Privacy notice

1. Who this notice is about, and who controls your data

This notice describes how XpertLab's OKR platform ("the platform") handles personal data belonging to platform users — people who sign in — and, in places, other individuals named in content that a platform user has typed, such as a key result owner or a reviewer.

The entity that controls this processing is [LEGAL ENTITY NAME — not yet decided], registered in [COUNTRY OF REGISTRATION — not yet decided]. Its supervisory authority for data-protection purposes is [SUPERVISORY AUTHORITY — not yet decided]. None of these three facts has been finalized yet — see the notice at the top of this page — and none should be relied on until it is.

2. Our role: controller for some data, likely processor for other data

For account and sign-in data (creating your user profile, keeping you signed in, deciding who may access the platform), we act as the controller: we decide why that data is collected and how it is used.

For the strategy content you or your organisation types into the product — objectives, key results, plan narratives, review comments, and the names of people entered into that content — the more likely legal shape is that your organisation is the controller and the platform is its processor, acting on your organisation's instructions. Which of these applies, precisely, is a determination our organisation has not yet formally made and recorded. Where this notice states a purpose or a legal basis for that content, read it as a description of what the platform technically does with it, not as a final legal classification.

3. What we collect, and why

Grouped by activity — this list mirrors what the product actually stores.

• Account and authentication. Your name, email address, whether your email is verified, an avatar image, and the tokens your identity provider issues to keep you signed in. Used to let you sign in and to identify you within the product. Legal basis (candidate): performing our contract with you — signing in is the only way to use the service.
• Platform access. Your email address on an allow-list that decides whether an account may be created at all, plus records of invitations sent and accepted. Used to control who may access a closed, invitation-based platform. Legal basis (candidate): our legitimate interest in restricting access to a business platform.
• Organisation membership and role. Which workspace(s) you belong to, your role, and any individual permission overrides, together with a record of which administrator granted them. Used for access control and to attribute cascade ownership to a real person. Legal basis (candidate): performing our contract with you and your organisation.
• OKR authoring content. The objectives, key results, strategy narrative, intake answers, chat turns, review comments, waiver and objection reasons, and score history that you or your colleagues type while using the product — including any names of people you choose to write into that text, such as a key result owner or a support-ask contact, whether or not that person is themself a platform user. Used to provide the core product: authoring, critiquing, cascading and scoring an annual OKR plan. Legal basis (candidate): performing our contract with your organisation, as described in §2 above.
• Company research and enrichment. When the product researches a client company, it may collect and quote publicly available information that names real people — company officers, executives, or authors of public pages and news articles — as part of building a company profile. These individuals are not platform users and have no direct relationship with us. Legal basis (candidate): our legitimate interest in researching publicly available business information; a formal balancing test for this specific use has not yet been completed.
• AI-assisted drafting and analysis. See §5 below — this is significant enough to describe on its own.
• Product analytics. If enabled, your internal user identifier, name and email address, your organisation, role, pages viewed and actions taken, used to understand how the product is used and to improve it. Legal basis (candidate): our legitimate interest in improving the product, though we recognise this is one of the weaker bases in this notice for directly identifying data — see §7 on your right to object.
• Support and diagnostics. If you or your organisation submit a diagnostic report, it may include your name, email, role, a description of the problem, screenshots, recent console activity, and — because the report is designed to help us reproduce a problem — the surrounding plan content and any recent AI drafting activity for that workspace. Legal basis (candidate): our legitimate interest in providing support.

We do not intentionally collect special categories of data (such as health, religious belief, or similar sensitive information, per Art. 9 GDPR). Because several of the fields above are free text written by people, we cannot rule out that such information is incidentally included in something someone chose to type; we have no automated detection or filtering for this today.

4. Who we share it with

We do not sell personal data. We share it with the following categories of recipients, each providing a service the platform relies on. We name recipients by category rather than by company, which is standard practice and, under Art. 13(1)(e) GDPR, a legally sufficient way to disclose this.

• A cloud infrastructure provider (EU-hosted). Everything the platform stores — accounts, organisations, plans, and every other record described in this notice — is hosted with a cloud infrastructure provider, in the EU (Frankfurt region), for compute, database and object storage.
• An AI model provider. See §5 — the AI-processing disclosure.
• An email delivery provider. Used to send invitations, sign-in-related mail, and other transactional email. The recipient address, relevant display names, and the message content are sent to this provider so it can deliver the message. The delivered message's headers are also visible to your own mail provider and to any relay in between, as with any email.
• A product analytics provider. Used only if analytics is enabled for your organisation (see §3 above). Configured by default to an EU processing region.
• An error-monitoring provider. Used to diagnose crashes and failed background jobs. Configured to exclude personal data from default request/user capture, though a stack trace or error message can incidentally contain fragments of data being processed at the time.

