Privacy notice

The controller responsible for processing personal data in connection with the Service is techtropy GmbH, Am Anger 1, 87672 Roßhaupten, Germany. Contact details are listed in the legal notice. We have not appointed a data protection officer.

For privacy questions, reach us at: privacy@techtropy.com.

For some data we are the controller ourselves. That is your account, the website, page statistics, the email log, server logs, the strategy fox on the home page, support requests and the market research in Intelligence. For other data your organization is the controller. That is your membership, your roles, the content you bring in and the records of a simulation. We process that data on its behalf under the data processing agreement. The organization informs you about it, and questions about it go to the organization.

We process the following categories of personal data.

You give us your name and email address when you create an account, submit content or write to us. Both are required for an account. We process them to perform the contract about your account (Article 6 (1) (b) GDPR) and keep them until you delete your account. An organization may also give us your name and email address itself, to invite you, for example to a seminar. The organization is then the controller for your membership, and we process it on its behalf.

When your organization sends a support request, or you reply to one, we process your name, your email address and the text of the request in order to answer it (Article 6 (1) (b) and (f) GDPR). Your organization's administrators and our team see the request. It is deleted with the organization, or earlier on request.

For the market research in Intelligence we read public sources. These are news articles, company websites, job postings, public registers and companies' mandatory filings. In doing so we also process data of people who do not use the Service. That is the name of an article's author, and the name, position and employer of people named in the text. With an author's name we attribute an article and recognize when several articles cover the same story. We record positions only in their professional, public role. We do not rate or profile people. The legal basis is our legitimate interest in verifiable market research (Article 6 (1) (f) GDPR). We delete stored page text after a set period unless an entry in the evidence record cites it. If you object, we put your name on a suppression list so that it is not recorded again. The suppression list holds the name alone and stands as long as your objection stands.

Our servers write technical data to log files. That is your IP address, browser type, the pages requested, and the date and time. We use this data only to run the Service reliably, to secure it and to detect abuse (Article 6 (1) (f) GDPR). The log files have a fixed size, and the oldest entries are overwritten continuously.

For each day you are signed in, we store that your account was active that day. Nothing more, no pages and no actions. We use it to count how many people use the Service and whether they return (Article 6 (1) (f) GDPR). The record is deleted with your account. Inside a simulation we record more, which the paragraph on simulations explains.

We count page views without cookies and without storing anything on your device. For each view we store the kind of page, the referring website, a campaign or document code carried by the link, your country, the type of device, browser and operating system, and whether you were signed in. We read country and device type from what your browser sends with every request anyway. We read nothing more from your device. To recognize several views on the same day, we form a pseudonym from your IP address, your browser identifier and a random value that is new each day (Article 6 (1) (f) GDPR). We delete the random value the next day. After that the pseudonym cannot be traced back to you, not even across days. We never store the address or the identifier, and we never link page views to your account. From then on the records serve statistics only and are deleted after 25 months.

For every email we send, we store the recipient address, the subject, the kind of email and the delivery status our email provider reports. This lets us show that an email was delivered and fix problems. We delete the content as soon as the email is sent. The record is deleted after 90 days, or earlier with your account (Article 6 (1) (f) GDPR). We do not track whether you open an email or follow its links.

If you ask the strategy fox on our home page a question, we store the question, the answer, the sources named, the language, the time and your rating as helpful or not helpful. This is how we check and improve the answers (Article 6 (1) (f) GDPR). We store nothing that identifies you, neither an account nor your IP address nor a browser identifier. We hold your IP address briefly in memory only, to limit how many questions arrive at once. We delete the records after 90 days. Do not write personal data into a question. We cannot relate a stored question to you and therefore cannot delete it for you specifically. To limit questions per visitor and day, we also count each question without its content, with the time, the outcome and the tokens used, under the daily pseudonym described above (Article 6 (1) (f) GDPR). After that day the count can no longer be related to anyone and serves statistics only. It is deleted after 25 months.

Inside a simulation we record how the room works. We store which pages and sections of the simulation you open, when you arrived and how long you stayed. We also store your moves, such as a changed decision field or a committed period. The other people in the room and the instructor also see which page you are on right now and whether you have gone idle. We process this on behalf of the organization that runs the simulation, so that its instructor can run the seminar. The organization is the controller for it. It decides whether the instructor sees page visits per person or only per company, and it informs you about the legal basis. We ourselves receive only totals that name nobody, to improve the simulation. The data processing agreement provides for this. Only the simulation is recorded, nothing you do elsewhere in the Service. We delete page visits after 365 days, and all of it is deleted with your account.

We use only strictly necessary cookies and preference settings you actively choose. We do not use tracking or advertising cookies. For more information, see our cookie notice.

If we hold data about you that we did not get from you but from a public source, we inform you here as Article 14 GDPR requires. The controller is the entity named in the legal notice. The purpose is market research in Intelligence. The legal basis is our legitimate interest under Article 6 (1) (f) GDPR. We process name, professional position, employer and the context in which they were published. Sources are the publication named in the entry, company websites, job postings, public registers and mandatory filings. A model drafts the entries, which the AI transparency notice describes. Recipients are our customers with access to Intelligence and the service providers named under sharing. We keep entries as long as market research needs them. The period stated above applies to page text. You have the rights set out below, in particular to access, rectification, erasure and objection. We answer a request within 30 days. Notifying every person individually would involve disproportionate effort (Article 14 (5) (b) GDPR). That is why we inform you here.

