Privacy Policy

1. Introduction

This privacy policy (Policy) relates to your personal information in connection with your use of and access to the Estratos website (estratos.ai) and application (together, the Estratos Platform) and any services provided by Estratos (the Estratos Platform and services together forming the Estratos Services).

We are committed to protecting your information and your right to privacy. If you have any questions or concerns about our Policy, or our practices with regards to your personal information, please contact us via support@estratos.ai.

When you use the Estratos Services, you trust us with your information and we take your privacy very seriously. We seek to explain to you in the clearest way possible what information we collect, how we use it and what rights you have in relation to it. We hope you take some time to read through it carefully, as it is important. If there are any terms in this Policy that you do not agree with, please discontinue your use of the Estratos Services.

2. Changes to This Policy or Your Personal Information

We review this Policy regularly and reserve our right to amend it at any time. It is your responsibility to check regularly and determine whether you still agree to comply with the Policy. If you do not agree to any changes to this Policy then you must immediately stop using the Estratos Services. In the event we make any significant changes to this Policy we will use our reasonable endeavours to inform you of such changes in advance in writing.

It is important that the personal information we hold about you is true, complete, accurate and current. Accordingly, you must notify us of any changes to your personal information (for example, if you change your email address).

3. About Us

The Estratos Services are owned and operated by WLS Labs Ltd, a company registered in England and Wales with company number 15609221, whose registered office is at 66 Paul Street, London, England, EC2A 4NA (WLS Labs/we/us/our).

WLS Labs is the controller (also known as a data controller) of, and is responsible for, your personal information. The term “you” refers to the user wishing to access and/or use the Estratos Services.

The Estratos Platform provides a hosted multi-tenant memory platform for AI agents: teams store memories organised into folders and tagged layers, with version history and a review workflow, and connect AI agents and tools that read and write those memories via our API and the Model Context Protocol (MCP).

4. Information We May Collect About You

4.1 Personal information you disclose to us

In Short: We collect personal information that you provide to us including information such as your name, email address, workspace and billing details and payment card information (see paragraph (b) below for further details).

(a) Where and how we collect personal information

We collect personal information that you voluntarily provide to us when registering to use and actually using the Estratos Services, or otherwise contacting us.

If you apply or are put forward for a role with us, or work for us (either directly or indirectly) for any period of time, we also collect your personal information, which may include your contact details, financial and payment details, details of your education, qualifications and skills, your marital status, your nationality, your NI number, your job title and your CV.

If you give us personal information on behalf of a third party, for example an employee, contractor or client, in providing that information to us you are confirming that you have sought and obtained, from that individual, permission for you to:

Consent on their behalf to the processing of their personal data;
Receive on their behalf any data protection notices; and
If relevant, consent to the transfer of their personal data abroad,

and you shall indemnify us and hold us harmless against any claims, actions, proceedings, losses, damages, costs (including reasonable legal costs) and expenses (including taxation), in each case of any nature whatsoever, arising out of or in connection with your failure to obtain these permissions.

More particularly, the personal information that we collect depends on the context of your interactions with us, the choices you make and the products and features you use. For example:

We collect personal information via the Estratos Platform when you sign up to, participate in, use or receive a service from us, for example where you use the Estratos Platform, contact us, request information online, report an issue or provide feedback.
Our website also uses cookies and collects IP addresses (for more information on this, see our Cookie Policy).
We may monitor and record communications with you (such as telephone conversations and emails). We may do this for a number of reasons, such as to check the quality of our customer service, for training purposes, to prevent fraud or to make sure we are complying with legal requirements.
If you visit our offices, some personal data may also be collected from monitoring devices and systems such as access cards.

Unless otherwise specified, all personal information requested by us is mandatory and failure to provide this information may make it impossible for us to provide our services. In cases where we specifically state that some personal information is not mandatory, you are free not to provide this personal information without consequences to the availability or the functioning of the Estratos Services.

