Privacy policy
Last updated: 23 October 2026
We collect as little personal data as we can, use it only to run Structrl well, and never sell it. This policy explains what we process, why, and what your rights are, wherever you live.
1. Who is responsible
Structrl, Madeliefje 1, 7463 ED Rijssen, The Netherlands, KvK 67721540, is responsible for the processing described in this policy (the "controller"). Questions or requests: [email protected].
2. What this policy covers
- our website structrl.dev, including the live demo and the waitlist;
- downloading Structrl, and the desktop app's update checks;
- e-mail and support.
3. Structrl you run yourself
The desktop app, the CLI and self-hosted installations run on your own computer or server. Your code, specs, runs, prompts and accounts stay there: they don't reach us, and we can't see them. Whoever runs an installation decides how it processes data. We only receive:
- the desktop app's update check (when it starts and every 6 hours: its version and platform, plus your IP address, which every internet request carries), served from structrl.dev (hosted by Cloudflare) and GitHub;
- anonymous usage statistics, only if an administrator switches them on (off by default).
The installers and Docker images are downloaded from GitHub (github.com and ghcr.io, run by GitHub, Inc.). GitHub processes your download requests as an independent controller under the GitHub Privacy Statement.
4. What we process and why
| Purpose | Personal data | Legal basis | How long we keep it |
|---|---|---|---|
| Waitlist (only if you sign up) | Your e-mail address, what you asked to hear about (Structrl Cloud, team plans), when you signed up | Your consent (art. 6(1)(a)), given by signing up; we e-mail you once, when it launches | Until you unsubscribe (the launch e-mail has a link, or e-mail us), and at the latest 6 months after the launch e-mail |
| Running the website and update checks: security, abuse prevention, troubleshooting | IP address, browser or app version, requested page, time; for the desktop app's update checks, its version and platform. For the waitlist's abuse protection, a daily-changing hash of your IP address (not the address itself) | Legitimate interest in a secure, working website and safe updates (art. 6(1)(f)) | Processed by our hosting provider (Cloudflare) to deliver and protect the site; we keep no access logs. The waitlist hash: 24 hours |
| Support and questions | Your messages and contact details | Legitimate interest in answering you, or the contract if you're a customer | Up to 2 years after the conversation ends |
| Website analytics (structrl.dev only) | Pages visited, referrer, device and approximate location, via Google Analytics cookies | Your consent (art. 6(1)(a)); off until you allow it | 14 months in Google Analytics |
We don't use your data for automated decisions with legal or similarly significant effects, we don't sell it or share it for advertising, and we don't use it to train AI models.
5. Your AI models and keys
Structrl works with the model providers you choose and pay for yourself ("bring your own key"), such as OpenRouter or a model you host. When a run executes, the relevant code, specs and prompts are sent from your installation to the model provider you configured. That provider processes the data under its own terms and privacy policy, not ours; please check them, especially if your code contains personal data. With a local model, nothing leaves your computer.
6. Who receives data
We share data only with service providers that help us run Structrl (for example hosting), under contracts that oblige them to protect it and use it only on our instructions. They are listed on the Subprocessors page. We also share data when the law requires it.
7. Transfers outside the European Economic Area
Our website is delivered by Cloudflare's worldwide network, close to each visitor; the waitlist is stored in the European Union. Some providers (such as Cloudflare, Google) may process data in the United States. Where that happens, we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses with additional safeguards.
8. Cookies
The website uses only necessary cookies (such as remembering your cookie choice), plus Google Analytics if you allow it. A browser that sends a Global Privacy Control signal is treated as a "no". See the Cookie policy for the details, and change your choice any time in Cookie settings.
9. Security
We protect data with encryption in transit (TLS), least-privilege access, security logging and short retention. If a data breach is likely to put your rights at risk, we notify the Dutch Data Protection Authority and, where required, you.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and receive a copy;
- have incorrect data corrected, and data deleted ("right to be forgotten");
- restrict processing, and object to processing based on our legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time (the waitlist: the link in every e-mail; analytics: Cookie settings), without affecting processing before that.
For anything else, e-mail [email protected]. We answer within one month and may ask you to confirm your identity.
You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country. We'd appreciate the chance to help first.
11. If you live outside the EU
We apply this policy, and the rights above, to everyone, wherever they live. In addition:
- United Kingdom: the UK GDPR gives you the same rights; you can complain to the Information Commissioner's Office (ICO).
- California and other US states: you have the right to know what we collect (this policy), to access, correct and delete it, and not to be discriminated against for using these rights. We don't sell personal information and don't share it for cross-context behavioral advertising, so there is nothing to opt out of; we also honor Global Privacy Control. The categories we collect are identifiers (e-mail and IP address), internet activity (pages visited, with consent) and, if you write to us, your messages.
- Elsewhere: e-mail us with any request under your local law, and we'll help.
12. Children
Structrl is a tool for professionals and is not intended for anyone under 16. We don't knowingly collect their data.
13. Changes
We update this policy when our processing changes, for example when Structrl Cloud launches. The date at the top shows the latest version.