Skip to content
Strent
Pricing Docs

Privacy Policy

Last updated:

This policy explains how Strent handles personal data about the people who use it: visitors to strent.dev and docs.strent.dev, people with a Strent account, and people who write to us.

Who is responsible

The controller of your personal data is Juan Manuel Copia Mateu (NIF 60555481T), who runs Strent as an individual, at Calle Mezquite 2, 28045 Madrid, Spain. Write to legal@strent.dev about anything in this policy.

Data about your customers

When you connect a Stripe account to a Strent project, Strent processes data about your own customers on your behalf. For that data you are the controller and Strent is your processor under the Data Processing Agreement, which describes what Strent stores and for how long. Your own privacy policy covers it. If one of your customers asks us about their data, we pass the request on to you.

What we collect and why

Account data

What
Your email address, the name, profile image, or connected sign-in account you add, your sign-in credentials, and the IP address and browser of each session, held by Clerk. Strent's own database stores your account's user ID and links your projects to it. Each day it also counts your live projects' paying customers and keeps the latest count, the date your account first went over the Free plan's limit, and since when it has been over each plan's limit.
Why
To create your account, sign you in, keep your account secure, and apply your plan's limit on paying customers.
Legal basis
Performance of our contract with you, the Terms of Service (GDPR article 6(1)(b)). You need an email address to create an account.
Recipients
Clerk, Inc. and Render Services, Inc., both in the United States.
Kept
Until your account is deleted.

Project configuration

What
Your projects' names and environment labels, the Stripe account each one connects, its Stripe credentials (encrypted), and its Strent API keys (stored only as hashes). Records of actions the Strent operator takes on your projects, such as refreshing a customer, with the reason given.
Why
To provide Strent and to support you.
Legal basis
Performance of our contract with you (GDPR article 6(1)(b)).
Recipients
Render Services, Inc., in the United States.
Kept
Until you delete the project in Admin, or your account is deleted. Records of operator actions on a whole project, such as deleting it, stay after the project is deleted so we can account for them; they keep the project's ID but no longer link to your account.

Platform billing records

What
When you open billing to start a paid plan or manage a payment method, Strent creates a customer for your account in Strent's Stripe account, carrying your account's user ID. Stripe then holds the details you enter at checkout or in the billing portal, such as your name, email address, billing address, and payment method. Strent keeps that Stripe customer's ID, a copy of its subscriptions, and the Stripe events about it. While Strent is free, Admin offers no billing pages.
Why
To charge for paid plans and to decide which plan your account has.
Legal basis
Performance of our contract with you (GDPR article 6(1)(b)).
Recipients
Stripe Payments Europe, Limited, in Ireland, which may transfer data to Stripe, LLC in the United States. Stripe also uses some of this data as an independent controller, for example to prevent fraud, under its own privacy policy. Strent's copy is held by Render Services, Inc., in the United States.
Kept
Until your account is deleted, when we delete the Stripe customer and Strent's copy of it. Stripe events about that customer expire 30 days after Strent received them. Stripe keeps the records it must keep under its own legal obligations.

Server logs

What
For each request to strent.dev, docs.strent.dev, Admin, and Strent's APIs, Render, which hosts them, receives your IP address, the request method, host, and path, which can include project and Stripe customer IDs, and your browser's user agent, to deliver it. Strent's APIs log each request's method and URL, response status and time, user agent, and request ID, without your IP address. To limit request rates, the API also holds IP addresses in memory, never on disk.
Why
To run Strent, find and fix errors, and protect it against abuse and attacks.
Legal basis
Our legitimate interest in keeping Strent secure and working (GDPR article 6(1)(f)).
Recipients
Render Services, Inc., in the United States.
Kept
Up to 7 days, the period Render keeps Strent's logs.

Correspondence

What
The email address, name, and message you send to a strent.dev address, such as legal@strent.dev or feedback@strent.dev, and our replies.
Why
To answer you and to keep a record of what was asked and done.
Legal basis
Our legitimate interest in answering you and in being able to show how we handled a request (GDPR article 6(1)(f)), and, for requests about your data, our legal obligation to answer them (GDPR article 6(1)(c)).
Recipients
Porkbun LLC, in the United States, which receives email sent to strent.dev addresses and forwards it to our mailbox, hosted by Google LLC in the United States.
Kept
Until the matter is closed, and then for up to five years, the general limitation period for contract claims in Spain.

Transfers outside the European Economic Area

The recipients above in the United States receive your data under these safeguards: Render, Clerk, Google LLC, and Stripe, LLC are certified under the EU-U.S. Data Privacy Framework, which the European Commission has found adequate, and Clerk's and Render's data processing agreements add the Standard Contractual Clauses if the framework stops applying. Porkbun's data processing agreement includes the Standard Contractual Clauses.

Cookies and browser storage

Strent uses only the cookies and browser storage needed for what you ask it to do. There are no analytics, advertising, or tracking cookies or scripts.

Deleted data

When we delete data, copies remain in database backups and in server logs for up to 7 days, and then expire.

Your rights

You can ask us for access to your personal data, and to rectify, erase, or restrict it. You can object to processing based on our legitimate interests, and ask for the data you gave us in a portable format. Strent makes no automated decisions about you.

Send requests, including requests to delete your account, by email to legal@strent.dev. We respond without undue delay and within one month of receipt. Where necessary because of the complexity or number of requests, we may extend that period by up to two further months, and we will tell you about any extension and its reasons within the first month. To protect your account, we may ask you to write from your account's email address.

You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es).

Changes

When this policy changes, we update the date at the top, and we inform you in advance where data protection law requires it.