Privacy Policy

1. Data Controller

The controller responsible for data processing on this website is:

Lucas Gruber
Eberlestraße 14, 86316 Friedberg, Germany
Email: lucas@trychiefboard.com
Phone: +49 1522 5755905

2. What data we collect

When using ChiefBoard, the following data is processed:

• Email address: for account creation and sign-in
• Questions without an account: if you ask a question on the start page without creating an account, our authentication provider Supabase creates an anonymous account without an email address so that question and answer stay together. If you do not create an account within 7 days, we delete it together with the conversation. Legal basis: steps prior to a contract (Art. 6(1)(b) GDPR). So that the free answers cannot be bypassed by creating guest accounts over and over, we store a pseudonymised hash of the IP address in the security log for each guest answer, without any content, deleted after 30 days (Art. 6(1)(f) GDPR)
• Sign in with Google: only if you choose “Continue with Google”: Google sends us your email address, your name and, where available, your profile picture. We never see your Google password. Legal basis is the contract for your account (Art. 6(1)(b) GDPR)
• Name: optional, for personalization
• Business profile data: company size, industry, goals (voluntary)
• Chat content: questions and answers. Transmitted to Anthropic’s Claude API for processing and stored in your account
• Uploaded files: PDFs, images and text files you attach to a question. Transmitted to Anthropic for analysis
• Decision ledger: decisions you record, together with reasoning, owners and review dates
• Company profile research: only on your request and only for your own, verified company: public information about the company from your website and a web search (e.g. legal form, locations, services), each with its source. No information about individuals; email addresses and phone numbers are removed before analysis. Legal basis: your consent (Art. 6(1)(a) GDPR), revocable at any time. Suggestions you do not confirm are deleted after 30 days
• Feedback on answers: your rating of individual answers with an optional comment, so future answers fit better. Deleted with your account or after 24 months
• Teams: if you use a team: who belongs to it with which role, and the email addresses of invited people. Invitation links are valid for 7 days, we only store a check value of them, and invitations are deleted 30 days after they were accepted or expired. Members see the shared businesses with their decision ledger and company profile, but never your chats. Legal basis is the contract with the account that created the team (Art. 6(1)(b) and (f) GDPR)
• Advisor access: if you invite an advisor (for example your accountant): their email address, their notes on your decisions and when access was granted. The advisor reads the profile and ledger of the shared business, but never your chats. Invitations are valid for 7 days. You can revoke access at any time. Legal basis is the contract for your account (Art. 6(1)(b) GDPR)
• Weekly brief: a weekly summary of your ledger, stored for 12 weeks. For the short assessment these facts are sent to Anthropic. You can unsubscribe from the email in the settings. Legal basis is the contract for your account (Art. 6(1)(b) GDPR)
• Support chat: your messages to us and our replies, stored in your account and deleted with it. Legal basis is the contract for your account (Art. 6(1)(b) GDPR)
• Calendar feed: on request we generate a secret subscription URL for your review dates
• Payment data: plan, subscription status and invoices (card details are processed solely by Stripe; we never see them)
• Contact requests: name, email, company and message when you use the contact form. Deleted after 12 months
• Technical data: IP address, browser type (automatically via hosting services)
• Security log: unusual events such as very many requests in a short time, invalid sign-ins or rejected files. No content; the IP address only pseudonymised as a hash. Purpose: protecting the service against abuse (Art. 6(1)(f), Art. 32 GDPR). Deleted after 30 days

3. Purpose of data processing

• Providing and operating the ChiefBoard service
• User authentication and account management
• Personalizing AI responses based on the business profile
• Improving the service

4. Third-party providers

5. Retention and deletion

Account data and content (chat history, decisions, business profile) are stored for as long as your account exists. Chat messages are stored permanently in our database so that you can find your history again, and are automatically deleted after 24 months. You can delete your account yourself at any time; deletion executes after a 7-day cancellation window and completes within 30 days. Invoices and payment records must be retained for up to ten years under statutory bookkeeping obligations. These are blocked from all other use and deleted afterwards. Content already transmitted to Anthropic to generate a reply is additionally subject to their own retention periods, which we cannot reach. Backups are overwritten on a rolling basis.

6. Your rights

Under the GDPR you have the following rights:

• Right to access stored data
• Right to rectification of inaccurate data
• Right to erasure of your data
• Right to restriction of processing
• Right to data portability
• Right to object to processing

You can access, export and delete your data yourself at any time under “Your data” in the account menu. For anything else, contact: lucas@trychiefboard.com

7. Cookies and consent

For sign-in and your cookie choice, your browser stores technically necessary data in local storage. With your explicit consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR) we additionally set marketing cookies from Meta (Meta Pixel) and Google (Google Ads) to measure advertising effectiveness. These load only after you agree. If you decline, they are never loaded. You can withdraw your consent at any time with effect for the future:

8. Transfers to third countries

Some of our providers process data in the USA (Anthropic, Vercel, Render, and in part Stripe, Meta and Google). Transfers are based on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). Despite these measures, a level of protection equivalent to the EU cannot be guaranteed in every case.

9. Automated processing

ChiefBoard uses an AI model (Anthropic Claude) to produce strategic assessments based on your input and business profile. These outputs are decision support, not automated decisions within the meaning of Art. 22 GDPR: no decision producing legal effects concerning you is made automatically. Evaluation and implementation always remain with you.

10. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live. The authority responsible for us is:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach
www.lda.bayern.de

11. Changes

This privacy policy may be updated as needed. The current version is always available on this page.