(b) The types of personal information we may collect

When you use the Estratos Services and/or when you otherwise deal with us, we may collect the following information about you (the Information):

Identity Data, which includes your first name and last name.
Contact Data, which means the data we use to contact you including your billing address, email address and contact number.
Financial Data, which means the payment method and card association used to process subscription payments. We do not store or process your card details ourselves, they are processed and stored via one of our contracted third-party service providers. We encrypt your payment card details in your browser and securely transfer this data to our relevant third-party payment provider to process a payment.
Transaction Data, which means details about transactions you have made in connection with the Estratos Services, including the payments to and from you along with other details of products you have purchased from us.
Profile Data, which includes your username, email address and log-in data, details of any purchases or orders made by you, and your interests, preferences, feedback and survey or questionnaire responses and, in relation to job applicants, details of your next of kin, emergency/alternate contact(s) or referee(s).
Customer Content, which means the memories and other content that you, your team members or your authorised AI agents store in your workspaces, together with the version history of that content. Customer Content may include personal information about you or about individuals you choose to reference in it. Where Customer Content contains personal data about individuals other than you, we process it on behalf of the workspace customer as a processor (see paragraph 6 and our Data Processing Agreement).
Usage Data, which includes Information collected automatically through us, or via third-party service providers, about how you use the Estratos Services. This includes your browsing patterns and Information such as how long you might spend on one of our webpages on the Estratos Platform and what you look at and for, the page that referred you to the Estratos Platform and the click stream during your visit to our website, page response times, and page interaction Information (for example, clicks you make on a page).
Marketing and Communications Data, which includes your preferences with regards to receiving marketing from us and your other communication preferences.
Other Information relevant to services, customer surveys, questionnaires and/or offers.

4.2 Sensitive personal information

In Short: Occasionally we may need to ask you to provide sensitive personal data. If we do, we will explain why we are requesting it and how we will use it.

We will not usually ask you to provide sensitive personal information. We will only ask you to provide sensitive personal information if we need to for a specific reason, for example, if we believe you are having difficulty dealing with your account due to illness. If we request such information, we will explain why we are requesting it and how we will use it.

4.3 Personal information from third parties

In Short: We may receive information about you from third parties, and we may use this information to provide, improve and personalise the Estratos Services.

Occasionally we may receive information about you from other sources, which we will add to the information we already hold about you in order to help us provide, improve and personalise the Estratos Services. If you apply for a job with us, we may also receive information from those who provide references relating to your prospective or actual engagement or employment.

4.4 Information automatically collected

In Short: Some Information – such as IP addresses and/or browser and device characteristics – is collected automatically when you use the Estratos Platform.

We automatically collect certain Information when you visit, use or navigate the Estratos Platform. This Information does not reveal your specific identity (unless your device name is the same as your name) but may include device and usage Information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, Information about how and when you use the Estratos Platform and other technical Information. This Information is primarily needed to maintain the security and operation of the Estratos Platform, and for our internal analytics and reporting purposes.

We use PostHog, an analytics platform hosted in the European Union, to collect page views, click events, and browser/device information across the Estratos Platform, including both public pages and the authenticated application. PostHog is configured without cookies (memory-only persistence), so no tracking cookies are set on your device. When you are logged in, PostHog associates your activity with your user profile (email and name) to provide product analytics. We also capture server-side product analytics events (such as account creation, memory activity, and subscription changes) to understand how the platform is used and improve our service.

Like many businesses, we also collect Information through cookies and similar technologies. You can find out more about this in our Cookie Policy.

5. How We Use Your Information

In Short: We use your information to operate, maintain and improve the Estratos Services, to communicate with you, to take payment, and to comply with our legal obligations.

We use the personal information we collect for the following purposes, relying on the lawful bases indicated:

To provide and operate the Estratos Services – including creating and administering your account and workspaces, hosting the memory hierarchies, folders and layers you define, storing memories and their version history, operating the memory review workflow, generating exports you request, maintaining audit logs of workspace activity, and operating API and MCP access for the AI agents you authorise. This is necessary to perform our contract with you.
To take payment – to process subscription payments and manage billing through our payment provider. This is necessary to perform our contract with you and to comply with our legal obligations.
To communicate with you – to send service and transactional messages (such as account verification, password resets, workspace invitations, and notifications about memory review requests and workspace activity). These are necessary to perform our contract with you or are sent in our legitimate interests in keeping you informed about your account.
To understand and improve the Services – we use product analytics to understand how the Estratos Platform is used and to improve it (see paragraph 4.4 and our Cookie Policy). This is done in our legitimate interests in operating and improving our business.
To keep the Services secure – including authenticating users, supporting two-factor authentication, verifying and rate-limiting API and MCP requests, protecting against fraudulent or automated access, and monitoring for errors and abuse. This is done in our legitimate interests in protecting the Services and our users.
For marketing – to send marketing communications where we are permitted to do so (see paragraph 14). You can opt out of marketing at any time.
To comply with the law – to meet our legal and regulatory obligations, to establish, exercise or defend legal claims, and to respond to lawful requests from public authorities.

