Privacy policy

Stratos is operated by DDL Ventures (“Stratos”, “we”, “us”), a business organised under the laws of the State of Delaware, United States. We are the data controller for the personal information described here. This policy covers the Stratos web app and marketing site at trystratos.ai, the Creator Rewards site at ugc.trystratos.ai, our public API and MCP server, and any email we send you. It does not cover TikTok, Google, Meta or any other platform you connect — their own policies govern what they do with your data on their side.

Stratos makes short-form marketing content for mobile apps. Hooks, AI-creator videos and slideshows — and publishes it to social accounts you connect. Most of what we process exists only to do that job for you.

• Account. Your email address, name, a hashed password (we never see the plain text) or the identity Google returns when you sign in with Google, your plan, credit balance and workspace settings.
• Your product. The App Store link or website you paste, the public listing details we read from it (name, description, screenshots, category, reviews), the screenshots and brand details you add, and the positioning notes you write. If you connect a subscription-analytics integration, the revenue and subscriber metrics you choose to share so your dashboard can show them.
• Content you create. Hooks, captions, slides, scripts, generated images and videos, the AI characters you create or pick, footage or photos you upload, and the voice or face of anyone in that footage. If you upload media containing a real person, you are responsible for having their permission.
• Connected platforms. When you connect TikTok, YouTube or Instagram/Facebook we store an access token, the account's public identity (name, handle, avatar, ID) and the settings needed to publish (for example TikTok's privacy and comment options), plus the status and public performance metrics of posts Stratos published. Tokens are encrypted at rest. Details for each platform are below.
• Payments. Billing is handled by a PCI-DSS compliant payment processor. We receive your plan, invoices, the last four digits and brand of your card and your billing country; full card numbers never touch our systems.
• Usage and technical data. Server logs (IP address, browser and device type, pages and API routes requested, timestamps, error reports) and product events needed to run features such as posting schedules, credit accounting and rate limiting. We also record product analytics through PostHog so we can see which parts of Stratos people use and where they get stuck: pages viewed, features opened, when a generation runs out of credits, and whether a draft was edited or discarded. These events identify you only by your Stratos account ID. They never carry your email, your name, your social handles, or the text of anything you or Stratos wrote. We do not run advertising trackers of any kind.
• Communications. Emails you send us, support conversations, and anything you post in our community channels.
• Creator Rewards applications. If you apply at ugc.trystratos.ai: your name, email, country, TikTok and Instagram handles, follower count, a portfolio link, what you tell us you would make, a referral code if you used one, and a hashed IP address used only to detect abuse.
• Referrals. If you share a referral link, the code, the clicks it receives and the accounts that sign up through it, so we can credit you.

• To provide the service you signed up for. Generating, storing, scheduling and publishing your content, showing its performance, and billing you. Basis: performance of our contract with you.
• To operate and secure the service. Authentication, fraud and abuse prevention, rate limiting, debugging and backups. Basis: our legitimate interest in running a safe, working product.
• To improve the product using aggregated, de-identified usage patterns. We do not use your content or your product data to train AI models, and we do not permit our AI providers to. Basis: legitimate interest.
• To communicate with you about your account, your posts, security and material changes to the service. Basis: contract and legal obligation. Product news is opt-in and every email has an unsubscribe link.
• To run the Creator Rewards and referral programs you opt into. Basis: contract.
• To comply with law, respond to lawful requests and enforce our terms. Basis: legal obligation and legitimate interest.

Where we rely on consent, for example when you connect a social account. You can withdraw it at any time by disconnecting the account, and we stop processing on that basis going forward.

Stratos generates content with third-party AI models. To do that we send the relevant inputs to the provider: your product's public listing details and the notes you wrote (to write hooks and scripts), your prompts and reference images (to draw slides and characters), and a still image or clip (to animate a video). We use established third-party model providers for text, image and video generation, through their business APIs and under terms that prohibit them from using your inputs to train their models. We do not send your account details, tokens or payment information to any AI provider.

