Legal
Privacy policy
Draft. This page is waiting for legal review before Sastra Cloud accepts paying customers.
This policy explains what personal data Lectio (lectio.pro) collects when you use sastra.cloud and Sastra Cloud, why, and what your rights are. Lectio is the controller for your account data and a processor for the data inside your workspace, which your organization controls.
What we collect
Account data
Your email address, the workspace name and address you choose, your region and timezone, and billing status. Payment card details are collected and stored by Paddle, not by us.
Workspace data
Everything your team puts into the workspace: projects, tasks, chat, files, agreements, budgets, and email sent to the correspondence address. This data is processed on your organization's instructions, under the data processing addendum.
Technical data
Server logs with IP addresses and request paths, kept for 30 days for security and troubleshooting. We do not use advertising trackers or third-party analytics on sastra.cloud.
Why we use it
- To run your workspace and keep it working (contract).
- To send sign-in links, invitations, notifications your team chose, and service notices (contract).
- To bill you, through Paddle (contract and legal obligation).
- To keep the service secure and to investigate abuse (legitimate interest).
- To answer your support requests (contract).
Where it is stored
Each workspace has its own database and file storage in the region you choose, Singapore or Frankfurt. Backups are stored encrypted for 30 days. Our providers are listed on the subprocessors page.
AI features
When someone uses an AI feature, the relevant text (for example an email or an agreement) is sent to OpenRouter and the model provider it routes to, with zero data retention requested where the provider supports it. Text sent this way is used only to produce the answer.
Mail sent to your correspondence address is received through Cloudflare Email Routing and stored in your workspace. Notification email is sent through Amazon SES. Bounce and complaint reports come back to us so we can stop sending to addresses that reject mail.
Who can see your data
Your teammates, according to the roles your admins set. Lectio staff do not read workspace content except to fix a problem you asked us to fix, and then only what is needed. We share data with the subprocessors listed, and with authorities when the law requires it.
How long we keep it
For as long as your workspace exists, plus 30 days after cancellation or suspension so you can export or reactivate. Account records needed for tax and accounting are kept as long as the law requires. Logs are kept 30 days.
Your rights
You can ask us for a copy of your personal data, to correct it, to delete it, or to restrict how we use it, and you can complain to your data protection authority. For data inside a workspace, ask your workspace admin first; they can export or delete it. Write to privacy@sastra.cloud.
Children
Sastra Cloud is for organizations, not for children, and we do not knowingly collect data from anyone under 16.
Changes
We will announce changes to this policy by email and on this page at least 14 days before they take effect, unless the change only makes things clearer.
Contact
Lectio, the operator of sastra.cloud and lectio.pro: privacy@sastra.cloud.