6. Information Sharing and Sub-processors

In Short: We do not sell your personal information. We share it only with the service providers (sub-processors) that help us run the Estratos Services, with the people and AI agents you authorise, and where the law requires or permits it.

We may share your personal information with:

Service providers (sub-processors) who process personal information on our behalf to provide the Estratos Services, including hosting and infrastructure, file storage, payment processing, email delivery, product analytics, error monitoring, content delivery, and bot protection. A current list of these sub-processors, together with their purpose and location, is maintained at estratos.ai/legal/sub-processors. These providers are only permitted to use your personal information as necessary to provide their services to us.
Other users of your workspace – where a Subscription customer grants access to a workspace to their team members, those members may see personal information within that workspace (including memory content and its version history) as part of using the Estratos Services.
AI agents you authorise – where you or your workspace administrators connect an AI agent to a workspace, that agent can read the memory content its authorisation covers (see paragraph 7).
Professional advisers and authorities – including our legal, accounting and insurance advisers, and regulators, law enforcement or other authorities, where we are required or permitted to do so by law.
A buyer or successor – if we sell, transfer or reorganise our business or assets, in which case personal information may be transferred as part of that transaction (see clause 1.7 of our Terms of Service).

Where we process customer data on behalf of a Subscription customer (for example, personal data included in the memory content stored in their workspaces and its version history), we act as a processor and the customer acts as the controller. Those arrangements are governed by our Data Processing Agreement.

7. AI Agents Connected to Your Workspace

In Short: You can connect AI agents to your workspaces via OAuth and MCP. Those agents act on your instructions, and their providers are not our sub-processors.

The Estratos Platform is designed to give AI agents and developer tools (for example, Claude, Codex or GitHub Copilot) access to the memories stored in your workspaces. You (or your workspace administrators) connect an agent by granting it an OAuth authorisation scoped to your workspace, after which the agent can read and write memories through our API and the Model Context Protocol (MCP), subject to the scopes you approve.

When an agent you have authorised retrieves memory content, that content is transmitted to the agent and processed by the agent’s provider on your (or your organisation’s) instructions and under your agreement with that provider – not ours. Agent providers are independent services engaged by you: they are not WLS Labs sub-processors, and this Policy does not govern their processing. We encourage you to review the privacy terms of any agent provider before connecting it.

You can review and revoke the agents you connected from Settings › Account. A workspace Owner or Admin can also review and revoke sessions across that workspace from Connect › Active sessions. Revoking an authorisation stops the agent from making further requests, but it does not delete copies of content that the agent’s provider already received on your instructions – you would need to contact that provider directly.

8. International Transfers

In Short: Some of our service providers are located outside the United Kingdom. Where personal information is transferred internationally, we put appropriate safeguards in place.

Our hosting infrastructure is provided within the European Union, and our product analytics provider is hosted in the European Union. Some of our other sub-processors – including providers of deployment, payment processing, email delivery, error monitoring, content delivery and font delivery – are located in the United States or operate globally. Where we transfer personal information outside the United Kingdom, we rely on appropriate safeguards recognised under UK data protection law, such as the UK-US Data Bridge (UK Extension to the EU-US Data Privacy Framework) where the recipient is certified, or the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. Further detail of the locations of our sub-processors is set out at estratos.ai/legal/sub-processors.

9. Third-party Websites

In Short: The Estratos Platform may contain links to third-party websites we do not control.

The Estratos Platform may contain links to, and content from, websites, applications and services that are not operated by us. This Policy does not apply to those third parties, and we are not responsible for their content or privacy practices. We encourage you to read the privacy notices of any third-party websites you visit. Your dealings with third-party websites are also subject to clause 5 (Third-Party Websites & Resources) of our Terms of Service.

10. Data Retention

In Short: We keep your personal information only for as long as we need it, and delete it when you close your account.

We retain your personal information for as long as your account is active and as needed to provide you with the Estratos Services. Within a workspace, memories are version-controlled: editing a memory creates a new version, and earlier versions remain available to workspace members until the memory, workspace or account they belong to is deleted. You can export your memories from your workspace settings at any time, and you can delete your account, or an individual workspace, from within your settings.

