Privacy policy
This policy explains what personal data Staterica collects, why, and what control you have over it. It applies to the website at staterica.com and to the Staterica application at app.staterica.com.
1. Who we are
Staterica is a stakeholder governance platform operated from Muscat, Sultanate of Oman. Staterica is at an early stage and is not yet a registered company. When a legal entity is formed, this policy will be updated to name it as the party responsible for your data.
For any privacy question or request, write to [email protected].
2. What this policy covers
This policy covers personal data about:
- visitors to staterica.com;
- people who hold an account in the Staterica application (users);
- people whose details users record in the application, such as the contacts and officials within an organisation's stakeholders.
3. Data we collect
Website visitors
The website does not use analytics, advertising or tracking tools, and it has no forms. Our hosting provider processes technical data needed to deliver and protect the site, such as IP address, browser type and the time of the request.
Application users
- Account details: name and email address.
- Sign-in details: a securely hashed password if you set one, or the identity confirmed by Google if you sign in with Google. We never see your Google password.
- Workspace membership: the organisations you belong to, your role in each, and your permissions.
- Activity records: what you create or change, and when, including a record of who viewed contact details.
People recorded by users
Organisations use Staterica to record their stakeholders. This can include personal data about contacts, such as name, title, role, organisation, work email and phone number, the history of positions held, attendance at meetings, and notes about engagement. For each contact, the organisation records a lawful basis and a date to review whether the record is still needed.
4. How we use it
- To provide the application: sign-in, workspaces, permissions, reports and dashboards.
- To send service emails, such as sign-in links, invitations and password resets. We do not send marketing email.
- To keep the service secure, prevent misuse and investigate problems.
- To meet legal obligations.
We do not sell personal data, and we do not use it for advertising.
5. Customer data and our role
The information an organisation records in its workspace, including personal data about its contacts, belongs to that organisation. The organisation decides what to record and why, and is responsible for having a lawful basis to do so. Staterica processes that data on the organisation's behalf and only to provide the service.
If you are a contact recorded by an organisation and want to see, correct or remove your details, please contact that organisation. If you cannot identify or reach it, write to [email protected] and we will pass on your request.
6. Service providers
We use a small number of providers to run Staterica. Each processes personal data only to provide its service to us.
| Provider | What it does | Data involved |
|---|---|---|
| Supabase | Database and account sign-in | Account details and all workspace content |
| Cloudflare | Website and application hosting, network security | Technical request data |
| Brevo | Delivery of service emails | Email address and the email sent |
| Optional sign-in with a Google account | Name and email address, if you choose Google sign-in |
7. Where data is processed
Our providers operate internationally, so personal data may be stored or processed outside the Sultanate of Oman. Where that happens, we rely on the providers' contractual and security commitments to protect it.
8. How long we keep it
- Accounts: for as long as the account is active. When an account is deleted, its sign-in and profile data are deleted with it.
- Workspace content: for as long as the organisation keeps its workspace. When a workspace is deleted, its content is deleted with it.
- Contacts: each contact record carries a review date, set 24 months ahead by default, so the organisation can decide whether it is still needed.
- Technical logs: for the short periods set by our providers.
9. Security
Data is encrypted in transit. Access inside each workspace is limited by role, and the database enforces those limits for every request. Contact details can be restricted to authorised roles, and views of them are logged. No system is perfectly secure, and we will tell affected organisations promptly if a breach affects their data.
10. Your rights
Subject to applicable law, including the Personal Data Protection Law of the Sultanate of Oman (Royal Decree 6/2022), you can ask to:
- access the personal data we hold about you;
- correct data that is inaccurate;
- delete your data;
- object to or restrict how it is processed;
- withdraw consent, where we rely on consent.
Users can change their name and password in the application at any time. For any other request, write to [email protected]. We will reply within 30 days and may need to confirm your identity first.
12. Children
Staterica is a professional service for organisations. It is not intended for anyone under 18, and we do not knowingly collect their data.
13. Changes to this policy
We will update this policy when the service or the law changes, and when Staterica is registered as a company. The effective date at the top shows the latest version. Significant changes will be notified to users in the application or by email.
14. Contact
Staterica · Muscat, Sultanate of Oman
[email protected]