Privacy
Policy.

Stratify is an AI-assisted email client. To do that well we read, summarise and draft replies to your email. This document describes exactly what we collect, why, how long we keep it, and how you can get it out of our systems.

01 What we collect

Only what we need to run the product.

• Account data. Your name, email address, and the organisation you belong to.
• Mailbox content. Message bodies, subjects, participants, timestamps and attachments for the mailbox you connect. Read with your OAuth consent.
• Assistant data. Priority definitions, writing samples, corrections, and memory facts you provide. Generated summaries, tags and drafts.
• Usage telemetry. Feature events (e.g. "draft refined"), performance metrics, and error traces. No keystrokes, no mouse tracking, no session replay.

02 How we use it

To produce summaries, tags and drafts — nothing else.

Email content is used only to generate the features you see: a one-line summary, a priority tag, a draft reply, and the memory the assistant uses to stay accurate for you.

We do not use your email content to train general-purpose models. We do not sell or rent it. We do not scan it for advertising, product marketing, or lead generation.

03 Where it lives

Tenant-isolated, encrypted at rest, and minimised by default.

• Email bodies. Short-lived cache, purged nightly. Used to generate artifacts (summary, tag, draft) then discarded.
• Derived artifacts. Summaries, tags and drafts are retained per your retention setting (default 90 days).
• Memory & preferences. Retained for the life of the account; editable and deletable at any time.
• OAuth tokens. Encrypted at rest with AES-256-GCM. Purged within minutes of disconnect.
• Database. Postgres with row-level security; tenants cannot address each other's rows.

04 Subprocessors

Every party that touches your data, named.

• AWS (us-east-1 & eu-west-1). Compute, database, object storage.
• Anthropic. Large language model inference. Zero-day data retention configured; no training on our inputs.
• Linear & Sentry. Internal issue tracking and error reporting. No mailbox content is forwarded.

This list is canonical. If it changes we notify account owners by email before the change takes effect.

05 Your rights

Access, export, correct, or delete — without a support ticket.

• Export. Download every artifact we hold on you as a single JSON bundle. Available from Settings → Account.
• Delete. Wipe your account and all associated artifacts. Takes effect immediately; backups are rotated out within 30 days.
• Correct. Memory facts and writing samples are directly editable.
• Revoke. Disconnect your mailbox to stop new reads without deleting your account.

06 Data residency

US accounts run in us-east-1. EU accounts run in eu-west-1. Your data does not leave your region of origin except for model inference, which is pinned to the same region where available.

07 Breach notification

In the event of a confirmed security incident affecting your data, we notify account owners within 72 hours with a description of the scope, what we believe is affected, and the mitigation steps in progress. We do not wait for the 72-hour clock to run down if we can tell you sooner.

08 Changes

Material changes to this policy are announced by email to every account owner at least 14 days before they take effect. The effective date above always reflects the current version.