Privacy Policy

Effective date: 2026-06-28

Stature Cloud, Inc. ("Stature", "we", "us", "our") operates the Stature website at stature.cloud, the application at app.stature.cloud, and related services.

Who we are and our role

Stature builds and answers questions over a citation-grounded dossier of an individual's or organization's expertise.

Where we collect data directly from you, such as account, waitlist, and billing information, Stature is the controller. Where a workspace uploads content or discovers a footprint that contains personal information about its own people, customers, or third parties, the workspace is the controller and Stature acts as a processor under the workspace's instructions and data processing agreement.

Personal information we process

| Category | Examples | Source | | --- | --- | --- | | Waitlist / early-access data | name, email address, organization | you, through the marketing site | | Account data | name, email, authentication identifiers, workspace membership, role, clearance tier | you or your workspace admin | | Billing data | subscriber email, plan, subscription status, billing metadata | you, through Stripe Checkout or Customer Portal | | Chat and usage data | chat queries, conversation history, generated answers, dossiers, timestamps, browser metadata, audit and cost telemetry | your use of the service | | Corpus content | uploaded documents, transcripts, chunks, embeddings, and citations | your workspace | | Publicly-discovered footprint | public works attributable to you or your organization | public sources and bibliographic APIs |

Stature is not designed to process special-category data, government identifiers, payment card numbers, or children's data. Payment card details are handled by Stripe and are never stored on Stature servers. The service is not directed to children under 13.

How we use personal information

We use personal information to operate the waitlist, create and authenticate accounts, provide workspace access, ingest and retrieve content, generate cited answers and dossiers, process billing, maintain security, prevent abuse, maintain audit trails, send transactional notices, and support and improve the service.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use customer content, chats, or corpus material to train or fine-tune Stature's or any third party's foundation models.

Subprocessors

We disclose personal information to service providers and subprocessors that help us operate the service. The current user-facing list is maintained on the Subprocessors page. We also use public bibliographic APIs for outbound lookups against the public record; we do not transmit customer content to those APIs.

International transfers

Our primary infrastructure is in the United States. If you or your data subjects are in the EEA, UK, or Switzerland, transfers to the United States or other non-adequate countries are made under appropriate safeguards, including the Standard Contractual Clauses and the UK International Data Transfer Addendum where applicable. EU-region hosting is available to organization customers on request.

Data retention

| Data | Default retention | | --- | --- | | Corpus documents, chunks, citations | until workspace/account deletion, then deletion through the configured lifecycle process | | Chat history | Trial or lapsed access: 14 days. Scholar and Pro paid tiers: 365 days (1 year). Empty aged sessions are pruned on the same schedule. | | Audit logs | 400 days | | Cost and usage telemetry | 400 days | | Application logs | 400 days | | Backups | 30 days standard; 90 days for verified backups | | Account records | until account deletion plus any legally required retention | | Waitlist data | until you ask to be removed or the early-access program ends |

Organization customers may negotiate custom retention in their data processing agreement. If you need a longer conversation-history window on a paid plan, contact [email protected] and we will evaluate the request case by case.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information. A signed-in user can export their own data and delete their data in the application under Settings -> Your data. If you cannot sign in, email [email protected] or [email protected].

If your personal information appears in a workspace's content, your request is generally directed to that workspace as controller. If you contact Stature directly, we will refer the request to the relevant workspace and assist them as required by our data processing agreement.

California residents have the right to know, access, delete, correct, opt out of sale or sharing, limit certain sensitive-personal-information uses, and be free from discrimination for exercising privacy rights. We do not sell personal information or share it for cross-context behavioral advertising.

Security

We use technical and organizational safeguards appropriate to the risk, including encryption in transit and at rest, tenant isolation, role and clearance controls, least-privilege access, managed secret storage, vulnerability scanning, centralized audit logging, and incident response procedures. No system is perfectly secure.

Cookies and analytics

The application uses strictly necessary cookies and browser storage for authentication and core functionality. The marketing site uses Plausible, a cookieless analytics service, on public pages only. See the Cookie Notice.

Contact

Privacy and data-protection questions can be sent to [email protected]. General questions can be sent to [email protected].