Privacy policy.
What we collect, why, who else touches it, and what you can require us to do about it.
Draft
This policy is a working draft and has not yet been reviewed by legal counsel. It describes how the product actually behaves today, but it is not yet a final statement of our legal obligations, and passages marked as needing legal input are incomplete. Email [email protected] if you need a definitive answer before it is finalised.
Who this policy is from
Last updated · Effective [NEEDS LEGAL INPUT]
- Legal entity
- [NEEDS LEGAL INPUT]
- Trading as
- Storatix
- Registered address
- [NEEDS LEGAL INPUT]
- Governing law
- [NEEDS LEGAL INPUT]
References to “we”, “us”, and “Storatix” below mean this entity.
Two different roles, and why it matters to you
For operators, we are the data controller
If you run a storage business and use Storatix to do it, we decide what we collect about you and your staff and why. Your rights under this policy run against us directly, and you can exercise them by writing to us.
For tenants, we are usually the data processor
If you rent a unit, your record was created by the operator you rent from, not by us. They decide what to hold about you and for how long; we store and process it on their instructions under a contract with them.
What that means if you are a tenant
Requests to see, correct, or delete your information should go to the operator you rent from — they are the ones who can decide. Write to us anyway if you cannot reach them or do not know who they are, and we will identify the right operator and pass it on rather than leave you stuck.
What we collect
Grouped by whose data it is. We collect what the product needs to function and have not added collection for analytics or advertising purposes.
Operator and staff accounts
Lawful basis: Necessary to perform our contract with you, and our legitimate interest in securing the service.
- Name, display name, email address, and phone number.
- Postal address.
- A bcrypt hash of your password. We never hold the password itself.
- Your role and which company and facilities you may access.
- Activity records — what was changed, by which account, and when — kept as an audit log so an operator can answer that question about their own staff.
Tenant records entered by an operator
Lawful basis: Processed on the operator's documented instructions. The operator is responsible for having a lawful basis to hold it.
- Name and, where applicable, business name.
- Email address, phone number, and an alternate phone number.
- Postal address.
- Rental records: which unit, on what terms, from when, and the payment and lease history attached to it.
- Gate access provisioning tied to the state of that rental, where an operator uses the gate integration.
Payment information
Lawful basis: Necessary to perform the rental contract.
- Card details are entered on Stripe's own payment form and go to Stripe directly. They do not reach our servers, and we could not store them if we wanted to.
- We retain Stripe's identifiers for a payment — the reference, the amount, the status, the date — so a payment can be reconciled against a rental.
Information from using the site
Lawful basis: Necessary to operate and secure the service.
- Server logs recording requests to the application, which include IP addresses and are used to operate and troubleshoot the service.
- One session cookie once you sign in. Nothing else.
What we use it for
- Providing the product: creating rentals, taking payments, sending leases for signature, provisioning gate access, and producing the reports an operator asks for.
- Communicating about the service — a lease to sign, a payment that failed, a change that affects how you use the product.
- Keeping accounts secure, investigating suspected misuse, and meeting our legal obligations.
- Support, when you ask us for help with something specific.
What we do not do with it
- We do not sell personal information, and we do not share it for cross-context behavioural advertising. In the sense those terms carry under California law, we do neither.
- We do not run advertising, profiling, or automated decision-making that produces legal or similarly significant effects.
- We do not use tenant data belonging to one operator for any purpose of our own, including improving the product for other operators.
Who else touches the data
These are the vendors that process personal data on our behalf. Each is bound by contract to process it only on our instructions. We keep this list current because naming subprocessors is an expectation under GDPR Article 28, not a courtesy.
Stripe
Card payments and payouts to the operator's connected account.
Cardholder and payment details, collected directly by Stripe.
DocuSign
Electronic signature of lease agreements.
Signer name and email address, and the lease document itself.
MongoDB
The database the application runs on.
All application records described above.
Render
Application and website hosting.
Anything transiting or logged by the hosted service.
Email delivery provider
Transactional email — lease links, payment notices, account messages.