When an account or workspace is deleted, the associated data – including the memories stored within it, their full version history, and any exports or files generated from it – is removed from the Estratos Platform, and the underlying files held by our storage provider are deleted as part of that process. As described in clause 9.5 of our Terms of Service, data is permanently deleted from our backups and logs within 30 days of cancellation or termination, after which it cannot be recovered.

We may retain certain information for longer where we are required to do so to comply with our legal, accounting, tax or regulatory obligations (for example, records relating to payments), or where necessary to establish, exercise or defend legal claims.

11. Security

In Short: We take appropriate technical and organisational measures to protect your personal information.

We implement appropriate technical and organisational measures designed to protect your personal information against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures include encryption of data in transit using industry-standard TLS, encryption of particularly sensitive fields (such as two-factor authentication secrets) at rest, enforced row-level tenant isolation in our database so that each workspace’s data is segregated, role-based access controls, audit logging of workspace activity, optional two-factor authentication for your account, and error and security monitoring. The specific measures we apply when processing customer data on behalf of our customers are described in Schedule 2 of our Data Processing Agreement.

No method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials, API keys and agent authorisations confidential, and we encourage you to enable two-factor authentication.

12. Children and Minors

In Short: The Estratos Services are not directed at children.

The Estratos Services are intended for use by businesses and are not directed at children. We do not knowingly collect personal information from anyone under the age of 16. If you believe that we may have collected personal information from a child, please contact us at support@estratos.ai and we will take steps to delete it.

13. Consent

In Short: Where we rely on your consent to process your personal information, you can withdraw it at any time.

We rely on your consent for certain limited processing, such as the sending of marketing communications where consent is required. The Estratos Platform sets strictly necessary cookies only and does not set non-essential cookies (see our Cookie Policy). Where we rely on your consent, you may withdraw it at any time – for example, by adjusting your communication preferences in your account settings or by contacting us at support@estratos.ai. Withdrawing your consent does not affect the lawfulness of any processing carried out before you withdrew it.

14. Marketing

In Short: We will only send you marketing communications where we are permitted to, and you can opt out at any time.

We may send you marketing communications about the Estratos Services where we are permitted to do so by law. We do not currently use advertising or conversion-tracking cookies on our website (see our Cookie Policy). Service and transactional messages (such as password resets, workspace invitations and notifications about memory review requests) are not marketing and are sent as part of providing the Estratos Services. You can opt out of marketing communications at any time through your account settings or by contacting us at support@estratos.ai.

15. Account Information

In Short: You can review and update much of your personal information directly within the Estratos Platform.

You can review and change the personal information in your account – including your name, email address, communication preferences and security settings – at any time through your account and profile settings within the Estratos Platform. If you wish to close your account, you can do so from your account settings, and the associated data will be deleted as described in paragraph 10.

16. Your Privacy Rights

In Short: Under UK data protection law you have a number of rights in relation to your personal information.

Subject to certain conditions and exceptions under the UK GDPR and the Data Protection Act 2018, you have the right to:

request access to the personal information we hold about you;
request that we correct any inaccurate or incomplete personal information;
request that we delete your personal information;
request that we restrict the processing of your personal information;
object to our processing of your personal information;
request the transfer of your personal information to you or another controller (data portability); and
where we rely on your consent, withdraw that consent at any time.

Where the personal information relates to an individual referenced in memory content stored in a customer’s workspace, our customer is the controller of that information, and you should direct your request to them; we will assist them in responding as set out in our Data Processing Agreement. To exercise any of your rights, please contact us at support@estratos.ai. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at ico.org.uk, although we would encourage you to contact us first so that we can try to resolve your concern.

17. Vulnerability Disclosure

In Short: If you discover a security vulnerability, please report it to us responsibly.

We welcome reports from security researchers and others who identify potential security vulnerabilities in the Estratos Services. If you believe you have found a vulnerability, please report it to us at support@estratos.ai with enough detail for us to reproduce it, and give us a reasonable opportunity to investigate and remediate the issue before any public disclosure. Please do not access, modify or delete data that does not belong to you, and do not degrade the availability of the Services, while testing. We will acknowledge legitimate reports and work to address confirmed vulnerabilities promptly.

18. Contact Details

In Short: If you have any questions about this Policy or your personal information, please contact us.

If you have any questions or concerns about this Policy, or wish to exercise any of your rights, please contact us using the details below. WLS Labs Ltd is the controller of your personal information.

WLS Labs Ltd, a company registered in England and Wales with company number 15609221, whose registered office is at 66 Paul Street, London, England, EC2A 4NA.
Email: support@estratos.ai