Privacy notice

The controller for processing personal data in connection with the Service is techtropy GmbH, Am Anger 1, 87672 Roßhaupten, Germany. Contact details are listed in the legal notice.

For privacy questions, reach us at: privacy@techtropy.com.

For your account, the website and its statistics, our emails and logs, the strategy fox on the home page, support requests and the market research in Intelligence we are the controller. For your membership, your roles, the content you bring into an organization and the records of a simulation your organization is the controller. We process that data on its behalf under the data processing agreement. Questions about it go to the organization.

You give us your name and email address when you create an account, submit content or write to us. Both are required for an account. We process them to perform the contract about your account (Article 6 (1) (b) GDPR) and keep them until you delete your account. An organization may also give us your name and email address itself, to invite you, for example to a seminar. The organization is then the controller for your membership, and we process it on its behalf.

When your organization sends a support request, or you reply to one, we process your name, your email address and the text of the request in order to answer it (Article 6 (1) (b) and (f) GDPR). Your organization's administrators and our team see the request. It is deleted with the organization, or earlier on request.

Documents and strategies that an organization's teams bring into Strategy we process on the organization's behalf. When a person calls an AI feature, the text concerned goes to a model, as described under data transfer and in the AI transparency notice.

Our servers write technical data to log files. That is your IP address, browser type, the pages requested, and the date and time. We use this data only to run the Service reliably, to secure it and to detect abuse (Article 6 (1) (f) GDPR). The log files have a fixed size, and the oldest entries are overwritten continuously. Warnings and errors of the Service are also kept for 30 days, with the identifier of the account concerned.

For each day you are signed in, we store that your account was active that day, nothing more. We use it to count how many people use the Service and whether they return (Article 6 (1) (f) GDPR). The record is deleted with your account.

We count page views without cookies and without storing anything on your device. For each view we store the kind of page, the referring website, a campaign or document code carried by the link, your country, the type of device, browser and operating system, and whether you were signed in (Article 6 (1) (f) GDPR). To recognize several views on the same day, we form a pseudonym from your IP address, your browser identifier and a random value that is new each day and deleted the next. After that the pseudonym cannot be traced back to you. We never store the address or the identifier, and we never link page views to your account. The records are deleted after 25 months.

For every email we send, we store the recipient address, the subject, the kind of email and the delivery status our email provider reports. This lets us show that an email was delivered and fix problems (Article 6 (1) (f) GDPR). We delete the content as soon as the email is sent. The record is deleted after 90 days, or earlier with your account.

If you ask the strategy fox on our home page a question, we store the question, the answer, the sources named, the language, the time and your rating, to check and improve the answers (Article 6 (1) (f) GDPR). We store nothing that identifies you, neither an account nor your IP address nor a browser identifier, so we cannot relate a stored question to you or delete it for you specifically (Article 11 GDPR). Do not write personal data into a question. We hold your IP address briefly in memory only, to limit how many questions arrive at once. The records are deleted after 90 days. To limit questions per visitor and day, we also count each question without its content, with the time, the outcome and the tokens used, under the daily pseudonym described above (Article 6 (1) (f) GDPR). The count is deleted after 25 months.

The cookie notice explains which cookies we set and why.

Inside a simulation we record which pages and sections you open, when you arrived and how long you stayed, and your moves, such as a changed decision field. The other people in the simulation see which page you are on right now and whether you have gone idle. We process this on behalf of your organization, which is the controller for it and informs you about the legal basis. The organization decides whether a facilitator sees the time per page for each person or only per company. Only the simulation is recorded, nothing you do elsewhere in the Service. A simulation evaluates no person, and the organization may not use the Service to recruit, select, assess or monitor employees or job candidates, or to decide on their employment, tasks, promotion or dismissal. We delete page visits after 365 days, and all of it is deleted with your account.

Inside a simulation we record which pages and sections you open, when you arrived and how long you stayed, and your moves, such as a changed decision field or a committed period. The other people in the room and the instructor see which page you are on right now and whether you have gone idle. We process this on behalf of the organization that runs the simulation, which is the controller for it and informs you about the legal basis. It decides whether the instructor sees page visits per person or only per company. Only the simulation is recorded, nothing you do elsewhere in the Service. We delete page visits after 365 days, and all of it is deleted with your account.

