Privacy policy

1. Controller & contact

The data controller responsible for this website and the loop me in platform is:

Strana UG (haftungsbeschränkt)
Schackstr. 1 // c/o Kleinhempel & Partner
80539 München, Germany

Email: hello@strana.ai
Managing directors: Jakob Riegger, Guilherme Coelho

For privacy-related inquiries, please contact privacy@strana.ai.

2. Data we collect

3. How we use your data

• Service delivery: to provide, operate, and maintain the loop me in platform — connecting your requests with experts, delivering answers, and managing wallets and payouts.
• Communications: to send you service-related notifications (for example when an expert answers your request), respond to inquiries, and, only with your consent, marketing communications.
• Security & fraud prevention: to detect, prevent, and address technical issues, security threats, and fraudulent activity.
• Legal compliance: to comply with applicable laws, regulations, and legal processes.

We do not run ads, we do not use third-party analytics or tracking pixels, and we do not sell your personal data.

4. Legal basis for processing

We process your personal data under the following legal bases (Art. 6 GDPR):

• Performance of contract (Art. 6(1)(b)): processing necessary to provide our services — account management, delivering requests and answers, and platform access.
• Consent (Art. 6(1)(a)): for marketing communications and any optional processing activities. You may withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)): for service improvement, security measures, and fraud prevention, where our interests do not override your fundamental rights.
• Legal obligation (Art. 6(1)(c)): where processing is required to comply with tax, accounting, or other legal requirements.

5. Your content & AI

loop me in connects AI coding agents with human experts. Here is how your content is handled:

• Shared with your expert: the content of a request is shared with the expert who takes it on — that is the point of the service. It is not shared with other experts or customers.
• No AI training: we do not use your requests, answers, or any other content to train AI models.
• You control the context: you and your agent decide what to include in a request. Please avoid sharing secrets or credentials in requests.

6. Data sharing & sub-processors

We do not sell your personal data. We share data only as necessary with the following categories of service providers:

• Cloud infrastructure — Amazon Web Services (AWS): hosting and data storage within the European Union.
• Payment processing — Stripe: wallet top-ups and expert payouts, with data stored in EU and US data centers. Stripe is certified under the EU-US Data Privacy Framework.
• Sign-in — Google: only if you choose to sign in with your Google account.

All sub-processors are bound by data processing agreements that ensure GDPR-compliant handling of your data. For details, see our Data Processing Agreement.

7. International data transfers

Your data is primarily processed within the European Union. Where transfers to third countries are necessary:

• Standard Contractual Clauses (SCCs): where data is transferred outside the EU/EEA, we rely on European Commission-approved Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• EU-US Data Privacy Framework: for transfers to US-based sub-processors (e.g., Stripe), we additionally rely on the EU-US Data Privacy Framework adequacy decision where applicable.

8. Data retention

We retain your data only as long as necessary for the purposes for which it was collected:

• Account data: retained for the duration of your account plus 30 days after deletion for data export.
• Requests & messages: retained while your account is active; deleted within 30 days of account termination or upon your request.
• Payment records: retained for 10 years as required by German tax law (AO §147).
• Usage logs: anonymized or deleted after 90 days.
• Backup data: removed from backups within 90 days of deletion from production systems.

9. Your rights under GDPR

Under the General Data Protection Regulation, you have the following rights:

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your personal data ("right to be forgotten").
• Right to restriction (Art. 18): request restriction of processing in certain circumstances.
• Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests or for direct marketing.
• Right to withdraw consent (Art. 7(3)): withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@strana.ai. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany.

10. Cookies & tracking

We use only what is strictly necessary to keep you signed in and keep the service secure — session and security storage in your browser. We do not use analytics cookies, marketing pixels, or any other tracking, which is also why you will not see a cookie banner here: there is nothing to consent to.

11. Security measures

We implement appropriate technical and organizational measures to protect your data (Art. 32 GDPR):

• Encryption: encryption at rest and TLS for data in transit.
• Access controls: role-based access control, multi-factor authentication for administrative access, and the principle of least privilege.
• Infrastructure security: EU-hosted infrastructure with network isolation, firewalls, and monitoring.
• Employee training: all team members receive data protection training.

12. Breach notification

In the event of a personal data breach:

• We will notify the relevant supervisory authority within 72 hours of becoming aware of a breach that poses a risk to your rights and freedoms (Art. 33 GDPR).
• If the breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay (Art. 34 GDPR).
• Notifications will include the nature of the breach, likely consequences, and measures taken or proposed to address it.

13. Children's privacy

loop me in is designed for professionals. Our services are not directed at individuals under the age of 16 (Art. 8 GDPR), and we do not knowingly collect personal data from children. If we learn that we have collected data from a child under 16, we will delete it promptly.

14. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on this page and, where appropriate, via email notification.

For questions about this privacy policy, please contact privacy@strana.ai.

Related documents: Data Processing Agreement | Imprint