Privacy Policy

Draft — must be completed before launch. This page is a structural skeleton, not binding legal text. It must be completed or drafted by qualified counsel before the service is offered commercially in the EU.

1. Controller and contact

TODO: Name the controller, postal address and a data-protection contact; add a DPO if one is appointed.

2. What we process

Account and profile — email, display name, professional role, organisation, optional LinkedIn URL, verification status.
Use-case content — the descriptions and documents you submit for analysis, and the answers you give in the guided workflow.
Contribution and credit records — validations, proposals, reviews and the append-only credit ledger.
Payments — pack, amount, currency, status, billing country and the payment provider's session identifiers. Card data is never seen or stored by this service; it is processed by the payment provider.
Anonymised submission log — when you analyse a use case on /describe or generate a dossier in the guided workflow, we store the description you submitted, the answers you gave, the target markets you selected, the derived outcome (risk class, outcome state, matched catalogue case, confidence) and the graph version. This record is anonymous: it carries no account reference, no IP address and no session identifier, and it stays anonymous when you are signed in. A reference to your account is stored only if you tick the optional catalogue-contribution box in the workflow — that tick is the only thing that links a submission to you, and it is off by default. The log is readable by platform administrators only, and is used to improve the knowledge graph and the question sequence. Retention: the free-text description is automatically replaced by “[redacted after retention period]” 12 months after submission, while the structured fields (answers, target markets, derived outcome, graph version) are kept for statistics. The reason is that the free text is typed by you and can contain personal data, whereas the structured signal cannot — so the raw text is not kept indefinitely, the signal is. A platform administrator can additionally delete an individual submission at any time; the deletion and its mandatory reason are recorded in the append-only audit log. A submission may also be promoted into the curator proposal queue as a use-case candidate; the proposal then carries the submission content without any account reference.
Stack playground shares — assembling and deriving in the public stack playground (/playground) runs entirely in your browser — nothing is transmitted or stored. Only when you click “Share this stack” do we store the chosen component set, the target markets, the best use-case match and your optional note (max. 500 characters), together with an anonymous session id generated in your browser. No account reference and no IP address are stored, even when you are signed in. Retention mirrors the anonymised submission log: your note is automatically redacted after 12 months while the structured signal is kept for statistics. Curators can aggregate recurring combinations into knowledge-graph proposals; these carry the component combination and the note texts, never an identity.
Technical logs — request metadata needed to operate and secure the service.

3. Legal bases

TODO: Map each purpose to Art. 6(1) GDPR (contract for the service and purchases, legitimate interest for security, consent where applicable) and document the assessment.

4. Processors and third countries

TODO: List hosting, database/auth, payment and AI-inference providers with their roles, locations and transfer mechanism; confirm the data-processing agreements are in place.

5. AI processing of your input

Answered from the code, not from intent. There are two different paths and they must not be confused:

The quick description path (/describe) runs entirely in your browser. The text and any file you drop are parsed, matched against the knowledge graph and turned into a result locally. The text is not sent to this service and not sent to any model provider.
The research and analysis paths that explicitly say so — deep search, source scraping and the assisted extraction used by curators — do call external services (a search and scraping provider, and an AI inference gateway) with the text you supply for that action. Those calls happen only when you trigger them.
No training. Content you submit is not used to train models. Intermediate results are kept only as long as the request needs them; what is stored is the outcome you chose to save.

TODO: Name the search/scraping provider and the inference gateway with their locations and transfer mechanism once the data-processing agreements are countersigned.

6. Retention and deletion

You can delete your account yourself, at any time, from Account & deletion in the account menu. Deletion is immediate and permanent. It erases your profile, saved analyses, tracked use cases, expert-review requests including the free-text descriptions of your systems in their snapshots, generated dossiers, proposals, validations, peer reviews, comments, team memberships and pending team invitations, and withdraws any testimonial.

Two categories are retained without your identity: credit-ledger entries and purchase records. They are kept because financial and tax records carry a statutory retention period that overrides an erasure request; your user reference is removed and replaced by an anonymous tombstone tag, so the records remain accountable as figures without identifying you. Published community releases keep the change they contained, without naming you.

TODO: State the applicable statutory retention period in years for the jurisdiction of the controller, and the retention period for technical logs.

7. Your rights

TODO: Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the competent supervisory authority.

8. Cookies and local storage

The service stores a sign-in session, your saved workflow draft, and interface preferences (theme, density, market selection, dismissed hints) in your browser. All of it is either strictly necessary for a function you asked for or a preference you set; none of it is advertising or cross-site tracking.

TODO: Confirm the consent assessment for the preference storage with counsel and list the named keys if the final policy requires that level of detail.