Open item — nothing here should be read as a completed legal review. We have not yet located or verified a data processing agreement, standard contractual clauses, or a sub-processor list for any of these recipients within our own records. Until that review is complete, treat this section as an accurate technical description of what is sent and to which category of recipient — not as a statement that every necessary agreement is in place.

5. AI-assisted drafting and analysis

The platform uses an AI model to help draft, critique and cascade OKR content, and to power the company-research features. When you use these features, the following may be sent to a third-party AI model provider: objective titles and rationale, key-result text and metrics, named owners you entered, your free-text instructions and chat turns, your strategy narrative, and company-profile summaries the platform has assembled.

The prompt sent to the AI model provider and the response it returns are both kept by the platform afterward, today for an indefinite period, so that a bad or unusual AI response can be investigated and so the product can fall back to a safe, deterministic result whenever the AI response cannot be used. See §6 for how we intend to shorten that window.

We do not currently state, and this notice does not claim, that the AI model provider declines to train on this content or retains nothing after processing it. Whether the provider makes either commitment is a term of a commercial agreement that has not yet been located and read within our own records. We will not publish such a claim until it has been verified against that agreement, and we will update this notice — as a new version, per the note at the top of this page — once it has been.

Every AI-generated draft, critique or cascade is reviewed and can be edited or rejected by a human before it takes effect anywhere in your organisation's plan. We are not aware of any output from this feature that would meet the bar for a decision producing a legal or similarly significant effect on a person without human involvement.

6. Where your data is processed, and for how long

Hosting and international transfers. The database, file storage and compute that store your data are hosted in the EU (Frankfurt). We have not configured, and do not currently offer, a contractual commitment to keep your data in the EU — the Frankfurt location is today's operational default, not a promise. Sending content to the AI model provider (§5) or certain other recipients (§4) may involve a transfer outside the EU; whether an adequate safeguard such as Standard Contractual Clauses is in place for that transfer is an open item we have not yet verified.

Retention today. Being direct about the current state: most of the personal data described in this notice is retained indefinitely. There is today no automated mechanism in the product that ages out or deletes account, organisation, plan, review, score or AI-trace data on a schedule. A small number of narrow exceptions exist already — for example, an unused invitation link tied to nobody is removed, and a workspace member removed from an organisation has their access revoked immediately even though records of work they did remain, attributed to them, for the organisation's own audit history.

What is changing. We are actively building automated retention tooling — starting with narrowing how long AI prompts and AI-generated responses (§5) are kept, since that is the most sensitive store in the system. This work is a rollout in progress, not yet complete and not yet turned on in production. We are not telling you that data is currently being deleted on a schedule; it is not. This section will be updated, as a new version of this notice, once a retention schedule is actually enforced — and, separately, once our organisation has determined the contractual and legal minimum periods we are required to keep customer content for, which may extend some of these windows regardless of our own preference.

7. Your rights, and being honest about what we can do today

Depending on where you are and which law applies, you may have some or all of the following rights over your personal data. We describe each honestly, including where the platform does not yet have a self-service way to exercise it.

• Access — asking what personal data we hold about you. There is no self-service export today; we can retrieve this manually if you contact us.
• Rectification — asking us to correct inaccurate data. You can correct most of what you have entered directly in the product. A correction made today will not reach historical version snapshots of a plan taken before the correction, which are kept unchanged as an audit record; we can discuss this with you if it matters for your request.
• Erasure — asking us to delete your personal data. There is no self-service account- or organisation-deletion feature today, and we would need to handle a request manually. Some records — such as a score entry or a review decision someone else relies on — cannot simply be deleted without breaking the audit history other people in your organisation depend on; our intended approach there is to remove your identifying details (name, email) while leaving the underlying record in place under a pseudonym, rather than deleting the record itself. That mechanism is not built yet.
• Restriction — asking us to pause processing of your data without deleting it. There is no dedicated "restrict processing" state in the product today; the closest available step is removing your membership from a workspace, which stops further access but does not itself change how already-stored records are processed.
• Portability — receiving your data in a structured, machine-readable format. The exports the product offers today (spreadsheet, document and slide exports) are formatted for reading a plan, not a structured personal-data export; we do not yet have the latter as a dedicated feature.
• Objection — objecting to processing based on our legitimate interest, including product analytics. There is no preference centre or opt-out control in the product today; if you object, contact us and we will act on it manually while that tooling is built.

To exercise any of these rights, or to ask a question about this notice, contact [PRIVACY CONTACT ADDRESS — not yet decided]. We do not yet have a dedicated intake form or a published response-time commitment for these requests; we will still respond, and we intend to build both.

8. Changes to this notice

Each version of this notice is a fixed, frozen document — this is version 1, effective 2026-08-24. When the text changes, we publish a new version rather than editing this one in place, and where we have a record of you having accepted a version, we will ask you to review the new one the next time that matters.