Legal
Privacy Policy
Last updated: October 4, 2026
1. Introduction
This Privacy Policy explains how Straton collects, uses, shares, and protects personal information.
Straton is a software platform for fitness and nutrition coaching businesses. It is operated by Straton Suite LLC, 30 N Gould St Ste. N, Sheridan, WY 82801, United States. In this policy, “Straton”, “we” and “us” mean Straton Suite LLC.
2. Controller and Processor Roles
Privacy law distinguishes between a controller (decides why and how data is processed) and a processor (acts on the controller's instructions).
- For coach account data (name, email, billing, workspace settings), Straton is the controller.
- For client data that a coach uploads, organizes, or manages through Straton (programs, check-ins, photos, metrics, notes), Straton acts as a processor on the coach's behalf. The coach is the controller of that data.
Clients should contact their coach first for requests related to coach-controlled data. Straton will support coaches in fulfilling those requests.
3. Information We Collect
Account & workspace data: name, email, login credentials, workspace settings, coach profile, team membership.
Client data uploaded by coaches: client profile, contact info, workout programs and logs, nutrition targets and logs, check-in responses, intake forms, habits, progress photos, body metrics and measurements, notes, messages.
Billing data: subscription metadata, plan, billing email, tax info. Full card numbers are stored by our payment provider, not by Straton.
Integration data: information from third-party services you connect (e.g. calendar, fitness trackers).
Technical data: device, browser, IP address, app usage, logs, error reports.
Cookies and session replay: our websites use cookies and, with your consent where the law requires it, product analytics and session replay. The Cookie Policy explains each kind and how to turn measurement off.
Support data: messages and feedback you send us.
Children: Straton is not for anyone under 16, and we do not knowingly collect information from them. If you believe someone under 16 has given us their information, contact us and we will delete it. The Terms of Service set the minimum ages for using Straton.
Pre-account applicant data: contact details, coaching application answers, package selection, consent records, and application status submitted through a coach's enrollment link before an account is created.
Sensitive / special category data
Some client data uploaded to Straton may qualify as special category personal data under GDPR Article 9 or equivalent (e.g. body metrics, progress photos, nutrition logs, injury notes that reveal health information).
Coaches are responsible for obtaining explicit consent from clients and applicants before collecting or uploading such data. Straton records the applicable consent before a pre-account enrollment form accepts sensitive answers.
Straton is not HIPAA-compliant and must not be used to process Protected Health Information.
4. How We Use Information
We use information to:
- provide and operate Straton;
- create and manage accounts;
- enable coaches to manage clients, programs, workouts, check-ins, habits, nutrition, and forms;
- process subscriptions and billing;
- provide customer support;
- improve and secure the product;
- detect abuse or fraud;
- send service notifications;
- send marketing where allowed (with opt-out);
- provide AI and automation features;
- comply with legal obligations.
Legal basis for processing (EU/UK users)
| Purpose | Legal basis |
|---|---|
| Providing the platform to a paying coach | Contract (Art. 6(1)(b)) |
| Processing client data on a coach's behalf | The coach's chosen lawful basis, under our DPA |
| Billing, fraud prevention, security | Legitimate interest (Art. 6(1)(f)) |
| Marketing emails to coaches | Consent or legitimate interest with opt-out |
| Legal compliance, tax records | Legal obligation (Art. 6(1)(c)) |
| Special category data (health, photos) | Coach must obtain client explicit consent (Art. 9(2)(a)) |
| Providing a personal plan | Contract (Art. 6(1)(b)) |
| Health data on a personal plan | Your explicit consent to Straton (Art. 9(2)(a)) |
5. Payments
Straton uses Polar (or another payment provider) to process platform subscriptions. The payment provider collects billing, tax, invoice, and payment information directly. Straton does not store full card numbers.
Coach-client payments are handled by the coach's own connected payment provider. The coach and that provider are responsible for the underlying transaction.
6. AI and Automation
Straton processes selected workspace or client content to provide AI-assisted features such as summaries, suggestions, insights, reminders, and draft actions.
