Privacy Policy

1. Who we are and what this covers

Stravo LLC ("Stravo," "we," or "us") operates stravolabs.com. This business-to-business website is intended for professional and organizational inquiries. This policy explains how we handle personal information from website visitors, business contacts, and people who contact us. A business email address or professional role does not remove applicable privacy protections. Our address is 400 N. Tampa St., Suite 1550, Tampa, FL 33602. Contact info@stravolabs.com with privacy questions or requests.

Stravo’s own business information. We determine how to handle website inquiries, business contact details, account administration, billing contacts, and similar relationship records for our own business purposes, subject to this policy and applicable law. This is distinct from information a client entrusts to us to perform its services.

Client-controlled information. When we process personal information on a client’s behalf as its service provider or processor, the applicable customer agreement, data processing agreement, lawful documented instructions, and applicable law govern that processing. This website policy does not independently authorize us to reuse client-controlled information for advertising, model training, or other unrelated purposes. Collection, permitted uses, access, security responsibilities, subprocessors, retention, return or deletion, and any regulated-data requirements must be addressed in the engagement documents. Those documents control in a conflict, subject to applicable law.

Requests about client data. Contact the relevant client organization to exercise rights concerning information it controls. If we receive such a request, we will direct it to the client or assist as required by the agreement and applicable law; we will not independently change or delete client-controlled records contrary to lawful instructions. A separate notice will describe any different practices for an operational client portal or other service.

2. Information we collect and why

The following describes categories collected through this website and related business inquiries during the preceding 12 months, or since launch if shorter. We collect only the information relevant to the interaction. These categories also serve as our notice at collection.

Please do not send health records, payment account details, government identifiers, passwords, biometric data, or other sensitive or confidential information through this website. We do not request these categories for website inquiries. If an engagement requires sensitive information, a separate agreement and appropriate collection method must be established first. We do not use website inquiry information to make automated decisions producing legal or similarly significant effects.

3. How we use and disclose information

• Respond to inquiries, assess opportunities, and provide requested information or agreed services.
• Operate, maintain, troubleshoot, and protect the website and business communications.
• Understand website use and improve content, subject to the choices described in this policy.
• Send requested business updates or marketing communications where permitted. You can unsubscribe or email us to stop marketing.
• Meet legal obligations, resolve disputes, prevent misuse, and protect legal rights.

We disclose the categories above to providers and personnel as needed for those purposes. Engineering work may involve our affiliate team in Vietnam and project partners. Access to client-controlled information depends on the engagement, the client’s authorization, applicable contractual restrictions, and law. Working with Stravo does not automatically mean client data will be accessible from Vietnam or by every affiliate or partner. We also may disclose relevant information to professional advisers, authorities when legally required, or parties to a proposed or completed corporate transaction, subject to applicable protections. A business inquiry does not authorize unrelated advertising uses of its contents.

We do not sell personal information for money. The current website does not use advertising or retargeting pixels, and we do not disclose website personal information for cross-context behavioral advertising. We do not knowingly sell or share personal information of anyone under 16. We will update this notice and provide legally required choices before introducing a materially different use or disclosure.

4. Cookies, analytics, and third-party services

Necessary technology. Hosting, security, and delivery services process technical request information. We store your cookie choices in browser local storage. These functions are distinct from optional analytics and marketing tags.

Cloudflare. Cloudflare hosts and protects the website and provides performance monitoring. Its Web Analytics beacon measures page use and load performance without using cookies or tracking individuals across customers’ websites. Technical information also passes through Cloudflare to deliver and protect the site. See Cloudflare’s privacy policy.

Google services. The site loads fonts from Google, which receives the technical information needed to serve those requests. We are preparing to use Google Analytics 4 to measure visits, traffic sources, and interactions. Its deployment is pending as of this policy’s update date. When enabled, optional Google Analytics tags and cookies will load only after you allow Analytics in Cookie Preferences. They will not receive inquiry message contents or contact fields. See how Google uses information from sites that use its services and the Google Analytics opt-out tool.

Your choices. Use Cookie Preferences to allow or reject optional categories, or change a previous choice. Marketing tags are not currently enabled. Rejecting optional tags does not prevent you from reading the site or contacting us. Browser settings can also clear cookies and local storage. Choices apply to that browser and may need to be repeated after clearing storage or using another device.

Global Privacy Control and Do Not Track. We recognize Global Privacy Control (GPC) as an opt-out of sale, sharing, and targeted advertising for that browser, and keep optional marketing tags off when it is detected. We do not separately respond to legacy Do Not Track (DNT) signals. GPC and DNT are different signals. Providers that serve website resources receive technical request data; optional analytics providers receive permitted usage data when enabled. We do not authorize advertising partners to track you across websites through the current site.

