Privacy Policy

Last updated: May 19, 2026

This Privacy Policy explains how Straycy (“we”, “us”, “our”), operated by Digital Media Estonia OÜ, collects, uses, stores, and protects your personal data when you use our website (straycy.com) and our WordPress plugin (“Service”).

1. Data controller

The data controller responsible for your personal data is Digital Media Estonia OÜ, registry code 11697004, registered in Tallinn, Estonia. For any privacy-related inquiries, contact us at hi@straycy.com.

2. What data we collect

2.1 Account data

When you create a Straycy account, we collect your name, email address, company name, and website URL. This data is necessary to provide the Service.

2.2 Billing data

Payment processing is handled by Stripe. We do not store your credit card details. Stripe may collect billing information as described in their privacy policy.

2.3 Visitor tracking data (collected by the Straycy plugin on your website)

When the Straycy plugin is installed on your website, it collects the following data from your website visitors:

• UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content)
• Ad platform click identifiers (gclid, fbclid, msclkid)
• Referrer URL
• Landing page URL
• Device type and browser information
• Hashed IP address (SHA-256, never stored in raw form)
• A randomly generated visitor ID stored in a first-party cookie

2.4 Lead data

When a visitor submits a form on your website, Straycy captures the form submission data (name, email, phone if provided) alongside the attribution data listed above. This data is stored in your WordPress database and optionally synced to the Straycy dashboard.

2.5 Usage data

We collect basic usage analytics about how you interact with the Straycy dashboard, including pages viewed and features used, to improve the Service.

3. Legal basis for processing

We process personal data based on the following legal grounds under GDPR:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service you signed up for.
• Legitimate interest (Art. 6(1)(f)): Analytics to improve our Service, fraud prevention, and security.
• Consent (Art. 6(1)(a)): Where explicitly required, such as marketing communications.

4. How we use your data

• To provide, maintain, and improve the Straycy Service
• To process billing and manage your subscription
• To provide customer support
• To send essential service communications (account updates, security alerts)
• To send marketing communications (only with your consent, and you can unsubscribe anytime)
• To detect and prevent fraud or abuse

5. Data storage and retention

Your data is stored on servers within the European Union. We use industry-standard encryption and security measures to protect your data.

• Account data: Retained as long as your account is active, then deleted within 30 days of account closure.
• Visitor tracking data: Anonymous visitor sessions without a matching lead are automatically deleted after 30 days (configurable in plugin settings). Visitor records linked to leads are retained as long as the lead record exists.
• Lead data: Retained as long as your account is active. You can delete individual leads at any time from the dashboard.
• Billing data: Retained as required by Estonian tax law (7 years for financial records).

6. Data sharing

We do not sell, rent, or trade your personal data. We may share data with the following categories of service providers, all bound by data processing agreements:

• Stripe: Payment processing
• Vercel/Supabase: Hosting and database infrastructure (EU-based)
• Resend: Transactional email delivery

We may disclose data if required by law or to protect our rights, safety, or property.

7. Cookies

The Straycy plugin uses first-party cookies on your website to track visitor attribution. These cookies include:

• stry_visitor_id: A randomly generated identifier to link page visits to form submissions. Functional cookie.
• stry_attribution: Stores UTM parameters and referrer data for the current session. Functional cookie.

No third-party cookies are used. When a consent management tool (such as CookieYes, Complianz, or Cookiebot) is detected, Straycy respects the visitor’s consent preferences. Without consent, Straycy operates in cookieless mode, capturing only anonymous attribution data.

8. Your rights under GDPR

As a data subject, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your personal data.
• Right to restriction: Request restriction of processing in certain circumstances.
• Right to data portability: Request your data in a machine-readable format.
• Right to object: Object to processing based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at hi@straycy.com. We will respond within 30 days.

9. Data processing on behalf of our customers

When you install the Straycy plugin on your website, you are the data controller for your visitors’ data. Straycy acts as a data processor on your behalf. We process this data only according to your instructions and as necessary to provide the Service. A Data Processing Agreement (DPA) is available upon request.

10. International data transfers

Your data is processed and stored within the European Union. If any data transfer outside the EU is necessary, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission.

11. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS) and at rest, hashed IP addresses, access controls, and regular security reviews.

12. Children

Straycy is a B2B service and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. Your continued use of the Service after such changes constitutes acceptance of the updated policy.

14. Contact

For any privacy-related questions or requests, contact us at:

Digital Media Estonia OÜ
Registry code: 11697004
Email: hi@straycy.com

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) at www.aki.ee.