DecisionHub
Privacy Policy
Last updated: July 5, 2026
DecisionHub is a decision inbox for owner-managers and their teams. This policy explains, in plain language, what we collect, why, and what we do with it. We have tried to keep it honest and short. DecisionHub is in beta, so this policy may change as the product does - we will update the date above when it does.
Who is responsible for your data
DecisionHub (“DecisionHub,” “we,” “us”) is responsible for the personal data described here. For workspace content, your organization is the owner of that data and we act as its service provider - we handle it on your behalf, under your account’s control. The operating legal entity that acts as data controller will be named here before paid plans launch.
What we collect and why
- Your account details. When you sign in with Google, we receive your name and email address so we can identify your account and your workspace membership. We do not receive your Google password.
- What you put into DecisionHub. The workspaces you create and the decision requests, context, verdicts, and notes you and your team submit. This is your content - we store it so the product works.
- Basic usage logs. Standard technical records such as request timestamps, IP address, and error logs, used to keep the service running, secure it, and diagnose problems.
- Billing details (when paid plans launch). If you subscribe, our payment processor collects the details needed to charge you. We do not store full card numbers ourselves.
Why we are allowed to use it
In plain words, we rely on a few common legal bases. We process your account and workspace data because it is necessary to provide the service you signed up for. We keep security and usage logs because we have a legitimate interest in running the service safely and reliably. We process billing data to meet our contract with you and our legal obligations. Where the law requires consent for something, we ask for it.
Where your data lives and who processes it
Your data is stored in a Postgres database managed by Supabase. To run the service we rely on a small set of trusted providers (sub-processors), each handling only what their role requires:
- Supabase - database, authentication, and hosting of your workspace content.
- Vercel - application hosting and delivery.
- Google - sign-in through Google OAuth (name and email used to authenticate you).
- Stripe - subscription billing, once paid plans launch.
- Brevo - transactional email such as invites and notifications (planned).
We keep this list current as our providers change.
International data transfers
We operate globally, and our providers may store or process data in the United States and other countries. That means your data may be transferred across borders, including out of your own country. Where required, we rely on appropriate safeguards for those transfers.
How long we keep it
We keep your workspace content for as long as your account is active. Closed decisions are retained according to your plan’s decision-history window: 30 days on Free, one year on Starter, two years on Growth, and unlimited on Business and Custom. If your paid plan ends or you move to Free, your workspace falls back to the Free retention window (30 days) for purging closed decisions. When you ask us to delete your account, we remove your workspace data within 30 days, and remaining copies age out of routine backups after that. These retention rules match our plan ladder and billing policy.
What we do not do
- We do not sell your data. Not to anyone, ever.
- We do not show ads, and we do not run advertising trackers.
- We do not use the private contents of your workspace for anything other than providing the service to you. We do not use it to train AI models.
Your rights
You can ask us to show you the personal data we hold about you, correct it, export it, or delete it. Depending on where you live, you may also have the right to object to or restrict certain processing, or to lodge a complaint with your local data-protection authority. To make any of these requests, email support@decisionhub.app and we will respond within a reasonable time.
GDPR and CCPA
DecisionHub is a small product in beta, and we aim to honor the core protections of the EU/UK GDPR and the California Consumer Privacy Act (CCPA) for the people they cover. In GDPR terms, for your workspace content you are generally the controller and we act as your processor. Under the CCPA, we do not sell or share personal information as those terms are defined. A Data Processing Addendum (DPA) is available on request for customers who need one.
Cookies
We use cookies only to keep you signed in - the session cookie that maintains your authenticated session. We do not use advertising or cross-site tracking cookies.
Children
DecisionHub is a workplace tool for businesses and is not directed to children. It is not intended for anyone under 16, and we do not knowingly collect data from them. If you believe a child has given us personal data, contact us and we will delete it.
If there is a data breach
We take reasonable steps to protect your data. If a breach affects your personal data and is likely to create a real risk to you, we will notify you and, where the law requires, the relevant authorities, without undue delay, and tell you what we know and what we are doing about it.
Deleting your data
You can ask us to delete your account and your workspace data at any time. Email us at support@decisionhub.app and we will remove it within 30 days. Some records may persist briefly in routine backups before they age out.
Contact
Questions about this policy or your data? Reach us at support@decisionhub.app.
This page is a plain-language summary written in good faith. It is not legal advice, and it has not yet been reviewed by a lawyer.