Straton does not use coach or client content to train AI models. We send only the minimum content required to AI providers (e.g. OpenAI, Anthropic) under their no-training data policies. On a coaching workspace, AI outputs should be reviewed by coaches before use.
If you train on your own with a personal plan, Straton builds and adjusts that plan for you. Your content is sent to our AI providers only at the moment you submit it, such as your starting answers or a check-in, and only to produce your plan or its update. Nothing is sent on a schedule or between submissions, and none of it is used to train AI models. Adjustments are made automatically; you can change or ignore them, and withdraw your consent any time in Profile.
The list of AI providers we use is published on the Subprocessors page.
7. How We Share Information
We may share information with:
- coaches, clients, team members, and workspace admins, based on permissions;
- hosting, database, email, storage, analytics, support, security, payment, and AI providers (see Subprocessors);
- third-party integrations you connect;
- legal authorities where required;
- professional advisors (e.g. lawyers, auditors);
- parties involved in a merger, acquisition, or sale of assets, under confidentiality.
We do not sell personal information.
8. Data Retention
We keep personal information as long as needed to provide Straton, comply with legal obligations, resolve disputes, maintain security, and operate the business.
- Active account data is retained while the account is active.
- After account termination or an account deletion request, data is retained for up to 30 days to allow export or reactivation, then deleted.
- Some data may persist in encrypted backups for up to 30 additional days.
- Billing, tax, and legal records may be retained longer where required by law.
- Abandoned applicant drafts are deleted after 30 days of inactivity.
- Declined applications are deleted after 90 days.
- Applications awaiting review or payment expire after 90 days of inactivity and their sensitive answers are deleted. Paid applications follow the client retention process.
9. Security
Straton uses reasonable technical and organizational measures to protect personal information, including:
- authentication required for all access to coach and client data;
- workspace-based permissions limiting visibility to authorized users;
- TLS encryption for data in transit and encryption at rest on managed infrastructure;
- PCI-compliant payment processing through Polar (we do not store full card numbers);
- regular automated backups;
- application and infrastructure monitoring for errors, abuse, and security events;
- limited internal access to customer data on a need-to-know basis;
- ongoing dependency monitoring and security updates.
Straton has not yet completed SOC 2 or ISO 27001 audits. We will update this section when that changes.
In the event of a confirmed personal-data breach, Straton will notify affected customers in line with applicable law and, where required, regulators within statutory timeframes (e.g. 72 hours under GDPR).
No system is 100% secure. Users are responsible for keeping login credentials safe. To report a vulnerability, contact security@straton.fit.
10. International Data Transfers
Straton may process and store data in countries different from where users live. Where data leaves the EEA, UK, or other restricted regions, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms.
11. Your Rights
Depending on your location, you may have rights to:
- access, correct, delete, export, or restrict processing of your personal data;
- object to processing or withdraw consent;
- lodge a complaint with a supervisory authority (EU/UK users);
- opt out of “sale” or “share” of personal information (California users; Straton does not sell data).
To exercise your rights, contact privacy@straton.fit. Clients should typically contact their coach first for coach-controlled data.
12. Children and Minors
You must be at least 18 to use Straton on your own. A coach's client must be at least 16, and a client aged 16 or 17 may use Straton only with the agreement of a parent or guardian, which the coach is responsible for obtaining. The app asks for a date of birth and does not let anyone below these ages continue.
Straton is not for anyone under 16, and we do not knowingly collect personal information from them. If you believe someone under 16 has given us their information, contact us and we will delete it.
13. Changes to This Policy
Straton may update this Privacy Policy from time to time. We will post the updated version here and update the “Last updated” date. For material changes, we will provide additional notice (e.g. email or in-app).
14. Contact
For privacy questions or to exercise your rights:
Straton Suite LLC
30 N Gould St Ste. N, Sheridan, WY 82801, United States
For EU users with concerns we cannot resolve, you may contact your local data protection authority.