What happens to the data your agent sends

Strale goes to the source of record first: official registers and APIs, then licensed data from vendors whose terms allow resale, then direct reads of public pages, one request at a time. The rules are the same for every tool.

• No logins, no paywalls, no fake or borrowed accounts. Strale reads what is public, logged out.

• A block is an answer. A refusal, a challenge page or a robots.txt rule ends the request. Strale never solves CAPTCHAs, rotates addresses or retries a blocked request another way.

• Every request says who it is. Strale identifies itself by name in each request it sends to a website.

• No harvesting people data. Strale does not collect profiles or contact details of people. Personal data comes back only where a court or registry publishes it, as published, for the one request that asked. Sanctions, PEP and adverse-media screening runs on licensed data, for compliance checks.

• No sites that forbid automated access. Platforms that forbid it and enforce it, and commercial data aggregators, are on a blocklist Strale checks before every fetch.

• Pages your agent names are read once. When your agent asks Strale to read a page, Strale fetches that one public page for that one request, under the same rules.

For each answer, Strale records which source the data came from and how it was obtained.

You can ask for a person to review the result of any call made with an API key. Send the reason, and optionally the field you dispute, to the call’s dispute endpoint. A person at Strale reviews every dispute.

curl -X POST https://api.strale.io/v1/transactions/TRANSACTION_ID/dispute \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"reason": "The register shows this company as dissolved.", "affected_field": "status"}'

The account holder authenticates with the API key. Someone who was given the call’s shareable audit link can dispute with the link’s token instead, and adds a contact_email so Strale can reply.

GDPR Article 22 classification

Every call’s audit record states how the tool’s output relates to automated decisions about people, and gives the dispute endpoint. The customer making the call is the controller for any personal data in it; Strale processes it on the customer’s behalf.

data_lookup

Returns facts from a source, and is not a decision. 292 tools have this class.

screening_signal

Reports matches against lists or databases, such as sanctions lists. The match is a fact about the source; acting on it automatically, without review, is where Article 22 applies. Tools with this class: Adverse Media Check, Insolvency Check, PEP Check, Sanctions Check, UK Disqualified Director Check.

risk_synthesis

An AI model writes a risk summary from other checks’ results. A workflow that acts on it automatically is an automated decision under Article 22. Tools with this class: Risk Summary Writer.

A bundled check takes the highest class among its steps.