable expectations.

8. AI processing and automated decisions

The Discovery Agent includes AI-assisted features that can help users ask questions, review selected workbook content, generate draft suggestions, and prepare write previews.

AI outputs may be incomplete, inaccurate, unsuitable, outdated, or inappropriate for your specific circumstances. AI features do not replace professional judgement, business analysis, quality assurance, governance review, or customer approval. You are responsible for reviewing AI outputs before using them and for validating any workbook changes before applying them.

The Discovery Agent is designed to require user review and approval before AI-generated draft content is written into workbook cells. Protected, formula-driven, header, read-only, and governed workbook areas may be blocked from review or write paths where relevant, and safety checks may be re-run before a write commit.

We do not intend AI features to make solely automated decisions that produce legal or similarly significant effects about individuals. If a customer uses outputs in a decision-making process, the customer is responsible for ensuring appropriate human review, lawful basis, transparency, fairness, and compliance with applicable law.

9. Hosted mode and Self-Managed mode

Hosted mode

In Hosted mode, StratForge manages the AI provider relationship and hosted credit balance for the relevant plan or Workspace. We record usage and credit consumption events so that we can provide the service, show balances, enforce limits, support top-ups, and resolve billing or support queries.

Relevant AI inputs may be sent by StratForge to OpenAI or another disclosed AI subprocessor to generate responses, review findings, proposed workbook content, or other AI-assisted outputs. Hosted usage is associated with your StratForge account, Workspace, licence, and Hosted credit balance.

Self-Managed mode

In Self-Managed mode, customers provide their own OpenAI API key or AI account credential. We use the key to relay AI requests through the StratForge backend. Customers are responsible for their OpenAI account, provider terms, provider charges, rate limits, usage limits, safety settings, and compliance obligations.

We do not control how OpenAI applies its own terms, policies, data controls, retention settings, or account-level commitments to a customer's Self-Managed account.

10. Cookies and similar technologies

We use cookies and similar technologies to operate and secure the Services.

Essential cookies

Essential cookies are necessary for core service functions, such as security, authentication, session management, and account access. For example, the customer account hub may use the HttpOnly session cookie sf_agent_account_session.

Non-essential cookies

At launch, StratForge uses strictly necessary cookies only.

Analytics cookies, HubSpot browser tracking cookies, advertising or marketing pixels, and session replay tools are not active at launch. We will not enable non-essential cookies or similar technologies unless and until we implement an appropriate cookie consent banner and preference-management mechanism where required.

Server-side HubSpot CRM sync may be used for form submissions, customer records, download records, service enquiries, and checkout/order records. This is separate from HubSpot browser tracking cookies.

Anti-spam and security technologies

We may use anti-spam, anti-bot, rate-limiting, duplicate submission checks, honeypots, minimum submission time checks, hashed IP addresses, user agent checks, and services such as Cloudflare Turnstile where configured.

11. Marketing communications

We may send marketing communications where you have opted in, where we are otherwise permitted by law to do so, or where we have a legitimate interest in contacting business users about relevant StratForge products or services.

You can unsubscribe from marketing emails by using the unsubscribe link in the email or by contacting us. We may retain a suppression record to ensure we respect your opt-out.

Service, transactional, account, billing, security, and legal notices are not marketing communications and may still be sent where necessary.

12. Comments and public content

If you submit a comment and it is approved, your author name, comment body, and submission date may be displayed publicly. Your email address is used for moderation, anti-spam, abuse prevention, and administration and should not be displayed publicly.

We may reject, remove, or moderate comments that are spam, abusive, unlawful, irrelevant, misleading, promotional, or otherwise unsuitable for publication.

13. How we share personal data

We may share personal data with the following categories of recipients where necessary and lawful.

Production hosting for the StratForge platform is provided through Microsoft Azure, including Azure App Service, Azure Database for PostgreSQL Flexible Server, Azure Blob Storage, Azure Key Vault, and Azure-native monitoring services such as Azure Application Insights / Log Analytics where configured.

Our intended production hosting position is UK/EEA primary hosting. We use separate production and staging databases and local development databases for development activity. Preview environments may be introduced later if required.

Confirmed launch third-party providers include Microsoft AppSource / Microsoft Marketplace, Microsoft identity / Microsoft Graph, Microsoft Azure, Stripe, HubSpot, OpenAI, and Resend.

Only some providers act as subprocessors for DPA-covered Customer Personal Data. The current DPA-approved subprocessor position is described in the StratForge Data Processing Addendum and covers providers that process B2B Customer Personal Data on StratForge's behalf, such as Microsoft Azure, OpenAI, Resend where used for customer service emails, Microsoft identity / Microsoft Graph where configured for customer account-linking workflows, and relevant security or monitoring providers where configured.

Stripe and HubSpot primarily support StratForge's own payment, subscription, CRM, enquiry, customer relationship, and commercial administration workflows, where StratForge acts as controller or where the provider acts under its own terms. Stripe and HubSpot will be treated as DPA-approved subprocessors only if they are later used to process customer-controlled workbook content, prompts, support extracts, Workspace-user data under customer instructions, or other DPA-covered Customer Personal Data.