If you create an agent credential or connect an app such as an AI assistant, an agent can act as you in one of your organizations. For each credential we store its name, the organization, the access it grants, its creation, last use and expiry, and the first characters and a hash of the credential, never the whole credential. We store a connected app's name, the address it returns you to and your consent, and its tokens only as hashes. The legal basis is performance of the contract about your account (Article 6 (1) (b) GDPR). Our log files record which credential a request came through but never contain the credential itself or the data sent with it. This serves to secure the Service and detect abuse (Article 6 (1) (f) GDPR). A change an agent makes in an organization names the credential it came through, which is why a revoked credential is kept. Tokens are deleted when they expire or the credential is revoked. Deleting your account or the organization deletes the credential itself. The organization's administrators see each credential's name, owner, access, creation, last use and expiry, never the credential itself, and can revoke one or not allow credentials at all.

What an agent reads goes to the app it runs in, which you or your organization chose. The app's provider is not our processor, and what happens to the data there is outside this notice.

We read public sources for the market research in Intelligence, namely news articles, company websites, job postings, public registers and companies' mandatory filings. In doing so we process the name of an article's author and the name, professional position and employer of people named in the text, together with the context in which they were published. The legal basis is our legitimate interest in verifiable market research (Article 6 (1) (f) GDPR). Recipients are our customers with access to Intelligence and the service providers named under sharing of data. We keep an entry as long as market research needs it, and source text only as long as an entry cites it. If you object, we keep your name alone, so that it is not recorded again, for as long as your objection stands. You have the rights set out below. Because informing every person individually would involve disproportionate effort, we inform you here (Article 14 (5) (b) GDPR).

We use your data to provide the Service and your account (Article 6 (1) (b) GDPR), and to communicate with you, improve the Service and detect abuse and technical problems (Article 6 (1) (f) GDPR). We make no decision by automation alone that has legal effects on you or affects you similarly significantly (Article 22 GDPR), and we do not rate individual people.

The periods are stated above with each kind of data. Backups of the Service are kept for 7 days and serve only to restore it. When you delete your account, we delete the data belonging to it unless a statutory retention duty prevents this. Content you brought into an organization stays with it.

Your data is held on servers in Germany, and our providers for hosting and email are based in the European Union. For features that use an AI model we engage a provider in the USA, which receives the text processed in each case and passes it to the provider of the model in use, which may be located in the USA or another third country. We allow only model providers that neither store the text nor use it for training. The transfer is based on the European Commission's standard contractual clauses (Article 46 (2) (c) GDPR), a copy of which we provide on request.

We share data with service providers that process it on our behalf under Article 28 GDPR, namely a hosting provider in Germany, an email delivery provider in the European Union and, for AI features, a provider in the USA that routes requests to the providers of the models in use. Where you work in an organization, its members see your name and what you bring in. Otherwise we share data only where the law requires it or to enforce our rights.

Named members of our team can open an organization to support it, to keep it secure and to set up what it has bought. We log every such access for 365 days, and the organization's administrators can read the log.

Transactional emails, such as sign-in codes and invitations, are sent for us by an email delivery provider in the European Union, which processes your email address on our behalf under Article 28 GDPR and only to deliver them. A sign-in code email also states the IP address and the time of the request, so that you can recognize a request that was not yours (Article 6 (1) (f) GDPR). We do not store these details.

The same email names the country the IP address belongs to, looked up in a database on our own server and not stored. The database is IP to Country Lite by DB-IP, Creative Commons Attribution 4.0: IP Geolocation by DB-IP.

You have the right to access your data (Article 15 GDPR), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18) and to data portability (Article 20). You can complain to a data protection supervisory authority (Article 77 GDPR), for example the one competent for us, the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

You can object at any time where we process data on the basis of our legitimate interest (Article 21 (1) GDPR), which is stated above with each kind of data. After your objection we stop, unless we demonstrate compelling legitimate grounds that override your interests or the data serves to establish or defend legal claims. An email is enough: privacy@techtropy.com.

We protect your data with technical and organizational measures under Article 32 GDPR, which the data processing agreement describes.

The version with the date stated above applies. We inform signed-in people about material changes in the Service.