Privacy Policy

This Privacy Policy explains how StratNovo ("we", "us") collects, uses, and shares personal information when you use ValidTeam (the "Service"), our project and issue management platform available at rumiamanage.com.

We designed the Service for teams, so most content you create is shared with your workspace. This policy covers the Service itself; it does not cover third-party sites we link to.

Information we collect

We collect information you give us directly, information generated as you use the Service, and limited technical information about how you use it.

Account information: your name, email address, avatar, job title, and organization membership. If you sign in with Google or GitHub, we receive the profile identifier and email address from that provider.
Content you create: issues, comments, documents, project plans, files you upload, and any other content you put in a workspace.
Collaboration data: real-time document edits are stored so your team can work together, and audio/video sessions while you are in a call.
Usage and device information: IP address, browser and device type, pages viewed, and error logs. We use this to operate, secure, and improve the Service.

How we use information

We use personal information to:

Provide and operate the Service, including authentication, storage, and real-time collaboration.
Send transactional email such as verification, password reset, and notifications. We do not send marketing email unless you opt in.
Provide support and respond to your requests.
Detect, prevent, and investigate abuse, fraud, and security incidents.
Improve the Service, including by analyzing aggregate usage patterns.

How we share information

We do not sell personal information. We share it only as described below.

With your workspace: other members of your organization can see the content you create in that workspace.
With service providers who process data on our behalf, under contract and only as needed to run the Service. These include Amazon Web Services (hosting and storage), Cloudflare (content delivery and file storage), Google Cloud Platform (database), LiveKit (real-time audio and video), and our email delivery provider. Our current sub-processor list is published in our Trust Center.
With an AI provider, only if your organization enables AI features and you submit content for processing. In that case the relevant provider processes the prompt and content under its own terms. We do not send your content for AI training.
With law enforcement or regulators when we are legally required to do so.
In connection with a merger, acquisition, or sale of assets, with notice to affected users.

Data retention

We retain personal information for as long as your account is active and as needed to provide the Service. When you delete content, we remove it from active use and delete it from backups within a reasonable period, normally within 90 days.

When you close your account we delete your personal information, except where we must retain it to comply with law or resolve disputes.

Data security

We encrypt data in transit with TLS and at rest with industry-standard encryption. Access to customer data is limited to staff who need it to operate the Service and is governed by confidentiality obligations.

No system is completely secure. If a breach affects your personal information we will notify you and any regulator as required by law.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or export your personal information, and to object to certain processing.

Access and export: request a copy of your data, commonly as a machine-readable export.
Correction: ask us to fix inaccurate information.
Deletion: ask us to delete your account and its contents.
Objection and restriction: ask us to stop, or limit, certain processing.
Complaints: you may lodge a complaint with your local data protection authority.

International transfers

We run infrastructure in several countries. Your information may therefore be processed outside your country of residence. Where required, we use standard contractual clauses or an equivalent safeguard for these transfers.

Cookies and analytics

We use cookies and similar technologies that are necessary to keep you signed in and to remember preferences. We also use privacy-respecting, aggregate analytics to understand which features are used. You can control non-essential cookies through your browser.

Children

The Service is not intended for anyone under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact privacy@rumiamanage.com and we will delete it.

Changes to this policy

We may update this policy as the Service changes. If a change is material we will notify you by email or in the Service before it takes effect. We will also update the "last reviewed" date above.

Contact us

Questions about this policy or our handling of your information can be sent to privacy@rumiamanage.com. Security reports can be sent to security@rumiamanage.com.