Privacy Policy

1. Who we are

Struth is operated by Ninja AI Labs Pty Ltd (ABN 96 688 779 393, ACN 688 779 393), Australia. This policy covers the Struth website, apps and services. Contact us at hello@struth.app about your information or this policy.

If a business uses Struth to manage information about you, that business also controls how it uses your information. You can contact it directly or ask us to help identify the right contact.

2. Information we collect

We collect information you provide when you create an account, contact us or use Struth. This can include your name, work contact details, business details, account settings and support messages.

We also collect the records you add to your business account: customer and supplier details, job addresses, quotes, invoices, payments, appointments, documents, photos, messages and other files. Voice and phone features can process audio, recordings, transcripts and call details. Device permissions control access to features such as the microphone, camera and location.

We collect technical information such as IP addresses, browser and device details, activity records and error reports to operate and protect the service. Payment providers process card details; Struth receives payment status and transaction details.

3. Connected email and calendars

Connecting a Google or Microsoft account is optional. When an integration is available and you choose to connect it, the provider shows the permissions Struth requests. The access you grant determines what Struth can do. Signing in to Struth alone does not grant access to your mailbox.

Email permissions can allow Struth to read message bodies, subjects, sender and recipient details, timestamps and attachments; organise messages; and send messages on your behalf. Calendar permissions can allow it to read availability and event details, including attendees and locations, and create, update or remove events. We request only the permissions needed for the features you use.

We use this access to show and synchronise information in Struth, link correspondence to customer and job records, prepare and send replies, check availability and manage bookings. Where you enable AI features, relevant email or calendar content can also be processed as described below.

We store connection details and authorisation tokens so a connected feature can continue working while you are away. Tokens let Struth use the access you granted without collecting your Google or Microsoft password.

The existing Google Calendar connection manages a separate calendar created by Struth. That permission does not let Struth read your other Google calendars. Broader mailbox or calendar features require their own permissions; their description here does not mean they are available on every account.

4. How we use information

We use information to provide the features you use, maintain your business records, process transactions, communicate with you, provide support, prevent misuse and investigate faults. We also use service activity and feedback to understand which parts of Struth need improvement.

Information saved in a business account may be accessible to its authorised team members according to their permissions. Only connect an account or upload records you are authorised to share with that business.

We do not sell personal information. We do not use Google or Microsoft mailbox or calendar data for advertising, credit assessments or unrelated profiling.

5. AI processing

Struth uses AI to carry out features such as identifying enquiries, extracting details from documents, summarising conversations, drafting replies and answering questions about your work. These features can send relevant text, attachments, audio or business records to an AI service provider, including OpenAI. The provider processes that information to return a result to Struth.

We do not use data obtained through Google or Microsoft email and calendar integrations to train or improve general-purpose AI models. We require providers processing that connected data on our behalf to follow the same restriction. Using an AI model to generate a response is different from training the model.

AI results can contain mistakes. Review drafts, extracted details and proposed actions before relying on them, especially where they affect a customer, a booking or a payment.

6. Sharing and human access

We share information with providers needed to deliver Struth, such as hosting and file storage, payments, email and SMS delivery, phone services, AI processing and support. We limit what we share to the relevant purpose. If you connect another service, we send it the information needed for the connection and the actions you authorise.

For Google data, transfers are limited to providing or improving the features you authorised, security purposes, legal requirements, or a business transfer with your explicit prior consent. These restrictions also apply to information derived from Google data.

Our staff and contractors may access personal information where needed for authorised support, security or legal obligations. Human access to Google user data is limited to your documented consent for specific data, necessary security or legal work, or aggregated and anonymised information used for internal operations where permitted by Google's policy.

We may disclose other information when required by law, to protect legal rights or investigate misuse, or as part of a business transfer subject to the applicable privacy requirements.

7. Storage and security

Struth uses hosting and storage in Australia. Some service providers, including AI, communications and cloud providers, may process or store information outside Australia, including in the United States. Connecting a Google or Microsoft account also involves the infrastructure operated by that provider. Australian hosting does not mean all processing stays in Australia.

We use safeguards appropriate to the information and service, including access controls, encrypted connections and encrypted storage of Google Calendar authorisation tokens. No online service can guarantee that information will never be lost or accessed without permission.

8. Retention, disconnection and deletion

We keep business records while they are needed to provide your account and the features you use. Retention also depends on the type of information, your deletion requests, accounting or legal obligations, security investigations and disputes. We delete or de-identify information when it is no longer needed for those purposes.

You can disconnect an available integration in Struth or revoke access through Google account connections. For Microsoft, use personal account permissions or My Apps for work and school accounts. Disconnection stops further synchronisation through that connection. It does not automatically delete messages, job records, bookings or summaries already saved in Struth. You can ask us to delete those copies separately.

For Microsoft API data, retained copies must reflect relevant corrections, restrictions and deletions in the connected source. Closing or abandoning an account requires deletion of the Microsoft API data associated with it, subject to applicable legal requirements. Disconnecting a single integration is separate from closing your Struth account.

Disconnecting Struth's existing Google Calendar integration also attempts to remove the separate calendar it created in Google. Appointments already recorded in Struth remain in Struth.

To request deletion of personal information, imported email or calendar data, or an account, email hello@struth.app. We may need to verify your identity and authority over a business account. We will explain any information we must retain and why. Backup copies may remain until they are replaced through the backup cycle; they are not used as active business records.

9. Access, correction and your choices

You can update information available in your account and use the export options provided by Struth. Contact us to request access to, correction of, or deletion of other personal information we hold about you. If we cannot fulfil a request, we will explain the reason and the options available to you.

You can choose not to connect external accounts and can control device permissions in your device settings. Features that need the withheld information or permission may not work. Contact us if you need help finding a setting or making a request.

10. Cookies and communications

We use cookies and similar storage for functions such as keeping you signed in and remembering settings. We also collect technical activity and error information to understand and maintain the service.

We may send service messages about your account, security, billing and product changes. If we send marketing emails, you can unsubscribe using the link in the message. Unsubscribing from marketing does not stop essential account messages.

11. Google API data

Our use and transfer of information received from Google APIs comply with the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements. These limits apply even where another part of this policy describes a broader use of other information.

12. Questions, complaints and changes

Email hello@struth.app with privacy questions, requests or complaints. For a complaint, tell us what happened and how we can contact you. We will investigate, contact you if we need more information, and aim to respond within 30 days. If more time is needed, we will explain why.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner. Other rights may apply under the law where you live.

We update this policy when our practices change. The date above identifies the current version. We will give notice of material changes through Struth or by email where appropriate, and seek additional consent where required.