AI creators offered in Stratos are synthetic people; they are not based on any real individual. If you upload a photo or footage of a real person to make a character or a hook, that likeness is used only for the content you ask for and is deleted when you delete the character or your account.

When you connect TikTok through TikTok Login, we receive your basic profile (display name, avatar, account identifiers) and your creator posting settings (available privacy levels and whether comments, duet and stitch are allowed). When you publish, we send the media and caption you approved to TikTok's Content Posting API and read back the post's status and public metrics.

We use TikTok data only to publish your own content to your own account, show the correct posting options, and report how your posts perform. We do not use it for advertising or profiling, and we do not share it with anyone other than the infrastructure providers that run Stratos. Disconnecting TikTok inside Stratos revokes our access and deletes the stored token. Our handling of TikTok data follows the TikTok Developer Terms of Service.

If you connect a YouTube channel, Stratos uses Google APIs (including the YouTube Data API) to publish on your behalf. If you sign in with Google, we receive your name, email address and profile picture from Google to create your account.

• What we access. Your channel identity (name, ID, avatar) so you can see which channel is connected; permission to upload videos to that channel; and statistics for the videos Stratos uploads (views, likes, comments) to show you analytics.
• What we do with it. Only to provide Stratos's features to you: uploading the videos you create and schedule, showing which channel is connected, and displaying how your posts perform. We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models.
• Who can see it. Nobody outside Stratos, other than the infrastructure providers that host the service under confidentiality obligations. Our staff only access it to run or support the service, with your permission, or as required by law.
• How to revoke access. Disconnect the channel inside Stratos, or remove Stratos at myaccount.google.com/permissions. Once revoked we can no longer access your channel and we delete the stored tokens.

Stratos’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Because Stratos uses YouTube API Services, you also agree to the YouTube Terms of Service when you connect a channel, and Google’s Privacy Policy applies to Google’s handling of your data.

If you connect an Instagram or Facebook account, Stratos uses Meta's official APIs (Facebook Login and the Instagram Graph API) to publish on your behalf.

• What we access. Your basic account details (name, ID, avatar) so you can see which account is connected; permission to publish the content you create to that account; and public metrics for the posts Stratos publishes (views, likes, comments) to show you analytics.
• What we do with it. Only to deliver Stratos's publishing features to you. We do not use Meta data for advertising, profiling or to train AI models, we do not sell it, and we share it only with the infrastructure providers that host Stratos under confidentiality obligations.
• How to revoke access. Disconnect the account inside Stratos, or remove Stratos from your Facebook Business Integrations settings. Once revoked we delete the stored tokens. You can also ask us to delete all data we hold from Meta by emailing daniel@ddl-ventures.com.

Our handling of Instagram and Facebook data complies with the Meta Platform Terms and Developer Policies.

We do not sell your personal information and we do not share it for cross-context behavioural advertising. We share it only with the categories of service provider below, each bound by a contract that limits them to processing on our instructions and to keeping it confidential, and with the platforms you connect, at your direction. A current list of providers is available on request at the contact below.

• Infrastructure providers. Cloud hosting, database, file storage and authentication services that run the app and store your data.
• Payment processor. Handles card details, invoices and subscriptions on our behalf; we never hold full card numbers.
• AI model providers. Receive the inputs described under AI processing to generate your content, under no-training terms.
• Web-reading services. Fetch the public web page or app-store listing you paste so Stratos can understand your product.
• Email delivery. Sends account and transactional email.
• Optional integrations. Only if you connect them, for example a subscription-analytics service to show your app's metrics.
• TikTok, Google/YouTube and Meta. Receive the content you publish and return its status and metrics, at your direction.

We may also disclose information when the law requires it, to protect the rights and safety of Stratos or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply and we will tell you.

Stratos is operated from the United States and our providers process data in the US and other countries. If you are in the European Economic Area, the United Kingdom or Switzerland, we transfer your data under the European Commission's Standard Contractual Clauses (and the UK Addendum) or another lawful mechanism, and our providers are contractually required to protect it to the standard those laws require.

