Strahler

Privacy Policy

Last updated: September 18, 2026

Strahler ("Strahler", "we", "us") operates the Strahler platform: AI agents for geospatial intelligence. This policy explains what information we collect, how we use it, who we share it with, how we store and protect it, and how you can access or delete it. It applies to the Strahler web application at strahler.ai.

Information we collect

We collect the following categories of information:

  • Google account data (via Google Sign-In). When you sign in with Google, we request the email, profile, and openid scopes. From these we receive your email address, your basic profile information (name and profile picture), and a Google account identifier (the OpenID subject). We do not request access to Gmail, Google Drive, Google Calendar, or any other Google service data.
  • Account data. Your account identifier, authentication tokens, and credit balance.
  • Content you provide. The prompts you write, files you upload, and the layers, maps, figures, and results produced in your sessions.
  • Usage and technical data. Basic operational logs and product analytics (for example, page views, feature usage, account identifier and email for identified analytics profiles, device/browser information, and client-side error details) used to operate and improve the service. Session replay and analytics autocapture are disabled in the application.

How we use Google user data

We use the Google account data described above solely to: create and authenticate your Strahler account; identify your session and keep your work private to you; display your name and profile picture in the app; and contact you about your account and the service. We do not use Google user data for advertising, and we do not use it to train, fine- tune, or develop generalized AI/ML models.

Strahler's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How we use other information

We use your content to run the workflows you request (fetching data, geoprocessing, analysis, and visualization) and to return results to you. We use account, usage, and technical data to provide, secure, maintain, and improve the service, to meter usage and credits, and to comply with legal obligations.

Routing telemetry does not retain prompt text, account identifiers, or session identifiers.

How we share information

We do not sell your personal information, and we do not share Google user data with third parties except as needed to provide the service or as required by law. We use a small number of infrastructure providers (subprocessors) that process data on our behalf under contractual confidentiality and security obligations:

  • Supabase (authentication and account database).
  • Cloudflare R2 (encrypted object storage for your files and results).
  • Fly.io (application hosting and compute).
  • Anthropic (the AI model that powers the agent; it processes the prompts and content you submit to run your workflow).
  • OpenAI (text embeddings used to choose which model handles your request; it receives the text of your message, not your files or results, and does not generate any part of the response. Used only when embedding-based routing is configured for the service).
  • PostHog (product analytics; enabled only when configured).
  • Sentry (scrubbed application error reporting; enabled only when configured).
  • Stripe (payment and subscription processing).
  • Resend (transactional and account email).
  • Web search providers (used only when a workflow performs a web search; they receive the search query, not your files).

How your workflow is routed between AI providers. To keep the service fast and affordable, the assistant selects a model for each turn. Depending on the service configuration, your plan, and the task, a turn may be processed by Anthropic, DeepSeek, or Moonshot (Kimi). A non-Anthropic provider or cross-provider failover is used only when that provider has been enabled for the service/account; it is not an unconditional default. Any provider handling a turn receives the prompts, files, and results needed for that turn. Making that routing choice can itself involve sending the text of your message to OpenAI to compute an embedding; OpenAI classifies the request only and never generates any part of the response. DeepSeek and Moonshot may process data outside the UK/EU.

Provider selection is automatic.

We may also disclose information to comply with applicable law, to enforce our terms, or to protect the rights, safety, and security of our users and the service.

How we store and protect data

Account and session data is protected by authentication, account-scoped authorization checks, separated storage paths, and restricted production access. Data is encrypted in transit (HTTPS/TLS) and stored with infrastructure providers that encrypt data at rest. Authentication is handled through Google Sign-In and short-lived tokens. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard measures.

Data retention and deletion

We retain your account data and content for as long as your account is active or as needed to provide the service. You can delete files from the session-files panel at any time. To delete your account and the personal data associated with it, email sales@strahler.ai and we will process the request and delete the data within 30 days, except where we are required to retain it to comply with legal obligations. Revoking Strahler's access from your Google Account permissions page will stop any further access to your Google data.

Children

Strahler is not directed to children under 16, and we do not knowingly collect their data.

Changes to this policy

We may update this policy from time to time. We will revise the "Last updated" date above and, for material changes, provide a more prominent notice.

Contact

Questions about this policy or your data: email sales@strahler.ai. Strahler.ai, Oxford, United Kingdom, governed by the laws of England and Wales.