Privacy Policy

1. Who we are

This website is operated by NCM Technology Ltd, trading as StrikeStack ("we", "us", "our"). StrikeStack provides drop-in AI agents that help businesses streamline work, reduce busywork and connect the tools they already use.

We are the data controller for personal data processed through this website. If you have any questions about this policy or how we handle your information, please contact us at:

2. What data we collect

We collect personal data only in the following circumstances:

Contact form submissions

When you complete the contact form on this website we collect your name, email address, company name, website, the workflow or market details you provide, the offer requested, and a request identifier used to prevent duplicate submissions. We also store the request's delivery and review history so that it can be followed through to completion. This information is submitted by you voluntarily.

Campaign attribution

If you arrive through a campaign, the form may record campaign parameters from the page URL (such as source, medium and campaign) and an advertising click identifier supplied by the referring platform (such as a Google click ID). We use these details to understand which campaign led to a request. If you consent to measurement, a configured Google Ads service may receive a pseudonymous request identifier so it can count an accepted request once. Plausible and optional Google Analytics diagnostics receive completed-request properties without that identifier. We do not use these details to build an advertising profile about you.

Cookies and analytics

We use a small number of cookies. Details of each category are set out in Section 7 below. If you consent to analytics cookies we collect usage and campaign-measurement data (such as page views, referrer, device type, country and completed-request events) to help us understand whether the site and its campaigns are useful. Providers may keep event-level records for their configured retention periods. We do not use this website data for personalised advertising.

Server logs

Our hosting infrastructure automatically records standard server-log data (IP address, browser type, referring URL, date and time of request and, for some requests, a pseudonymous request reference) for security and operational purposes. It is retained for the period provided by our active hosting plan and configured logging controls, then expires under those controls. We verify that period before accepting live campaign traffic. Logs are not used for marketing or profiling.

3. How we use your information

We use the personal data we collect for the following purposes:

• To assess, fulfil and respond to the offer or enquiry you request.
• To send a transactional receipt confirming that we received your request.
• To maintain a reliable record of the request, its status and its delivery.
• To measure and improve the site and its campaigns (only if you have consented to analytics and measurement cookies).
• To protect our website against fraud, abuse, and security threats.
• To comply with any legal obligation to which we are subject under English law or UK legislation.

We do not sell, rent, or otherwise trade your personal data with third parties for their own marketing purposes. Submitting a request does not add you to a marketing list. We will seek separate permission before sending optional marketing messages.

4. Legal basis for processing

We rely on the following lawful bases under UK GDPR:

• Legitimate interests — responding to enquiries you have initiated, maintaining site security, and server-log processing.
• Consent — analytics and campaign-measurement cookies (where you have accepted via our cookie banner), and any optional marketing messages.
• Legal obligation — where we are required to process or retain data by applicable law.

5. How long we keep your data

Retention varies by system. Our live database has an automated schedule; email, mailbox, analytics and log copies are controlled separately as described below.

• Request data in our live database — the form submission, campaign attribution, status history and delivery record are normally deleted after 22 calendar months, or earlier if you ask us to delete them where the law allows.
• Database recovery history — Cloudflare D1 Time Travel may hold recoverable database history for up to a further 30 days. Access is restricted to disaster recovery. The 22-month live-data schedule is designed so records age out of recovery history within 24 months under normal operation. If we restore a database, we reapply any valid erasure requests before normal service resumes.
• Email and mailbox copies — deleting a database record does not automatically delete copies held by our email provider or in our internal mailbox. Resend's standard service may retain message content while our account is active. These copies require separate retention and erasure procedures; the database deletion schedule does not apply to them automatically.
• Analytics data — aggregate reports may persist. Plausible does not receive our database request identifier. If you consent, a configured Google measurement service may retain a pseudonymous completed-request event identifier under its configured retention settings.
• Server logs — retained for the period provided by our active hosting plan and configured logging controls. We verify the current period before accepting live campaign traffic.

6. Who we share data with

We use the following categories of third-party service providers to operate this website. Each acts as a data processor on our behalf and is bound by appropriate data-processing terms:

• Hosting and infrastructure — Cloudflare hosts the website, protects the form and stores accepted request records on our behalf.
• Analytics and campaign measurement — if you consent, analytics and advertising-measurement providers, including Plausible and any configured Google Analytics or Google Ads service, may receive page, network and device information (including IP address), campaign and click identifiers, and completed-request data needed to report campaign performance. Google explains how it uses data from partner sites in its partner-sites notice.
• Email delivery — Resend sends the internal notification and the transactional receipt confirming that we received your request. Its standard service may store delivery metadata and message content while our account is active.
• Bot protection — our contact form uses a CAPTCHA service (Cloudflare Turnstile) to prevent automated submissions. Turnstile is designed to be privacy-preserving and does not set tracking cookies.

Some providers may process data outside the UK. Where this happens, we use the safeguards required by UK data-protection law, such as an adequacy regulation or approved contractual protections.

7. Cookies

Cookies are small text files stored on your device by your browser. We use the following categories:

• Essential cookies — strictly necessary for the website to function (e.g. storing your cookie-consent preference). These cannot be disabled.
• Analytics and measurement cookies — used to understand how visitors use the site and whether a campaign led to a completed request. These are only set after you accept them through our cookie banner.

You can withdraw consent at any time by selecting Cookie settings and then Decline. This updates your choice immediately and reloads the page to stop measurement code that was already loaded. You can also clear your browser cookies, which will cause the consent banner to reappear on your next visit.

8. Your rights

Under UK GDPR and the Data Protection Act 2018 you have the following rights in relation to your personal data:

• Right of access — to request a copy of the data we hold.
• Right to rectification — to ask us to correct inaccurate or incomplete data.
• Right to erasure — to ask us to delete your data in certain circumstances.
• Right to restrict processing — to ask us to limit how we use your data.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

To exercise any of these rights, please contact us at privacy@strikestack.ai. We will respond within one calendar month of receiving your request.

After verifying a request, we act on the live database, internal mailbox and processor-held copy where deletion is available and the law permits. D1 recovery history expires on a rolling basis rather than being edited in place. If a recovery copy is restored, we reapply valid erasure requests before normal service resumes.

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO):

9. Children

This website is directed at business professionals. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has submitted data to us, please contact us and we will delete it promptly.

10. Links to other websites

This website may contain links to third-party websites, including other Strike products. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal data.

11. Changes to this policy

We may update this Privacy Policy from time to time. Where changes are material we will post a notice on the site and update the "Last updated" date at the top of this page. Continued use of the site after a revised policy has been posted constitutes your acceptance of that revision.