Provider to be named specifically before launch: [NEEDS LEGAL INPUT]
Recipient name, email address, and message contents.
OpenTech Alliance
Gate access control, for operators who enable it.
Tenant identifiers and access credentials for the relevant site.
We also disclose personal data where the law requires it — a valid legal request, or to establish or defend a legal claim — and to a buyer, together with the rest of the business, if Storatix is ever acquired. We would tell you before the latter took effect.
International transfers
Our vendors operate internationally, so personal data may be processed outside the country it was collected in, including in the United States.
Where data protected by UK or EU law is transferred, we rely on the safeguards permitted by that law — standard contractual clauses or an adequacy decision, depending on the vendor. The specific mechanism per vendor: [NEEDS LEGAL INPUT]
How long we keep it
- Operator accounts
- [NEEDS LEGAL INPUT]
- Kept while the account is active. Deleted or anonymised after the account closes, subject to the legal-record exception below.
- Tenant and rental records
- Set by the operator, not by us
- We hold these for as long as the operator instructs, and delete or return them when their contract with us ends.
- Payment records
- [NEEDS LEGAL INPUT]
- Retained as long as tax and accounting law requires, which is generally longer than the rental itself.
- Server logs
- [NEEDS LEGAL INPUT]
- Kept for operational troubleshooting and security review.
- Unclaimed tenant records
- Configurable; 7 days by default
- A tenant record created during a rental that was never completed is cleaned up automatically. Operators can change the window.
Where we are required to keep something to meet a legal obligation, or to establish or defend a legal claim, we keep it for that purpose only and delete it when the obligation ends.
Your rights
Which of these apply depends on where you live. We do not require you to be in a particular place to ask — we would rather answer than adjudicate your location.
If UK or EU data protection law applies to you
- Access — a copy of the personal data we hold about you.
- Rectification — correction of anything inaccurate or incomplete.
- Erasure — deletion, where we have no overriding basis to keep it.
- Restriction — pause our processing while a dispute is resolved.
- Objection — object to processing based on our legitimate interests.
- Portability — receive your data in a machine-readable form, or have it sent onward.
- Withdraw consent at any time, where we relied on consent.
- Complain to your supervisory authority. In the UK that is the Information Commissioner's Office; in the EU it is the authority for your country. You can do this without going through us first.
If you are in California
- Know what personal information we have collected, the sources, why, and who we disclosed it to.
- Delete personal information we collected from you, subject to the exceptions the statute allows.
- Correct inaccurate personal information.
- Limit the use of sensitive personal information — noting that we do not use it for purposes that would trigger this right.
- Opt out of sale or sharing for cross-context behavioural advertising — noting that we do neither, so there is nothing to opt out of.
- Be free from retaliation for exercising any of these. We do not offer financial incentives for data and will not treat you differently for asking.
If you are in another US state with a privacy law
- Several states now provide rights closely resembling the California list above. We apply the same process regardless of which state you are in rather than making you establish which statute covers you.
How to exercise them
- Write to [email protected] and tell us what you want. You do not need to cite a statute.
- We will verify you are who you say you are, proportionately to what is being asked — more for a deletion request than for a copy of your own record.
- We aim to respond within 30 days, and will tell you if we need longer and why.
- An authorised agent may act for you. We will ask for proof of that authority.
- If you rent a unit and are asking about your tenant record, see the two-roles section above — we will route you to your operator, and chase them if they do not respond.
Children
Storatix is a business product and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child's information has reached us, write to [email protected] and we will delete it.
Changes to this policy
We will update this page when our practices change, and revise the date at the top. If a change materially affects your rights or how we use your data, we will tell affected account holders directly rather than relying on you to re-read the page.
Contact us
For anything in this policy, including exercising a right or asking a question before you buy:
[email protected]- Postal address: [NEEDS LEGAL INPUT]
- EU/UK representative, if one is required: [NEEDS LEGAL INPUT]
- Data protection officer, if one is required: [NEEDS LEGAL INPUT]