Strapi
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared only with the providers who run the service.
- The documents do not say who can read your content.
Strapi collects account, device, and usage data, keeps customer data for six years, and limits to $100.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Name, payment details, IP, browser, geolocation, and how you click through the site.
Read the exact line
Privacy policy
“Data that identified you: Your IP address, login information, browser type and version, time zone setting, browser plug-in types, geolocation information about where you might be, operating system and version, etc.”
Training
They use it to run the product, analyze traffic, profile you, and send marketing if you agree.
Read the exact line
Privacy policy
“Improving Strapi: Testing features, interacting with feedback platforms and questionnaires, managing landing pages, heat mapping our site, traffic optimization and data analysis and research, including profiling and the use of machine learning and other techniques over your data”
Sharing
Service providers who host and run Strapi get your data when needed.
Read the exact line
Privacy policy
“Your data is shared only when strictly necessary and according to the safeguards and good practices detailed in this Privacy Policy.”
Kept
Customer data is kept for six years after you leave, in case of legal claims.
Read the exact line
Privacy policy
“If you’ve been a Strapi customer, we’ll delete your personal data from our systems six years after you stop being a Strapi customer.”
Controls
Email privacy@strapi.io to access, fix, export, or ask them to erase your data.
Read the exact line
Privacy policy
“You can exercise your rights by sending us an email at privacy@strapi.io.”
Fine print
Service is as-is; they cap at $100; using after a terms update means you agree.
Read the exact line
Terms of service
“STRAPI'S TOTAL LIABILIY FROM YOUR USE OF THE SERVICES IS LIMITED TO US$100.00.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Ask them to erase or export your data
Email privacy@strapi.io (EEA/UK customers: subject line "DSR")
Opt out of marketing emails
Email privacy@strapi.io
Block or manage cookies
Browser settings or the cookie banner/tool on the website
Withdraw consent they already have
Email privacy@strapi.io
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
If something goes wrong, they say they will not pay more than one hundred US dollars.
Read the exact line
Terms of service
“STRAPI'S TOTAL LIABILIY FROM YOUR USE OF THE SERVICES IS LIMITED TO US$100.00.”
For example, if a site outage costs your business thousands, they still claim they only owe $100.
They keep your customer records for six years after you leave, mainly for legal claims.
Read the exact line
Privacy policy
“If you’ve been a Strapi customer, we’ll delete your personal data from our systems six years after you stop being a Strapi customer.”
For example, if you cancel today, they may still hold your name and account data until six years later.
If they change the rules and you keep using the site, they treat that as you saying yes.
Read the exact line
Terms of service
“By using those Services after Strapi has updated the Terms, you are agreeing to all the updated Terms; if you do not agree with the updated Terms, you must stop using the Services.”
For example, if they add a new rule next month and you log in again, they say you accepted it.
They may profile how you use the site and run machine learning on that data, sometimes with outside companies.
Read the exact line
Privacy policy
“including profiling and the use of machine learning and other techniques over your data and in some cases using third parties to do this.”
For example, they might study your click path to decide what product pages to show you.
Besides your account, they collect device, browser, IP, and rough location data.
Read the exact line
Privacy policy
“Data that identified you: Your IP address, login information, browser type and version, time zone setting, browser plug-in types, geolocation information about where you might be, operating system and version, etc.”
For example, visiting the site can log your IP and browser even if you only read a blog post.
They do not promise the product will work correctly or be error-free.
Read the exact line
Terms of service
“THE WEBSITES, THE SERVICES AND ANY INFORMATION OR MATERIAL CONTAINED OR PRESENTED ON THE WEBSITES IS PROVIDED TO YOU ON AN "AS IS", "AS AVAILABLE" AND "WHERE-IS" BASIS”
For example, if a bug wipes a project, they say you used the service at your own risk.
They say they do not collect health, biometric, or similar sensitive data unless you consent or the law requires it.
Read the exact line
Privacy policy
“We don’t collect any "sensitive data" about you (like racial or ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, genetic data, biometric data, health data, data about your sexual life or orientation, and offenses or alleged offenses) except when we have your specific consent, or when we have to comply with the law.”
For example, they say they will not store your fingerprint or health details as part of normal signup.
You can tell them to stop marketing emails by writing to that address.
Read the exact line
Privacy policy
“You can opt out from marketing by emailing us at privacy@strapi.io.”
For example, you can email privacy@strapi.io and ask them not to send product newsletters.
They say they use basic security and limit who inside the company can see your data.
Read the exact line
Privacy policy
“We have put in place reasonably appropriate security measures designed to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.”
For example, they claim only staff who need it for work can access customer records.
They say the product is for people 16 and older, but they do not describe an ID check.
Read the exact line
Privacy policy
“Strapi is a business-to-business service directed to and intended for use only by those who are 16 years of age or over.”
For example, a 15-year-old could still sign up if they type an older age.
Words to know
Legal words from the lines above, in plain English.
- precise geolocation
- Your exact position, usually from GPS, often accurate to within a few metres. For example, an app can tell not just your city but which building you are in right now.
- profiling
- Building a picture of who you are, what you like and what you might do next from your data. For example, an app may guess your income, health or politics from what you watch and tap.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- as is
- You get the service in whatever state it is in, with no promise that it works or will keep working. For example, if the app deletes your photos by mistake, it is not promising to fix that or pay you back.
- sensitive personal information
- Data that could hurt you if exposed, like health, religion, sexuality, race, exact location or bank details. For example, telling a chatbot about a medical condition creates sensitive data that some laws protect more strictly.
- biometric
- Measurements of your body that identify you, like your face, fingerprint or voice. For example, a selfie used to unlock the app or a voice recording matched to you.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
How we got here · grade C · score 42/100 · 15 of 15 policy answers backed by a verified quote · 5 not stated
What does the app collect beyond what it needs to work?
They collect contact and payment details plus IP, login, browser, geolocation, and clickstream usage data.
Does it record your voice, face or body, and what happens to that?
They say they do not collect biometric data unless you specifically consent or the law requires it.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
Not stated in the documents.
Are you profiled or tracked for advertising?
They use cookies, heat maps, profiling, and third-party cookies they say they do not control.
Do they sell or share your data, and can you opt out?
They say they share data with third-party providers only when needed to run the service.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
Customer personal data is kept for six years after you stop being a customer; deletion is by email request.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They profile site behavior for marketing and improvement, but do not describe in-app memory controls.
Do they commit to basic security, and have they leaked data?
They describe general security measures and limiting access to people who need to know.
Is there a real age gate, and are teens protected?
They say the service is for people 16 or over and they do not knowingly collect data from younger children.
Will they tell you when the rules change, and is the policy specific?
Policies are dated; terms say they post updates and notify users, and continued use means you accept.
Can they close your account without warning, and can you get your data out first?
Not stated in the documents.
If something goes wrong, who pays?
The service is as-is with no warranties, and total liability is capped at US$100.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 2,691 words at a fairly hard level (Flesch reading ease 53.9); the terms are 1,003 words at a college level.