Cloudflare Turnstile is planned for anti-bot protection and will be active only where configured. Azure Application Insights / Log Analytics may be used for operational monitoring if Azure-native monitoring is enabled.

No analytics provider, advertising pixel, session replay tool, or external error-monitoring provider is planned for launch unless this Privacy Policy and our cookie disclosures are updated as needed.

Support is email-only at launch. Support requests are handled through support@stratforge.co.uk and related email workflows unless and until a dedicated support platform is introduced.

We do not sell personal data in the ordinary sense of that term.

14. International transfers

Some of our providers, infrastructure, or support operations may be located outside the United Kingdom or may allow personal data to be accessed from outside the United Kingdom.

Where a restricted transfer of personal data occurs, we will use a lawful transfer mechanism where required, such as:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK International Data Transfer Addendum to the EU Standard Contractual Clauses;
• another appropriate safeguard permitted by law; or
• a specific exception where permitted by law.

We will also consider transfer risk assessments where required.

15. How long we keep personal data

We keep personal data for as long as necessary for the purposes described in this Privacy Policy, including to provide the Services, manage accounts, support customers, keep security records, comply with legal obligations, resolve disputes, maintain accounting and tax records, and establish, exercise, or defend legal claims.

When personal data is no longer needed, we will delete, anonymise, or otherwise handle it in accordance with applicable law and our operational processes. Some information may remain in encrypted or access-controlled backups for a limited period after deletion from live systems. Standard backups are retained for up to 30 days unless a longer period is required for security, disaster recovery, legal, regulatory, accounting, or dispute-resolution purposes.

We may keep anonymised, aggregated, or statistical information for longer where it no longer identifies an individual.

16. Security

We use technical and organisational measures designed to protect personal data. These may include, as applicable:

• HTTPS in production;
• production CORS and CSRF allowlists;
• Stripe webhook signature verification;
• Microsoft OAuth state signing and expiry;
• passwordless account access tokens with expiry;
• HttpOnly account session cookies;
• rate limiting and duplicate submission checks;
• honeypot and minimum submission time checks on public forms;
• hashed IP storage for anti-abuse and rate-limiting records;
• optional Cloudflare Turnstile verification;
• safe logging practices that redact keys, bearer tokens, and secrets;
• role-based access in the CMS and admin tools;
• environment-variable secret management rather than storing secrets in source code;
• restricted internal access based on role and operational need; and
• support and audit tooling for investigation and remediation.

No online service can be guaranteed to be completely secure. You are responsible for using the Services responsibly, protecting your access links and devices, and ensuring your organisation's users follow appropriate security practices.

17. Your rights

Depending on your location and the nature of the processing, you may have rights to:

• request access to your personal data;
• request correction of inaccurate personal data;
• request deletion of personal data;
• request restriction of processing;
• object to processing, including direct marketing;
• request data portability;
• withdraw consent where processing is based on consent;
• complain to a supervisory authority; and
• challenge certain automated decisions where applicable.

These rights are not absolute and may depend on the lawful basis, the type of data, legal retention obligations, contractual needs, and other factors.

To exercise your rights, contact us at privacy@stratforge.co.uk. You may also contact us through support@stratforge.co.uk. We may need to verify your identity before responding.

If your request relates to personal data contained in a workbook or Workspace controlled by your organisation, we may refer your request to that organisation or act on its instructions, because the organisation is usually the controller of that data.

If you are in the United Kingdom, you may complain to the Information Commissioner's Office. We would appreciate the opportunity to address your concerns first, but you are not required to contact us before contacting the ICO.

18. Customer administrator and organisation controls

If you use the Services through an organisation, Workspace, Microsoft tenant, or customer account, your organisation or administrator may control:

• whether you can access the Add-in or Services;
• whether you are assigned to a Microsoft 365 group;
• your Workspace role and permissions;
• billing and entitlement settings;
• Hosted credit allocation or usage permissions;
• whether Self-Managed or Hosted mode is used; and
• whether data submitted through the Services is subject to a customer data processing agreement, security policy, retention policy, or internal governance process.

Contact your organisation if you have questions about how it manages access, submissions, workbook data, or Workspace settings.

19. Children

The Services are designed for professional and business use and are not directed at children. You must be at least 18 years old, or the age of majority in your jurisdiction, to create an account, make a purchase, or use paid Services unless otherwise permitted under a written agreement.

We do not knowingly collect personal data from children through the Services. If you believe a child has provided personal data to us, contact us so that we can investigate and take appropriate action.

20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will take reasonable steps to notify users or customers, such as by updating the website, sending a service notice, or displaying an in-product notice where appropriate.

The "Last updated" date at the top of this Privacy Policy indicates when it was last revised.

21. Contact us

For privacy questions, rights requests, or concerns, contact:

StratForge / Sector Sage Limited

Unit A397 4 - 6 Greatorex Street, Unit A397, London, England, E1 5NF

Email: privacy@stratforge.co.uk

For product support, contact: support@stratforge.co.uk For legal notices, contact: legal@stratforge.co.uk