Privacy Policy

Last updated: September 2026 (rev. 2)

This policy explains what data Structa Technologies Inc. (“Structa”) collects, how we use it, and who processes it on our behalf. We collect only what we need to run the service.

What we collect

Account data — your name, email, and password (stored hashed) for the people who sign in.
Business data — the information you and your team enter to run the business (e.g. bookings, clients, inventory, menu, orders, payment records). This is data you control; Structa processes it on your behalf.
Billing data — subscription status and identifiers. Card details are entered directly with our payment processor and are not stored by Structa.
Technical data — basic logs needed to operate and secure the service (e.g. request/error logs, an audit trail of sensitive actions).

Subprocessors

We use these providers to deliver the service; your data may be processed by them for that purpose:

Supabase — database, authentication, and hosting of your data.
Stripe — payment processing and subscriptions.
Resend — sending transactional email (e.g. password reset, confirmation).
Anthropic — powers the optional AI assistant; relevant business data is sent to generate a response only when a user uses the assistant.
Vercel — application hosting.
Railway — hosting for the voice bridge, the small service that connects a live call to the receptionist. Only when the voice channel is enabled; the audio and the transcript of those calls pass through it.
OpenAI — the AI receptionist’s voice channel, when enabled. It receives the live audio of those calls, including whatever the caller says, so the receptionist can answer in real time. It also drafts inbox replies where that is configured to run on an OpenAI model instead of Anthropic.
Twilio — the AI receptionist’s phone line, when that channel is enabled.
Gelato — prints employee cards, only when a business orders them. It receives the orderer’s name, shipping address, email and phone, and the card artwork, which carries the employee names and titles printed on the cards.
ShipStation — shipping and label printing, only when a business connects its own ShipStation account. It receives the recipient’s name, phone and shipping address and the order lines for each delivery, and the same details are read back to keep the delivery list in step.
Apple — push notifications to the iOS app. A notification’s text travels through Apple’s push service, and it can name a client and an appointment time (“Maria cancelled 3 pm”).
Sentry — error reports from our servers and apps, so we learn about failures. Reports are scrubbed of message bodies, cookies and credentials before they leave; they can still carry identifiers such as a business or booking id.
Cloudflare — the “are you human” check on the signup and request-access forms (Turnstile). It sees the visitor’s browser and network details for that check only.

Two further providers handle call audio inside Twilio’s own service, not under a contract of ours, on calls that run through Twilio’s relay rather than the path above: Deepgram transcribes what the caller says, and ElevenLabs speaks the reply. We name them because your callers’ voices reach them.

How we use data

to provide, maintain, and secure the service;
to process subscriptions and billing;
to send necessary account emails (e.g. password reset, email confirmation);
to provide support and respond to your requests.

We do not sell your data, and we don’t use it for advertising.

Roles

For the business data you enter, you (the business) decide what is collected and why; Structa processes it on your instructions to run the service. Each business’s data is isolated from others (see Security).

Retention

We keep your data while your account is active. Closing a business does not delete it — the subscription ends and the workspace locks, but everything is still there if you change your mind, and you can still export it.

When you ask for permanent deletion, we wait 30 days and email you the date, so a mistaken or unauthorised request can be caught. After that we permanently delete your data. We keep only limited records we are required to — billing and tax records, and the suppression list that stops us emailing an address that asked us not to.

Your choices

You can view and update most data directly in the app, and export all of it at any time. Owners can close a business and request permanent deletion from inside the app, without asking us. For anything else — access, correction, or a request about data held by a business that uses Structa — contact us and we’ll help.

Cookies

Structa uses only the essential storage needed to keep you signed in (a session token in your browser). We don’t use advertising or third-party tracking cookies.

Contact

Privacy questions or requests? Email hello@structainc.com.