Privacy Policy

Struxel Dynamics, Inc. is an AI governance, compliance automation, and enterprise service delivery platform headquartered at:

800 N King Street, Suite 304-2688
Wilmington, DE 19801
United States

We serve enterprise clients, AI service contributors, coaches, reviewers, and professionals globally. For GDPR purposes, Struxel acts as both a Data Controller (for user account data) and a Data Processor (when processing data on behalf of enterprise clients).

Data Protection Contact: privacy@struxeldynamics.com

Account & Identity Data: Name, email address, phone number, professional credentials, LinkedIn profile, resume, role type (contributor, client, coach, reviewer), and account settings.

Professional & Work Data: Training progress, quiz scores, badge achievements, project assignments, work hours, reviewer/coach performance records, and certification history.

Payment & Billing Data: Billing address and subscription tier. Raw card data is never stored by Struxel — payment processing is handled exclusively by Stripe (PCI DSS Level 1).

Usage & Technical Data: IP address, browser type, device identifiers, pages visited, session duration, feature usage, and platform interactions collected via cookies and server logs.

Communications: Messages sent through our platform, support tickets, coaching session notes, and feedback submitted to our team.

Third-Party Integration Data: When you connect services like LinkedIn, GitHub, or Google, we access only the data you explicitly authorize. We do not store OAuth credentials — only the access token necessary to fulfill the requested feature.

We use your data only for the purposes described below and only to the extent necessary:

• Service Delivery: Provide, maintain, and improve our platform and match contributors with appropriate projects.
• Compliance & Governance: Generate audit-ready compliance reports and maintain records required by law.
• Payments: Process transactions, subscriptions, contributor payouts, and generate invoices.
• Communications: Send transactional notifications, platform updates, and security alerts. Marketing emails only with your consent.
• Safety & Fraud Prevention: Monitor for suspicious activity, enforce our Terms of Service, and protect users.
• Analytics: Understand aggregated usage patterns to improve the platform. We do not build individual behavioral profiles for advertising.

Legal Bases (GDPR): Contract performance, legitimate interests, legal obligation, and consent (for marketing and optional cookies).

We do not sell, rent, or trade your personal information. We share data only as follows:

• Sub-processors: Third-party vendors (AWS, Supabase, Stripe, Zoho, Google, Slack, GitHub) under contract with data processing agreements and security requirements. The full list is published in our Trust Center.
• Enterprise Clients: Contributor work data shared with enterprise clients only as necessary for project delivery and with your awareness.
• Legal Requirements: Disclosure to law enforcement or regulators when legally required, with notice to you where permitted.
• Business Transfer: In connection with a merger, acquisition, or asset sale, with advance notice to you.

Submit requests to: privacy@struxeldynamics.com. We fulfill requests within 30 days (GDPR) or 45 days (CCPA/CPRA).

We implement industry-standard and enterprise-grade security controls:

• AES-256 encryption at rest; TLS 1.3 for all data in transit
• Role-based access control (RBAC) with MFA enforced for internal accounts
• Annual third-party penetration testing and weekly automated vulnerability scans
• Immutable audit logs retained for 12 months
• SOC 2 Type II audited annually
• Incident response plan with 72-hour GDPR breach notification capability

Payment data is processed exclusively by Stripe (PCI DSS Level 1 certified). Struxel never stores raw card numbers.

We use cookies to make our platform work and to understand usage. Categories:

We do not use advertising or tracking cookies. Manage preferences via Cookie Settings in our Trust Center footer.

We retain personal data only as long as necessary for the purposes described or as required by law:

• Active accounts: Retained while your account is open and for 30 days after a deletion request.
• Financial records: 7 years (US tax and accounting requirements).
• Security logs: 12 months.
• Backup copies: Purged within 90 days of account deletion.

Struxel is based in the United States. If you access our platform from the EU, EEA, UK, or other jurisdictions, your data is transferred to and processed in the US.

We rely on the following transfer mechanisms:

• EU → US: EU Standard Contractual Clauses (SCCs) — Module 2 (Controller to Processor)
• UK → US: UK International Data Transfer Agreement (IDTA)
• Switzerland → US: Swiss SCCs

Our platform is intended for users 18 years of age and older. We do not knowingly collect personal information from children under 18. If we learn we have done so, we will delete it promptly.

We may update this Privacy Policy to reflect changes in our practices or applicable law. We will notify you of material changes via email and in-platform notification at least 30 days before the effective date. The "Last updated" date at the top reflects the most recent revision.