Privacy Policy

1. Introduction

Sturdy, Inc. ("the Company," "we," "us," or "our") operates the website getsturdyai.org (the "Site") and provides an AI-powered customer-health intelligence service that reads support tickets, email threads, and call notes to surface churn-risk signals for customer success teams. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

We are based at 111 Southwest Fifth Avenue, Suite 2200, Portland, OR 97204, United States and can be reached at [email protected].

2. Two Distinct Data Contexts

Sturdy operates in two distinct data contexts, and it matters which one applies to any given piece of personal information.

2.1 Site-Visitor Data (Sturdy as Controller)

When you visit getsturdyai.org, request early access, or send us a message, we act as the data controller for the information you provide or that we collect automatically. This policy describes how we handle that information.

2.2 Customer-Trace Data (Sturdy as Processor)

When a customer connects Sturdy to their Zendesk, Gong, or other platform under a service agreement, we ingest support tickets, email threads, and call notes that those systems contain. This ingested material is customer data. Sturdy acts as a data processor or service provider in that context; the customer is the data controller and is solely responsible for maintaining a lawful basis for processing and for providing appropriate notice to their own end-users.

Sturdy's service agreement with each customer governs the processing of customer-trace data. The sections below describe site-visitor data only unless otherwise noted.

3. Information We Collect

3.1 Information You Provide

We collect information you submit directly through the Site, including:

• Contact details (name, work email, phone) when you fill out the early-access or contact form;
• Company information you choose to share (employer, role, team size, context);
• The content of any messages you send us.

3.2 Information Collected Automatically

When you visit getsturdyai.org, we automatically collect limited technical information:

• IP address and approximate location (city or region level);
• Browser type, operating system, device class;
• Pages visited, referring URLs, time on page;
• Cookie and similar identifiers (see our Cookie Policy).

3.3 We Do Not Knowingly Collect Children's Data

getsturdyai.org is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

4. How We Use Information

We use site-visitor information to:

• Respond to early-access requests and provide requested information about Sturdy's product;
• Operate, maintain, and improve the Site;
• Send service updates and, where consent is required, product communications;
• Detect, investigate, and prevent fraud or abuse;
• Comply with legal obligations.

We do not use customer-trace data (tickets, email threads, call notes ingested from customer systems) for any purpose other than providing the contracted service to that customer. We do not use ingested customer communications to train machine-learning models without the customer's explicit written consent.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see your state's section below.

5. Sharing of Information

We share personal information only with:

• Sub-processors acting on our behalf (for example, cloud hosting, email delivery, analytics) under contractual data-processing terms that restrict their use;
• Authorities, when required by law or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties. Where customer-trace data is disclosed to a sub-processor (for example, to a cloud storage provider hosting ingested tickets), that sub-processor is bound by the same use restrictions as the Company.

6. Cookies and Tracking

We use cookies and similar technologies to operate the Site, remember preferences, and measure usage. For details and choices, see our Cookie Policy.

7. Data Retention

We retain site-visitor information only as long as needed for the purposes described in this Policy, to comply with legal or accounting obligations, and to resolve disputes. Inactive early-access or marketing-list contacts are purged after 24 months. Server access logs are retained 90 days, then aggregated.

Customer-trace data is retained only for the duration of the service agreement. Upon termination, ingested customer data is deleted or returned in accordance with the service agreement within the period specified therein.

8. Security and Your Rights

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS) and at rest, restricted-access data stores, and least-privilege access controls. No system is perfectly secure; we cannot guarantee absolute security and we encourage you to contact us promptly at [email protected] if you become aware of any security concern.

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law. State-specific rights are detailed in the sections below.

9. Oregon Residents (OCPA)

Oregon's Consumer Privacy Act took effect July 1, 2024. Because the Company is based in Portland and serves customers throughout Oregon, we take the following rights seriously.

Under the Oregon Consumer Privacy Act ("OCPA"), Oregon residents have the following rights.

9.1 Your OCPA Rights

• Right to Confirm and Obtain a List: confirm whether we process your personal data and obtain a list of specific third parties to whom we have disclosed personal data.
• Right to Access: obtain a copy of your personal data.
• Right to Correct, Delete, and Portability: correct inaccuracies, delete, and obtain a portable copy where technically feasible.
• Right to Opt Out: opt out of targeted advertising, sale, and significant-effect profiling.

9.2 Universal Opt-Out

We honor opt-out preference signals (for example, the Global Privacy Control) as a request to opt out of sale and targeted advertising.

9.3 How to Exercise

Email [email protected]. We respond within 45 days, with one 45-day extension available with notice.

9.4 Appeal

You may appeal a denial by replying to our response. Unresolved appeals may be referred to the Oregon Department of Justice.

California Visitors

If you are a California resident, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. We do not sell personal information and do not "share" personal information for cross-context behavioral advertising.

To submit a CCPA / CPRA request, email [email protected] with the subject line "California Privacy Request."

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Site.

11. Contact

Questions, requests, or complaints can be sent to: