Privacy Policy

This Policy explains how Strum collects, uses, stores and protects personal data of users of the investment, capital, budgeting, goals and analytics service.

Service operator

FOP Yutysh Oleksandr

7B Levka Lukyanenka Street, Apt. 11, Kyiv, 04212, Ukraine

Privacy contact: strum.yuinvest@gmail.com

1. Who is responsible for data processing

FOP Yutysh Oleksandr operates Strum and acts as the controller of personal data under this Policy.

Registered address: 7B Levka Lukyanenka Street, Apt. 11, Kyiv, 04212, Ukraine. For privacy requests or data deletion, contact strum.yuinvest@gmail.com.

2. Data we process

• Account data: email, name and other profile details provided by the user.
• Authentication and security data: sessions, technical tokens, login events and bot-protection checks.
• Financial and portfolio data entered or imported by the user: assets, transactions, goals, budgets, notes, broker reports and related calculations.
• Payment data needed for subscriptions or refunds. Payments are processed by WayForPay; Strum does not store full payment card details.
• Technical data: IP address, device type, browser, language, pages, error events and service logs.
• Support communications: messages, requests, replies and other information voluntarily provided by the user.

3. Cookies, analytics and marketing tags

Strum uses necessary technical storage for site operation, authentication, security and remembering the user cookie choice.

Google Tag Manager, Google Analytics, Microsoft Clarity and Meta Pixel load only after the user grants consent in the cookie banner. If consent is rejected, these tags do not load and known analytics cookies are cleared where technically possible.

• Google Analytics through Google Tag Manager helps measure page views, traffic sources, basic conversion events and technical visit parameters.
• Microsoft Clarity may be used to diagnose site interactions, clicks, scrolling, UX issues and de-identified session insights.
• Meta Pixel may be used to measure ad performance, registration or navigation events, and to build Meta audiences where the user has consented.
• Known cookies from these tools may include _ga, _ga_*, _gid, _fbp, _fbc, _clck and _clsk.
• Consent is stored in the browser localStorage as strum_tracking_consent_v1. The user can change the choice through the Cookies button on the site or by clearing browser data.

4. Why we use data

• To provide Strum, synchronize data and calculate portfolio, budgeting, goal and analytics views.
• To manage accounts, subscriptions, payments, trial periods and user support.
• To maintain security, prevent abuse, fix errors and keep the service stable.
• To improve product quality, UX, speed, content and marketing campaigns based on aggregated or de-identified data.
• To comply with legal, accounting, tax and regulatory obligations.

5. Legal bases

We process data to perform the agreement with the user, comply with legal obligations, protect Strum legitimate interests and rely on consent for optional analytics or marketing tags.

6. Who may receive data

We use providers needed to operate the service, including Supabase for database and authentication, WayForPay for payments, Google, Microsoft Clarity and Meta for analytics or marketing after consent, and hosting, communication and support tools.

We do not sell users personal financial data. Data is shared with third parties only to operate the service, comply with law, protect rights or with user consent.

7. Storage, security and retention

Data is stored as long as needed to provide the service, comply with legal obligations, resolve disputes, maintain security and keep accounting records. The user can delete the account through the deletion button in the service or contact us about specific data.

After deletion starts, Supabase removes the email from the user auth record, and Strum account data is anonymized. Some records can remain in the production database for a limited period until full deletion by a scheduled cron job, and in backups until the backup retention period ends.

We apply technical and organizational security measures, but no internet service can guarantee absolute protection against every risk.

8. User rights

• Access personal data.
• Correct inaccurate or incomplete data.
• Request deletion or restriction of processing.
• Withdraw consent for optional cookies and marketing tags.
• Export data where technically possible.
• File a complaint with a competent data protection authority.

9. Changes to this Policy

We may update this Policy when the service, law, providers or data processing practices change. The current version is always available on this page.