Legal
Privacy Policy
Last updated: 31 October 2026
This policy explains what personal data Stoa collects, why, and what rights you have. We have written it in plain language. If anything is unclear, contact us.
1. Who we are
Stoa is a team planning service operated by Ahmed Adil Kareem, based in Baghdad, Iraq ("Stoa", "we", "us").
Contact for privacy questions and requests: ahmed.alhimdani@gmail.com
2. Two roles: your company's data and our own
Stoa is a business tool. The data in it falls into two groups:
- Team data (plans, tasks, projects, notes, confirmed hours, overtime, notifications, and the team structure) belongs to the business that uses Stoa. That business decides how its team uses Stoa, so it is the "controller" of this data, and we are its "processor": we only handle it to provide the service, under our Data Processing Agreement (stoa.day/dpa). If you are an employee and have a question about your team data, please contact your employer first. You can also contact us.
- Account and service data (your sign-in details, billing records, bug reports, and technical logs) is data we decide how to handle, so for this data we are the controller.
3. What we collect and why
| Data | Where it comes from | Why we use it | Legal basis |
|---|---|---|---|
| Name, email address, and account ID | Google or Microsoft, when you sign in | To create your account, sign you in, and show your name to your team | Performance of our contract with you |
| Team data: plans, tasks, notes, hours, overtime, notifications, team roles and structure | You and your team | To provide the planning service | On behalf of your employer (see section 2) |
| Billing data: plan, invoices, payment status, company name, VAT number if given | You and our payment provider | To manage subscriptions and keep accounting records | Contract and legal obligations |
| Bug reports, optional screenshots, and the page, browser, and app version attached to them | You, when you report a bug | To investigate and fix problems | Our legitimate interest in a working service |
| Technical data: IP address, browser type, and server logs | Your browser, automatically | To keep Stoa secure, prevent abuse, and fix errors | Our legitimate interest in security |
We never receive your Google or Microsoft password. Card details are handled by our payment provider; we do not see or store full card numbers.
4. What we do not do
- We do not sell or rent personal data.
- We do not show advertising or use advertising or tracking cookies.
- We do not use your data to train artificial intelligence, and Stoa has no AI features.
- We do not take screenshots, record activity, or monitor how employees use their computers. Stoa is a planning tool, not a time tracker.
- We do not send marketing emails. We may email you personally only when necessary, for example about security, your subscription, or important changes to these policies.
5. Who can see your data
- Inside your team: your teammates see what Stoa is designed to show them, for example the team's plans. Leaders see more about the people who report to them, as described in the app. Your actual hours per task are private to you; your leaders see confirmed project totals and the overtime you report.
- Us: the platform administrator can see account information (teams, names, email addresses, roles, subscription status) to run the service and support customers. We do not view the contents of your team's plans, tasks, or notes, except when you explicitly ask us to help with a problem or when the law requires it.
- Service providers that help us run Stoa, only for that purpose:
- DigitalOcean: hosting our servers in Frankfurt, Germany.
- Google and Microsoft: signing in, if you choose them.
- Our payment provider: processing subscription payments.
- Authorities, only when the law requires it.
6. International transfers
Our servers are located in Frankfurt, Germany. Stoa is operated from Iraq, so data may be accessed from Iraq, which is outside the UK and the European Economic Area. For transfers of team data, we use the European Commission's Standard Contractual Clauses (and the UK Addendum to them), as set out in our Data Processing Agreement. Our service providers use their own approved transfer safeguards.
7. How long we keep data
- Account data: while your account exists. When an account is deleted, it is removed from our systems, and from our backups within 35 days.
- Team data: until the team's owner deletes it or the team is deleted. Some history is kept in anonymized form where the app describes this (for example, plans from a person who left a team, without their name).
- Billing records: as long as required for tax and accounting purposes.
- Bug reports and screenshots: until the report is resolved and for up to 12 months after, or until you delete your account.
- Server logs: up to 30 days.
8. Your rights
Depending on where you live, including under the UK GDPR and the EU GDPR, you have the right to:
- access the personal data we hold about you,
- correct inaccurate data,
- have your data deleted,
- restrict or object to certain processing,
- receive your data in a portable format, and
- complain to a data protection authority, such as the UK Information Commissioner's Office or the authority in your EU country.
You can export your data and delete your account yourself in Account settings. Team owners can export or delete all team data in Settings. For any other request, email ahmed.alhimdani@gmail.com. We reply within one month. For team data, we may forward your request to your employer, who is responsible for that data.
9. Security
We protect data with encrypted connections (HTTPS), secure server-side sign-in sessions, strict separation between teams' data, limited administrator access, and regular backups. No system is perfectly secure, but we work to protect your data and will inform affected customers without undue delay if a breach affects them.
10. Children
Stoa is a service for businesses. It is not intended for anyone under 16, and we do not knowingly collect their data.
11. Changes to this policy
If we make important changes, we will announce them in the app before they take effect. The date at the top shows when this policy was last updated.
12. Contact
Ahmed Adil Kareem, Baghdad, Iraq