Privacy Policy

This Privacy Policy explains how Structera ("Structera", "we", "us", or "our") collects, uses, stores, and shares personal data when you visit structera.co.uk or use the Structera platform (the "Service"). It is written to comply with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the EU General Data Protection Regulation (Regulation (EU) 2016/679), and the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (collectively, the "CCPA").

If anything in this policy is unclear, please contact us at [email protected] before using the Service.

1. Who is the data controller?

For personal data we collect about visitors to our website and registered account holders, Structera is the data controller. For personal data that our business customers upload into the Service in the course of classifying their procurement spend (for example, supplier contact names embedded in transaction records), Structera acts as a data processor on behalf of that customer, who is the controller. The terms of that processing relationship are set out in our Terms of Service and any separate Data Processing Agreement you enter into with us.

Contact details for the controller:

• Trading name: Structera
• Privacy contact: [email protected]
• General contact: [email protected]

Structera is not currently registered as a UK limited company. If and when a registered legal entity is incorporated, that entity's registered office address and company number will be added here.

2. What personal data we collect

2.1 Data you provide directly

• Account data: email address and a hashed password (we never store passwords in plain text).
• Registration profile: your first name, surname and company name, which are required to create an account, plus your job title, country and telephone number if you choose to provide them. We use these to identify your account, address you correctly in correspondence, and answer support enquiries about the right organisation.
• Marketing preference: whether you have opted in to receive product updates and procurement tips. This is off unless you tick the box, and is separate from service emails such as password resets, which we send because you asked for them. You can withdraw consent at any time using the unsubscribe link in any marketing email or by emailing us.
• Company workspace data: company name, a free-text "nature of business" field, and the data mode you select (suppliers, materials, or services).
• Transaction data you upload: the rows in any CSV or XLSX file you upload for classification. These rows typically contain supplier names, transaction descriptions, amounts, and dates. Some of those fields may incidentally include personal data (for example, an individual contractor's name appearing in a supplier field). You are responsible for ensuring you have a lawful basis to upload such data — see Section 3.
• Payment data: when you purchase access to a paid feature, we receive a record of the payment from our payment processor, Stripe (see Section 5). We do not see or store your card number, CVC, or full bank details.
• Support and correspondence: emails or messages you send to us, including their content and any metadata.

2.2 Data we collect automatically

• Authentication tokens: a JSON Web Token (JWT) stored in your browser's localStorage after you sign in, so you don't have to re-enter your password on every page. It is not a cookie and is not transmitted to third parties.
• Server logs: standard request logs (IP address, user-agent, timestamp, path, status code) generated by our hosting provider for security, abuse prevention, and debugging.
• Cookies: only those described in our Cookie Policy. Where consent is required under UK PECR or EU ePrivacy law, we ask for it via the cookie consent banner on first visit.

2.3 Data we do NOT collect

• We do not knowingly collect data from anyone under 18.
• We do not run third-party advertising trackers.
• We do not sell, rent, or trade your personal data to any third party. This applies regardless of whether the CCPA considers it a "sale" or a "share" for cross-context behavioural advertising.

3. Lawful bases for processing (UK / EU GDPR)

We rely on the following lawful bases under Article 6 of the UK / EU GDPR:

• Contract (Art. 6(1)(b)): to create your account, run classifications, take payment, and deliver the Service.
• Legitimate interests (Art. 6(1)(f)): to keep the Service secure (rate-limiting, abuse detection, fraud prevention), to debug, and to improve the product. We balance these interests against your rights and have determined the processing is proportionate.
• Legal obligation (Art. 6(1)(c)): to retain financial records, respond to lawful requests from authorities, and meet tax obligations.
• Consent (Art. 6(1)(a)): for non-essential cookies and any optional marketing communications. You can withdraw consent at any time via the cookie banner or by emailing us.

When you upload transaction data that contains personal data about third parties (for example, your suppliers), you must have your own lawful basis to share that data with us. We process it strictly on your instructions as your processor.

