Legal

Privacy Policy

Last updated: July 2026

Data controller

Bits&People S.L. ("Strategos"), is the controller of the personal data you provide through the Strategos platform.

Data we collect

  • Company data: name, corporate email domain, industry, country, number of employees.
  • User data: name, email address, role within the company.
  • Employee data: name, work email, position, department, Gmail consent status.
  • Uploaded documents: annual strategy and org chart, in markdown.
  • Email content (only with the employee's explicit consent).

Purpose of processing

We use your data to:

  • Manage your account and your company on the platform.
  • Read the work email of employees who have granted consent and condense it into monthly strategic summaries (clients, decisions, key figures, risks) for the business owner.
  • Provide the AI assistant (accessible via Telegram) that answers the owner's questions using those summaries, the company strategy and the org chart.
  • Notify you about service updates or incidents.

Use of Google (Gmail) data and Limited Use

To function, Strategos requests the Google restricted scope gmail.readonly (read-only access). Each employee grants this access individually and explicitly through Google's consent flow, and can revoke it at any time from their Google Account or by requesting disconnection from our panel.

We request read-only access because generating the summaries requires reading message content; the metadata scope is insufficient (it excludes message bodies). Strategos never sends, modifies, deletes or labels email, so no broader scope is requested.

Use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Specifically:

  • Gmail data is used solely to provide and improve the user-facing features described here (the summaries and the company's own assistant).
  • We do not transfer or sell Gmail data to third parties, except as strictly necessary to provide the service, to comply with the law, or with your explicit consent.
  • We do not use Gmail data for advertising of any kind.
  • No human reads your email, except with your explicit consent, for security purposes, to comply with the law, or on aggregated and anonymized data. Summary generation is automated.
  • Gmail data is not used to train generalized or third-party AI models.

Who we share Google data with

We do not sell, rent or disclose Google (Gmail) data to third parties for their own purposes, and never for advertising. We only share it with the following service providers (sub-processors), and only to the extent necessary to provide the service:

  • Google Cloud Platform (Cloud SQL, Cloud Storage and Cloud Run): hosting, encrypted storage and compute for the application, in the European Union. Google acts as a processor under a current DPA.
  • AI model providers configured to generate the summaries: Google Gemini, Anthropic (Claude) and MiniMax. Email content is sent to the selected provider's API solely to produce your company's summaries; it is not used to train their models or for any other purpose.
  • Telegram (Telegram Bot API): when the business owner queries the assistant, the answer — derived from the summaries — is delivered through Telegram to the authorized user.
  • Resend (transactional email provider): sending account emails and notifications. It does not receive Gmail content.

Beyond these cases, we will only disclose data when required by law or a competent authority, or with your explicit consent. All sub-processors are contractually bound to protect the data and use it only to provide their service.

Security and protection of sensitive data

We apply technical and organizational measures to protect data, including Gmail content and access tokens, which we treat as sensitive information:

  • Encryption in transit: all communication travels over HTTPS/TLS; the browser never sends server credentials.
  • Encryption at rest: data stored in Google Cloud (database and file storage) is encrypted at rest (AES-256) by default.
  • Protected OAuth tokens: Gmail access tokens are stored securely, used only for reading, and deleted immediately when the employee revokes consent or is disconnected.
  • Access control and per-company isolation: each company is isolated; only the authenticated owner can access their company's information and query the assistant, via authenticated sessions.
  • Least privilege: we request only the Gmail read-only scope; we can never send, modify or delete mail.
  • Secret management: API keys and credentials are kept in secured server configuration, never in the browser or alongside the data.
  • Automated processing: summary generation is automatic; there is no routine human access to email content.
  • Minimization and deletion: we keep data only as long as necessary and offer full deletion (see Data retention).

Legal basis

Processing is based on the service contract (art. 6.1.b GDPR). Processing of employees' email is carried out after obtaining their explicit consent (art. 6.1.a GDPR).

Google Cloud Platform (GCP) infrastructure

Data is stored and processed on Google Cloud Platform infrastructure (cloud.google.com), located in the European Union. Google acts as a processor under a current DPA (Data Processing Amendment).

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to contact@bitsandpeople.com. This includes the right to delete your account and all associated data, as well as the right to revoke any employee's Gmail consent at any time.

Data retention

We keep your data while your account is active. When an employee revokes consent or is disconnected, we stop accessing their Gmail and delete their access tokens. Deleting a company removes all of its email content and associated summaries from our database. After account deletion, data is removed within a maximum of 30 days, unless legally required to retain it.

Cookies

We use essential cookies for authentication (session token) and basic analytics cookies. We do not use third-party cookies for advertising. See more in the platform's cookie banner.

Contact

For any question about this policy, contact us at contact@bitsandpeople.com.