What is stored, what is never stored, who processes it — in plain words, from the code

Who is responsible

Iriska B.V., Amsterdam, runs Iriska AI and the marketplace. Your account is one account on both: one sign-in, one organisation record, one set of roles.

What is stored

• Your account: the e-mail address you sign in with (by a code, no password) — held by the sign-in service.
• Your organisation: its legal name, country, address, the roles it holds and its members — the record both products share; edited on the marketplace.
• Your workspace: its kind, language and timezone; the address for the weekly digest with its confirmation state; the three consents as dated rows; what the assistant may and may not do.
• Your place: the address you gave at registration and its coordinates — in the Netherlands from the Dutch address register, with the address's id there; elsewhere from OpenStreetMap — and, when you confirmed it through Google, its place id, nothing else from Google.
• The figures you state: each as a claim with its kind, confidence, date, and where it came from. A figure is never overwritten: restating it adds a row beside the old one, so the lineage can be followed.
• What the sources left: the peers around you from OpenStreetMap (with its attribution), the forecast, the public holidays, the country's price index and the seasonal calendar; up to five pages of your own website, kept as text.
• The documents you upload: the file itself in a private bucket (25 MB at most; PDF, spreadsheet, CSV, JPEG, PNG, HEIC, text), the text read out of it page by page, and its kind. A HEIC photo is also kept as a JPEG so it can be read.
• Voice: the transcript you edited and confirmed, which service produced it and how long the clip was — never the audio.
• The assistant: your messages and its answers, the tools it called, the tokens and the cost of every model call, in a ledger.
• What the product composed for you: the First Look's findings, the weekly digest, the review, your plan and its scenarios — each with the rows it stands on.
• A log of significant changes — what changed, when, by whom — that is never edited or deleted, and the application's own logs with a trace id.

What is never stored

• A neighbour's details from Google: not read. From Google, only your own place's id is kept; its details are shown live, when a key exists, and never written down.
• A competitor's revenue, margins or terms, or a peer's offers: the product does not have them and does not pretend to.
• Your audio: the clip goes to the transcription service and is dropped; what stays is the text you confirmed.
• A model's reading as a fact: what a model read out of a page is stored as an inference with its confidence, and marked as such until a person confirms it.
• The link token of the digest address in clear — only its hash; the link works for seven days and once.

Who processes it, and what each receives

• Supabase (Frankfurt, EU): the database, the sign-in service and the file storage. Everything above lives there, in a schema of its own behind its own role; the marketplace's own API key cannot read it.
• Vercel (Frankfurt region): the application runs there; it sees every request and keeps the application's logs.
• Anthropic: when a model key is configured, the text of a document (inside a data fence, as data, never as instructions), the image of a document for transcription, and the assistant's conversation with its context — your organisation's name, your language, your place. Every call is counted in a ledger with a cap. Model weights are never trained on it.
• Resend: when mail is configured, the weekly digest and the confirmation mail — the address and the letter's text. Without it, the letter is recorded here and not sent.
• OpenAI or Deepgram: when dictation is configured and only after your consent, the audio clip, to transcribe it; the product keeps no audio.
• Google (Places): when a key is configured, the letters you type in the street field of the registration screen (to suggest addresses — the words you pick fill the fields, nothing else is kept) and the name and city you type to find your own place; its place id is what the product keeps.
• OpenStreetMap (Photon, Overpass): the name or address you type to find your place, and the coordinates of your place to read the neighbours within a kilometre. Open-Meteo: the coordinates, for the forecast. Nager.Date and Eurostat: a country and a dataset, nothing of yours.
• Cloudflare Turnstile: a challenge on the sign-in form, when configured, to keep bots from the code.
• Sentry: named in the configuration and not yet wired — nothing is sent there today.
• PDOK (the Dutch government's service for the Kadaster's address register): the postcode and house number you type on the registration screen, asked by our server to find the address.

Export and deletion, one click each

• Export: under Settings › Privacy, one click produces a zip of every row the product holds about your organisation and every document, at a link that lives twenty-four hours.
• Deletion: one click closes the workspace at once; you have thirty days to withdraw; then every row and every file goes, and the AI ledger keeps its totals without your name. The organisation itself and its members belong to the marketplace account and are not touched.
• Consents: voice processing (yours, personal), learning contribution (off by default) and commercial introductions are dated rows you switch under Settings.

How long

• Your rows and documents: for the life of the workspace, until you delete it (thirty days' grace, then removed).
• The export link: twenty-four hours. The digest confirmation link: seven days.
• The application's logs: the hosting platform's own retention.

Learning

Model weights are never trained on your data. The learning-contribution consent is off by default, and nothing in this product processes a learning corpus today.