4. How we use your personal data

• To provide, operate, and maintain the Service.
• To run AI-powered taxonomy generation and classification over the transaction data you upload, using the sub-processors listed in Section 5.
• To process payments and issue receipts.
• To communicate with you about your account, service updates, and security notices.
• To detect, prevent, and address technical issues or abuse.
• To comply with legal obligations.

5. Sub-processors and third parties

We engage a small set of trusted sub-processors to operate the Service. Each is contractually bound to process data only on our documented instructions and to maintain appropriate technical and organisational measures.

We will give reasonable advance notice (via the website or email) of any new sub-processor before they begin processing personal data, and you will have a chance to object before that engagement starts.

6. International data transfers

Some of our sub-processors are located in the United States. When personal data is transferred outside the UK or the European Economic Area, we rely on the UK International Data Transfer Addendum (UK IDTA) to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses (Commission Decision 2021/914), and any equivalent mechanism the UK or EU recognises (for example, adequacy decisions for the Data Privacy Framework where the recipient is certified).

A copy of the relevant transfer mechanism is available on request at [email protected].

7. How long we keep your data

• Account data: for as long as your account is active, then deleted within 30 days of account closure unless we have a legal obligation to retain it longer (e.g. accounting records).
• Transaction data you upload: retained while the associated company workspace exists. Deleting a company workspace deletes all of its transactions, taxonomies, and classifications.
• Financial records: retained for the period required by UK tax law (currently 6 years from the end of the accounting period).
• Server logs: typically retained for up to 30 days for security and debugging, then deleted or anonymised.

8. Your rights

8.1 Under UK GDPR and EU GDPR

You have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate or incomplete data (Art. 16).
• Erase your data, subject to certain exceptions (Art. 17).
• Restrict processing in some circumstances (Art. 18).
• Data portability — receive your data in a structured, machine-readable format (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Withdraw consent at any time where we rely on consent (Art. 7(3)).
• Lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ICO, ico.org.uk); in the EU, your local Data Protection Authority.

8.2 Under California law (CCPA / CPRA)

California residents have the right to:

• Know what personal information we collect and how we use it.
• Access the personal information we hold about you.
• Request deletion of personal information.
• Correct inaccurate personal information.
• Opt out of any "sale" or "sharing" of personal information — we do not engage in either, but you may exercise this right at any time.
• Non-discrimination for exercising your rights.

To exercise any of these rights, email [email protected]. We will respond within the timeframes set by the applicable law (one month under UK / EU GDPR; 45 days under CCPA, extendable once).

9. Security

We use industry-standard technical and organisational measures to protect personal data, including: TLS encryption in transit, bcrypt password hashing, JSON Web Token authentication with short-lived sessions and idle timeout, role-based access controls, and per-user company workspace isolation. No method of transmission or storage is 100% secure; we will notify affected users and the relevant supervisory authorities of any personal data breach within the timeframes required by law.

9.1 Staff access to your data

Our staff cannot view the contents of your uploaded data or your classified results. There is no function in our internal tooling that displays or downloads another account's transactions, supplier names, item descriptions, amounts or category assignments.

To support you when something goes wrong, staff with an administrator role can see:

• Account records — the registration details above (name, company, email, and any job title, country or phone number you supplied), when you registered, when you were last active, how many workspaces you have created, and your billing history.
• Aggregate quality metrics for a workspace — row counts, the percentage of rows successfully classified, confidence averages, how many categories were produced, and whether your upload contained an amount column. These are counts and percentages only. They do not include any of your data.

Administrators can also take two actions on your behalf, both of which are recorded in our access logs:

• Re-run a classification on your workspace — for example when a run failed part-way through. This does not charge you and does not reveal your data to us.
• Send your export to you by email — if you cannot retrieve it yourself. The file is sent only to the email address registered on the account that owns the workspace. It is never sent to a member of staff and is never displayed to them.

Our hosting and database providers, listed as sub-processors in section 5, necessarily have technical access to the systems your data is stored on. That access is governed by their own security controls and our contracts with them.

10. Children

The Service is not intended for and not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The "Last updated" date at the top of the page will always show when the policy was last revised. Where the change is material, we will notify registered account holders by email.

12. Contact

Questions, complaints, or requests about your personal data should be sent to [email protected].