Privacy policy for Iriska AI

1. Who is responsible

The controller is Iriska B.V., Amsterdam, the Netherlands — registered address [to be completed: the company's registered address], registration number [to be completed: the company's registration number]. Questions about personal data go to [to be completed: the contact address for privacy matters (and, if appointed, the data protection officer)].

2. What this policy covers

This policy covers iriska.ai, the Iriska AI product. The marketplace on its own host has its own policy. The two share one account: signing up on either creates one organisation record and one login for both, so the account and organisation data below are held once, for both.

3. What we process, why, and on what basis

1. Account and sign-in — your e-mail address, the one-time code sent to it, and the session cookie. Basis: the performance of our contract with you (providing the account). Processor: the sign-in service of Supabase.
2. Your organisation — its legal name, country and address (the street, the postcode and the town you give at registration), the roles it holds (restaurant, café, hotel, shop, producer, distributor, reseller) and its members with their role. Basis: the contract. Held once for both products.
3. Your workspace — its kind, language and timezone; the address for the weekly digest, stored unconfirmed until its link is followed; three consents as dated rows; the settings that say what the assistant may do. Basis: the contract; for the digest address, your confirmation by the link.
4. The figures you state — every figure as a claim with its kind, confidence, date and origin; a figure is never overwritten, a restatement adds a row beside the old one. Basis: the contract.
5. Your place and its surroundings — the address you give at registration and its coordinates: in the Netherlands those of the Dutch address register (the BAG, through PDOK), with the address's id in that register; elsewhere those of OpenStreetMap; the peers within a kilometre from OpenStreetMap with the attribution its licence requires; the forecast; the public holidays; the country's price index; the seasonal calendar; up to five pages of your own website as text. When you pick your address from Google's suggestions, the words you picked fill the fields and nothing else from Google is kept; when you confirm your place through Google, its place id and nothing else. Basis: the contract — providing the service you registered for.
6. Documents you upload — the file in a private store (25 MB at most; PDF, spreadsheet, CSV, JPEG, PNG, HEIC, text), the text read out of it page by page, its kind; a HEIC photo also as a JPEG. When a model key is configured, the text or the image goes to Anthropic to be read or transcribed, inside a data fence, as data. Basis: the contract.
7. Dictation — only after your personal consent, the audio clip goes to the transcription service (OpenAI or Deepgram, when configured) and is dropped; what is kept is the transcript you edited and confirmed, the service's name and the clip's length. Basis: your consent, which you can withdraw under Settings.
8. The assistant — your messages and its answers, the tools it called (reading and preparing only; it never acts outside the product), the tokens and the cost of every model call in a ledger with a cap. Basis: the contract; the ledger, our legitimate interest in controlling cost and abuse.
9. What the product composes for you — the First Look's findings, the weekly digest, the review, your plan and its scenarios, each with the rows it stands on. Basis: the contract.
10. Operational records — an append-only log of significant changes (what changed, when, by whom), the queue's audit rows, the application's logs with a trace id, the sources' health probes. Basis: our legitimate interest in running the service securely and knowing why something failed.
11. Learning contribution and commercial introductions — two consents, off by default. Today nothing in the product processes a learning corpus and no introduction is made; the consents exist so that nothing happens without them.

4. Who receives data (processors and sources)

1. Supabase (database, sign-in and file storage; Frankfurt, EU) — everything above, in a schema behind its own database role; the marketplace's own API key cannot read it.
2. Vercel (hosting; Frankfurt region) — every request; the application's logs.
3. Anthropic (models) — when configured: document text and images inside a data fence, the assistant's conversation with its context (your organisation's name, language and place). Model weights are never trained on it. Transfer outside the EU: [to be completed: the transfer mechanism for processors outside the EU (to be confirmed by counsel)].
4. Resend (e-mail) — when configured: the weekly digest and the confirmation mail, to the address you set.
5. OpenAI or Deepgram (speech-to-text) — when configured and after your consent: the audio clip, to transcribe it. Transfer outside the EU: [to be completed: the transfer mechanism for processors outside the EU (to be confirmed by counsel)].
6. Google (Places) — when configured: the letters you type in the street field of the registration screen, to suggest addresses, and the name and city you type to find your own place; the place id of your own place is kept. Transfer outside the EU: [to be completed: the transfer mechanism for processors outside the EU (to be confirmed by counsel)].
7. OpenStreetMap (Photon, Overpass) — the name or address you type to find your place, and your place's coordinates. Open-Meteo — the coordinates. Nager.Date and Eurostat — a country and a dataset, nothing of yours.
8. Cloudflare (Turnstile) — when configured: a challenge on the sign-in form.
9. Sentry — named in the configuration and not wired; nothing is sent today.
10. PDOK (the Dutch government's service for the Kadaster's address register) — the postcode and house number you type on the registration screen, asked by our server, not by your browser, to find the address.

5. How long we keep it

1. Your workspace's rows and documents: for the life of the workspace. When you delete it, the workspace closes at once, you have thirty days to withdraw, and then every row and every file is removed; the AI ledger keeps its totals without your organisation, person or address.
2. The organisation record and the account itself belong to the shared identity and are not removed by a deletion here; they are managed on the marketplace.
3. The export link: twenty-four hours. The digest confirmation link: seven days, once.
4. The application's logs: [to be completed: the retention of the application's logs (set by the hosting platform; not fixed in the code)].

6. Your rights, and how the product serves them

1. Access and portability — under Settings › Privacy, one click produces a zip of every row and every document, at a link that lives twenty-four hours.
2. Erasure — one click closes the workspace; after thirty days' grace everything is removed as described above.
3. Rectification — restate a figure and the product keeps both, the new one superseding the old, so the lineage is visible; edit the organisation on the marketplace.
4. Withdrawal of consent — the three consents are switches under Settings; withdrawing has no effect on what was lawfully done before.
5. Objection and restriction — write to [to be completed: the contact address for privacy matters (and, if appointed, the data protection officer)].
6. Complaint — you may complain to [to be completed: the supervisory authority (to be confirmed by counsel)].

7. Security

Your workspace's data lives in a database schema of its own, behind a database role that reaches nothing else; every read and write runs inside a transaction scoped to your organisation by row-level security, after your membership has been checked; the marketplace's API key cannot read the schema; files live in private stores reached only through signed links; secrets never appear in the product's screens or logs; the digest link token is stored only as a hash. Model calls are counted and capped.

8. Automated decisions and the AI

The product makes no decision with legal effect on you. Its findings, scenarios and recommendations are proposals a person decides on; the assistant is an AI and says so wherever it speaks (EU AI Act, art. 50); it reads and prepares, and never acts outside the product on your behalf.

9. Changes

This is version [to be completed: the date of this version]. A change to this policy is published on this page.