We use your data to provide the Service and your account (Article 6 (1) (b) GDPR). We also use it to communicate with you, to improve features and content, and to detect abuse and technical problems (Article 6 (1) (f) GDPR). Where processing is based on your consent (Article 6 (1) (a) GDPR), you may withdraw it at any time for the future. We do not sell your data and we do not train AI models with your content. We make no decision by automation alone that has legal effects on you or affects you similarly significantly (Article 22 GDPR). We do not rate individual people.

We keep data only as long as the stated purpose requires. After that, only as long as the law demands. The periods are stated above with each kind of data. When you delete your account, we delete the data belonging to it unless a statutory retention duty prevents this. Content you brought into an organization stays with it and is subject to its decisions. Data without an account, such as a name from an article we processed, is deleted on request, and otherwise once the purpose ends. You may request deletion of your data at any time.

Your data is held on servers in Germany. Our providers for hosting and email are based in the European Union. For features that use an AI model we engage OpenRouter Inc., New York, USA. OpenRouter receives the text processed in each case, such as an uploaded strategy document, a company's strategy in the simulation or a question to the strategy fox. OpenRouter passes the text to the provider of the model in use. That provider may be located in the USA or another third country. We allow only providers that neither store the text nor use it for training. The transfer is based on the European Commission's standard contractual clauses (Article 46 (2) (c) GDPR). OpenRouter is not certified under the EU-US Data Privacy Framework. We therefore rely on these clauses and on no provider storing the text. The AI transparency notice names the models currently in use. Any other transfer outside the EU or the European Economic Area takes place only with the safeguards of Chapter V of the GDPR.

We share data with service providers that process it on our behalf under Article 28 GDPR. For hosting that is dataforest GmbH, Kriftel, Germany. For sending emails that is AhaSend B.V., Amsterdam, Netherlands. For AI features that is OpenRouter Inc., New York, USA, together with the providers of the models in use. Where you work in an organization, its members see your name and what you bring in, as the terms of service describe. Otherwise we share data only where the law requires it or to enforce our rights. We do not share your data for advertising or analytics.

Where you work in an organization, that organization decides about the content its people put into the Service. We process it on its behalf under a data processing agreement (Article 28 GDPR).

Named members of our team can open an organization to support it, to keep it secure and to set up what it has bought. Only those who administer organizations can see its member list. Nobody on our team can sign in as you. We record every such access with the person, the organization, the time and what was done, and we keep that record for 365 days. The administrators of an organization can read it on the organization's page.

Transactional emails, such as sign-in codes and invitations, are sent for us by AhaSend B.V., Amsterdam, Netherlands. AhaSend processes your email address on our behalf under Article 28 GDPR and only to deliver these emails. A sign-in code email also states the IP address and the time of the request. This lets you recognize a request that was not yours (Article 6 (1) (f) GDPR). We do not store these details, and AhaSend uses them only for delivery. For details, see the AhaSend data processing agreement.

The same email also names the country the IP address belongs to. We look it up in a database on our own server. The address is not sent anywhere for this, and the country is not stored. The database is the free IP to Country Lite database by DB-IP under the Creative Commons Attribution 4.0 license: IP Geolocation by DB-IP.

You have the right to access your data (Article 15 GDPR), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18) and to data portability (Article 20). You can withdraw a consent at any time for the future. You can complain to a data protection supervisory authority (Article 77 GDPR). The authority competent for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany. You may also turn to the authority where you live. To exercise your rights, write to: privacy@techtropy.com.

You can object at any time where we process data on the basis of our legitimate interest (Article 21 (1) GDPR). A reason arising from your particular situation is enough. This concerns server logs, the email log, your account's daily activity marker, page statistics, the strategy fox on the home page and the market research in Intelligence. After your objection we stop processing your data. We may continue only if we demonstrate compelling legitimate grounds that override your interests, or if the data serves to establish or defend legal claims. We do not do direct marketing. An email is enough to object: privacy@techtropy.com.

We protect your data with technical and organizational measures under Article 32 GDPR. Transmission is encrypted. Sign-in uses one-time codes instead of passwords. Only people who need access have it, and every access by our team is recorded. Each organization's data is kept separate. The data processing agreement describes the measures.

Our servers stand in Frankfurt, Germany, in data centers of dataforest GmbH, Kriftel, Germany. dataforest processes data on our behalf under Article 28 GDPR. The data centers are audited under SOC 2 Type II, SOC 1 ISAE 3402 Type II, TÜV Level 3, ISO 9001:2015, EMAS and ISO 50001. How dataforest processes data is described in the dataforest privacy policy.

Our Service may contain links to other websites. We are not responsible for their privacy practices.

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We update this privacy notice when the Service or the law changes. The version with the date stated above applies. We inform signed-in people about material changes in the Service or by email.

If you have any questions about this privacy notice, contact us at: privacy@techtropy.com.