5. Retention and international processing

We retain each category only for as long as reasonably needed for its stated purposes and applicable legal requirements. For contact details, business information, and correspondence, the criteria include whether an inquiry remains active, whether an engagement follows, recordkeeping duties, and dispute or legal hold requirements. For device and usage records, the criteria include security and troubleshooting needs, the analytics configuration, and your browser choices. Cookie preferences remain in your browser until changed or cleared. We delete, de-identify, or otherwise dispose of information when it is no longer needed, subject to lawful retention obligations.

Stravo is based in the United States. Personnel, affiliates, and providers may process information in the United States, Vietnam, and other countries where they operate. Their privacy laws may differ from those where you live. Where applicable law requires a transfer mechanism or other protection, it must be addressed for the relevant transfer. For client-controlled information, approved processing locations, affiliate and subprocessor access, international-transfer arrangements, and retention or return and deletion requirements are determined by the engagement documents and applicable law. This policy is not a substitute for a client data processing agreement, and updates to it do not amend an existing customer agreement.

6. Privacy requests and U.S. state rights

Depending on your state, the law’s applicability, and the information involved, you may have rights to confirm processing, access or obtain a portable copy of your information, correct inaccuracies, delete information, and opt out of sale, targeted advertising, or certain profiling. These rights have exceptions. No provision of this policy limits rights that applicable law gives you.

Email info@stravolabs.com with the subject “Privacy request,” or write to Stravo LLC, Attn: Privacy, at the address above. Include the request, your state of residence, and enough contact information to locate relevant records. Do not send sensitive identity documents unless we request a secure verification method. We may verify your identity and authority before providing, changing, or deleting records, using information proportionate to the request. You do not need an account. Authorized agents may submit requests with appropriate evidence of authority; additional verification may be required where permitted.

We respond within the deadlines applicable to the request, explain any legally permitted extension, and explain a denial where required. If your state provides an appeal right, reply to our response or email us with “Privacy appeal.” You may also contact your state attorney general or privacy regulator. We do not unlawfully discriminate or retaliate because you exercise a privacy right. Opt-out preference signals do not require identity verification.

7. Additional California disclosures

Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), applies, California residents may request the categories and specific pieces of personal information collected, sources, purposes, and categories of recipients; deletion; correction; and access in a portable format. They may opt out of sale or sharing and limit certain uses or disclosures of sensitive personal information. Applicable exceptions and verification requirements apply. We do not use or disclose sensitive personal information for purposes that require a right to limit under the CCPA.

The category table above describes the website information collected and disclosed for business purposes in the applicable 12-month period. We have not sold or shared that website information for cross-context behavioral advertising during that period. We do not offer financial incentives in exchange for website personal information. CCPA coverage depends on statutory criteria; this notice does not represent that every CCPA provision applies to Stravo.

To exercise applicable California rights, use the request methods above. Where the CCPA applies, we acknowledge requests to know, correct, or delete within 10 business days and generally respond within 45 calendar days, with a permitted extension and notice when necessary. Opt-outs are handled as soon as feasible within applicable deadlines. You can use Your Privacy Choices and GPC without creating an account. For California “Shine the Light” requests concerning disclosures for another company’s direct marketing, email us with “California privacy request.” We do not disclose website personal information to third parties for their own direct marketing.

8. New York residents and security

This policy applies to New York visitors as well as other U.S. visitors. We handle personal information subject to applicable security and breach-notification obligations, including New York’s SHIELD Act where it applies. Required security safeguards and incident notifications are operational responsibilities, not a certification created by this policy. We will provide notices to affected people and authorities when required by applicable law.

We use safeguards appropriate to the information and risks involved. Website traffic is encrypted in transit using HTTPS. No website or transmission method is completely secure. If you believe information sent to Stravo has been compromised, email info@stravolabs.com. Nothing here restricts complaints to the New York Attorney General or another regulator.

9. Children and teenagers

This business website is intended for adults and is not directed to children or teenagers. We do not knowingly collect personal information from children under 13 or knowingly use visitors’ information in violation of applicable protections for minors. If you believe a child provided information, contact us so we can review and delete it as required. No one under 18 should submit an inquiry on behalf of a business.

10. Changes and contact

We post revisions here with a new last-updated date. For material changes, we provide additional notice and obtain consent when applicable law requires it. A revised policy does not itself authorize an incompatible use of previously collected information. Florida law governs this policy to the extent permitted by law, without its conflict-of-laws rules. Federal law and nonwaivable rights under applicable state law, including California and New York law, remain effective. Where validly agreed, the dispute procedures in our Website Terms and Conditions apply; this policy alone does not create an agreement to arbitrate or waive statutory privacy rights. Contact info@stravolabs.com or Stravo LLC, Attn: Privacy, 400 N. Tampa St., Suite 1550, Tampa, FL 33602.