Data and security
Where your business data is stored
Your account, conversations, company profile and decision ledger are stored with Supabase in the EU. For each answer, your question, your profile and your attachments go to the Claude API from Anthropic in the US, which generates the answer. No AI model is trained on your data: not by us, and Anthropic is barred from it by contract. You can export your data and delete your account yourself at any time.
This page explains the main points in plain language. The legally binding text is the privacy policy.
Which service does what
The answers themselves are generated in the US. The privacy policy has the full details, and anyone who uploads contracts or employee data should read it first.
No training on your data
Your questions, answers, files, profile and ledger are not used to train an AI model. That holds in two places, and in both it is a rule, not an intention:
Anthropic may not train models on Customer Content from Services.The processing itself is governed by Anthropic's data processing agreement, which is part of those terms. Read the terms
What this does not mean: Anthropic stores inputs and outputs for a limited time, for example to detect abuse. We have no access to those copies. The retention periods are in Anthropic's own privacy documentation, which is linked in the privacy policy.
Data processing agreement (DPA)
If you upload documents that contain names of employees, customers or vendors, ChiefBoard processes that data on your behalf. You can get a data processing agreement from us for this, at no extra cost and on every plan. The subprocessors named in it are the services in the table above.
What we do not do
- We do not sell data and do not pass anything to advertising networks.
- We do not train any AI model on your content.
- Traffic measurement sets no cookies and builds no cross-device profiles. Marketing scripts load only after you consent.
- ChiefBoard makes no automated decisions with legal effect. The answers are decision support, and the decision stays with you.
- ChiefBoard is not licensed legal, tax or investment advice.
Frequently asked questions
Where is my data stored and who processes it?
ChiefBoard is operated by Lucas Gruber in Friedberg, Bavaria, Germany. Your account and content are stored with Supabase in the EU. To generate an answer, your question and attachments are sent to Anthropic in the US. Hosting runs on Vercel and Render, also in the US, and payments on Stripe. The privacy policy has the full details. If you handle especially sensitive data, check with your own counsel before uploading it.
Is my data used to train the AI?
No. ChiefBoard does not train any model and does not pass your content to anyone who does. Anthropic, which generates the answers, is barred by its commercial terms from training models on customer content; that is a contract rule, not a self-declaration. You can find the wording and the link further up on this page.
Can I get a data processing agreement (DPA)?
Yes, on every plan and at no extra cost. You need one as soon as you upload documents with names of employees, customers or vendors. The subprocessors in it are Supabase, Anthropic, Vercel, Render and Stripe, with purpose and location as in the table above.
Who can read my conversations?
Only you, and in a team the people you explicitly share a company with, and even there the chats stay private; only the ledger, profile and scenarios are shared. If you invite an advisor, for example your accountant, they can read the profile and ledger and write notes on decisions, but they cannot read chats or change anything. You can remove them at any time. Technically, the database enforces this: every query is tied to your account, not to the interface.
What happens to uploaded files?
An uploaded file goes to Anthropic for analysis. We do not store it; only your text remains in the conversation. We have no access to what Anthropic retains.
How long is my data stored?
Account and content for as long as your account exists; chat messages are deleted automatically after 24 months. Invoices must be kept for up to ten years under German tax and commercial law and are locked for any other use.
How do I delete everything?
In the account menu under “Your data”: there you can export your data, delete individual company details that were found, or delete the whole account. Deletion runs after a seven-day grace period and is complete within 30 days.
What happens to the questions I ask without an account?
For the 3 free answers, the sign-in service creates an anonymous account with no email address. If you do not create a real account within 7 days, it is deleted along with the conversation. To keep the free answers from being bypassed with an endless stream of guest accounts, we store an obfuscated value of your IP address for each answer, with no content, and delete it after 30 days.
Does ChiefBoard read my website?
Only when you start the research on your own company and have first confirmed that you own the domain. The bot respects robots.txt, reads a few pages of the same domain and does not evaluate any information about individuals.