• Account, product and content data: for as long as your account exists. Delete a product, character or post and it is removed from the live service immediately.
• Platform tokens: until you disconnect the account, revoke access on the platform, or delete your account, then deleted.
• Scheduled media: until the post has published and the platform has confirmed it, plus a short window for retries.
• Server logs: typically no more than 90 days. Provider backups: typically no more than 30 days, after which deleted data is gone from backups too.
• Billing records: as long as tax and accounting law requires, typically 7 years.
• Creator Rewards applications: for the life of the program, or until you ask us to delete yours.

When you delete your account, or ask us to at daniel@ddl-ventures.com, we delete your personal information within 30 days except where we must keep it by law or to resolve a dispute.

Data is encrypted in transit (TLS) and at rest. Platform access tokens are additionally encrypted with a key held only by our backend. Access to production systems is limited to the people who operate the service and is logged. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and any regulator as the law requires.

We use only strictly necessary storage: your sign-in session, your theme and workspace preferences, a referral code if you arrived through a referral link, and a first-party product-analytics ID. There are no advertising cookies, and our analytics runs cookie-free — it stores its ID in your browser's local storage on our own domain and never writes a cookie or an identifier that could follow you to another site. That is why there is no consent banner. If your browser sends a Do Not Track signal we record no product analytics from you at all, and your Global Privacy Control signal is respected by default because we never sell or share data for advertising.

Stratos writes posts for you and can see how they performed, and we use that loop to make the writing better. For your own account we keep a record of each published post's format, style, posting time and public performance figures, together with any edits you make to a draft before it goes out, so that what Stratos writes for you next is shaped by what has already worked for you.

We also learn across accounts, and only in aggregate. That means statistics such as “how often does this hook format get saved in the fitness category”, computed over many accounts at once. It never includes the text of your posts, your app’s name, your handles, or anything that identifies you or your business to another customer. Your written content is never used to train a model that serves anyone else, and it is never sold or shared.

You can opt out of contributing to the aggregate statistics at any time by emailing us, and doing so does not change anything about how Stratos works for you.

Wherever you live, you can exercise the rights below and we will honour them; some are also guaranteed to you by law.

• Access. Get a copy of the personal information we hold about you.
• Correction. Fix information that is inaccurate or incomplete.
• Deletion. Delete your account and associated data, subject to legal retention.
• Portability. Receive your information in a machine-readable format.
• Objection and restriction. Object to, or ask us to limit, processing based on legitimate interest.
• Withdraw consent. Disconnect a platform or turn off an optional integration at any time.
• No discrimination. We will never charge you or degrade the service for exercising a right.

EEA, UK and Switzerland (GDPR / UK GDPR). Our legal bases are set out above. You also have the right to lodge a complaint with your local supervisory authority; in the UK that is the ICO. California (CCPA/CPRA). You have the right to know what we collect and why, to delete it, to correct it, and to opt out of sale or sharing — we do neither, and we do not use or disclose sensitive personal information for purposes other than providing the service. You may use an authorised agent, and if we deny a request you may appeal by replying to our decision. Residents of Virginia, Colorado, Connecticut, Utah and other US states with privacy laws have equivalent rights.

To exercise any right, email daniel@ddl-ventures.com from the address on your account. We verify requests against your account and respond within 30 days (45 for CCPA requests, extendable once where the law allows), free of charge.

Stratos and the Creator Rewards program are for adults. We do not knowingly collect personal information from anyone under 18 (or under 16 where that is the age of digital consent). If you believe a minor has given us data, email daniel@ddl-ventures.com and we will delete it.

Applications submitted at ugc.trystratos.ai are reviewed by the Stratos team and stored as described above. If you are accepted we also process the URLs of the posts you submit, their public view counts on the platform, and the payout details you give us so we can pay you. Program questions go to marketing@trystratos.ai; privacy requests go to daniel@ddl-ventures.com.

When we change this policy we update the date at the top. If a change materially reduces your rights or expands what we collect, we will tell you by email or in the app before it takes effect.

DDL Ventures, operator of Stratos. Privacy questions and requests: daniel@ddl-ventures.com. We aim to reply within five working days.