Privacy policy
Last updated 29 October 2026
Sterodata is operated by Yodly SRL
CUI RO47510316 · Trade Register J2023001257400 · Share capital 200 lei
Registered office: Șos. Chitilei nr. 23, bl. 1, sc. 1, et. 2, ap. 211, Sector 1, București, Romania
This policy explains how Yodly SRL ("we") handles personal data when you use Sterodata (sterodata.com, the app at app.sterodata.com, and its connector for AI assistants), under the EU General Data Protection Regulation (GDPR).
1. Two kinds of data
- Your account, and how you use Sterodata. We are the controller of this data.
- What you and your team put into a workspace: tables, records, files, forms and the answers people send through them. The organisation that runs the workspace decides what goes in and who can see it, and is the controller of that data. We store and process it only to provide the service to that organisation.
2. What we collect, why, and for how long
| What | Why, and on what basis | How long |
|---|---|---|
| Your name and e-mail address. Your password is held by Amazon Cognito; we never see it. | To create your account and sign you in: performance of our contract with you (Art. 6(1)(b)) | Until your account is deleted, on request |
| The workspaces you belong to, your roles, and who created and last changed each record | To show each person only what they may see, and who changed what: performance of the contract (Art. 6(1)(b)) | As long as the workspace exists |
| A record of each request to our service: the address requested, your user, your IP address and your browser | To keep the service secure and find faults: our legitimate interests (Art. 6(1)(f)) | 7 days |
| Visitors without an account: a generated name (such as "Quiet Heron"), the first and latest IP address, and when the identity was last used | So a visitor can open a shared page or send a form, and so a form cannot be flooded: our legitimate interests (Art. 6(1)(f)) | Until you ask us to delete it |
| Answers sent through a form | Delivered to the workspace that published the form, which is their controller | As long as that workspace keeps them |
| AI assistants you connect (ChatGPT, Claude, Codex): the assistant's name, when you connected it and last used it, and its tokens, stored only as one-way hashes | So the assistant can act as you, and so you can see and disconnect it: performance of the contract (Art. 6(1)(b)) | Tokens until they expire or you disconnect; the connection's record is kept, marked as disconnected |
3. Cookies and storage in your browser
sterodata.com sets no cookies, runs no analytics and loads nothing from other companies.
The app sets no cookies and runs no analytics or advertising code. It keeps, in your browser's own storage: your sign-in tokens, or a visitor identity if you are not signed in; your theme and display choices; the brand of pages you opened; and the answers of a form you have started but not sent, so they are not lost. Signing out clears them, except one accessibility setting. To work, the app loads some open-source code from public code libraries (cdnjs, unpkg, jsDelivr and Google's gstatic), which receive your IP address and browser details as any website you load does.
4. Who processes data for us
These providers process data on our behalf, on our instructions, and only as needed to provide their service:
| Who | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, storage, backups, and sign-in (Amazon Cognito) | EU (Ireland) |
| Resend | Sending e-mail: sign-up and password codes, invitations, and the copies of form answers a form is set to send | EU (Ireland) sending region |
| Anthropic | Only if you use the AI chat inside the app: your messages, and the table data it reads to answer them | United States |
If you connect your own AI assistant, such as ChatGPT or Claude, it receives what you ask it to read, within your own permissions. What its provider does with that is covered by that provider's own policy. Integrations you set up yourself, an API or a database you connect, exchange data with the service you chose.
We do not sell personal data, and we do not use it for advertising.
5. International transfers
Your data is stored in the EU. Where a provider processes data outside the European Economic Area, such as Anthropic for the AI chat inside the app, the transfer is protected by appropriate safeguards: the European Commission's Standard Contractual Clauses or, for providers certified under it, the EU–US Data Privacy Framework.
6. Security
- The database and workspace files are encrypted at rest. Every connection to the service uses HTTPS.
- Passwords are held by Amazon Cognito. Assistant tokens are stored only as one-way hashes.
- Inside a workspace, people see only what they have been given. See Access and permissions and Security and your data.
7. Deletion and backups
- A deleted table, field, record or workspace waits 30 days, so it can be restored, then is deleted.
- The database is backed up daily and each backup is kept 7 days; workspace files daily, kept 35 days. Deleted data leaves the backups when they expire.
- Files attached to a record are deleted when their workspace is deleted.
8. Your rights
- Access, rectification and erasure of your personal data, including deleting your account: write to contact@sterodata.com.
- Data portability: your organisation can export any table to CSV or Excel at any time, and you can ask us for your account data.
- Restriction of, or objection to, processing.
- Lodging a complaint with the Romanian supervisory authority, ANSPDCP (dataprotection.ro), or the authority where you live.
We answer requests within one month. For data inside a workspace, ask the organisation that runs it first: it decides what is kept there.
9. Children
Sterodata is built for work and is not meant for children: you must be 16 or older to use it, as the terms of service say. We do not knowingly collect the data of anyone younger. If you think a child under 16 has given us their data, write to contact@sterodata.com and we will delete it.
10. Changes and contact
We may update this policy; the current version is always published here, with the date it last changed. For any question, or to use your rights, write to contact@sterodata.com.