Privacy Policy and GDPR Consent

1. Data Controller Information

Data Controller: DecisionPen

Contact Information:

• Email: Contact us via our contact form
• Address: 22 Sherway Drive, Timperley, WA15 7NU, England
• Data Protection Officer: Renjith Madathum Padikkal

2. Personal Data We Collect

2.1 Account Information

When you create an account, we collect:

• Name: Your full name for account identification
• Email Address: Used for account login, communication, and service notifications
• Phone Number: Optional, used for account recovery and support
• Password: Stored in encrypted form (hashed) for account security

2.2 Organization Information

We collect information about your organization:

• Organization name
• Organization size category

2.3 Usage Data

We automatically collect information about how you use the Service:

• Login timestamps and session information
• Actions performed within the Service
• IP addresses and device information
• Browser type and version
• Pages visited and features used

2.4 Authentication identifiers

Depending how you sign in, we may process:

• Email / password accounts: credentials stored as password hashes (not reversible passwords)
• Google sign-in: identity assertions needed to create or link your account
• Company SSO (optional): identifiers and claims provided by your organisation’s IdP (for example Okta or Microsoft Entra ID) when SSO is enabled for your tenant

2.5 Workspace / architecture content

We store the customer content you create or upload so the Service can function as an Architecture Decision Workspace. This may include personal data if it appears in your documents (for example names in HLDs or meeting notes). Typical categories:

• Enterprise architecture entities, relationships, and factsheet-style descriptions
• Uploaded documents and evidence (for example PDFs, wiki extracts, transcripts)
• Ask / chat threads and related product history (subject to retention settings)
• AI-proposed modelling results you review, plus generated artefacts (reports, diagrams, blueprints)
• Admin security-event records used for compliance export within your tenant

3. Legal Basis for Processing (GDPR Article 6)

We process your personal data based on the following legal grounds:

• Consent (Article 6(1)(a)): You have given explicit consent to the processing of your personal data for the purposes described in this policy
• Contract Performance (Article 6(1)(b)): Processing is necessary for the performance of the service agreement
• Legitimate Interests (Article 6(1)(f)): Processing is necessary for our legitimate interests in providing, improving, and securing the Service

4. How We Use Your Personal Data

4.1 Service Provision

We use your personal data to:

• Create and manage your account
• Authenticate your identity when you log in
• Provide access to the Service and its features
• Process and store your enterprise architecture data
• Generate reports and documentation based on your data

4.2 Communication

We use your contact information to:

• Send you important service updates and notifications
• Respond to your support requests and inquiries
• Notify you of security issues or account changes
• Send administrative messages (e.g., password reset instructions)

4.3 AI / LLM processing of workspace content

To provide modelling, enrichment, and Enterprise Ask features, we send relevant prompts and retrieved tenant context to Google Cloud Vertex AI in a regional Google Cloud project (default US East). In production we do not use consumer Gemini API-key channels for enterprise traffic. Under Vertex AI generative AI data governance, customer prompts and responses are not used to train Google foundation models by default. Operational logs for model calls record metadata (for example tenant, model, latency, success) rather than full prompt or response bodies. More detail: Security & trust.

4.4 Service Improvement

We may use aggregated and anonymized data to:

• Improve the Service's functionality and performance
• Develop new features and capabilities
• Analyze usage patterns and trends
• Enhance security measures

Aggregated product analytics are separate from using your prompts to train foundation models. We do not use your workspace prompts or Ask responses to train Google foundation models by default.

4.5 Legal Compliance

We may process your data to:

• Comply with legal obligations
• Respond to lawful requests from authorities
• Enforce our Terms and Conditions
• Protect our rights and prevent fraud

5. Data Sharing and Disclosure

5.1 No Sale of Personal Data

We do not sell, rent, or trade your personal data to third parties.

5.2 Service Providers (subprocessors)

We share data with service providers only as needed to operate the Service, including:

• Google Cloud Platform — hosting, object storage, Secret Manager, logging
• Google Cloud Vertex AI — generative and embedding inference for modelling and Ask (enterprise Google Cloud terms / DPA; regional endpoints; default US East)
• Neon (AWS) — managed Postgres for application data, colocated in the US East metro with our default GCP region where feasible
• Email delivery providers for transactional messages (for example account and contact confirmations)
• Analytics providers for the marketing site only after cookie consent (see Cookies below)

These providers are engaged to process data for our purposes under contractual obligations. Enterprise LLM handling — including no training on customer prompts/responses by default — is summarised on Security & trust. A fuller subprocessor / DPA pack is available on request for enterprise evaluation.

5.3 Legal Requirements

We may disclose your data if required by law or in response to:

• Valid legal process (subpoenas, court orders)
• Government requests
• Legal investigations
• Protection of rights, property, or safety

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity, subject to the same privacy protections.

6. Data Security

We implement technical and organisational measures appropriate to the Service. The public summary lives on Security & trust. In brief:

• Encryption in transit: TLS for client traffic and for calls to Vertex AI and other Google Cloud services
• Encryption at rest: Cloud-provider platform encryption for the managed database (Neon / Postgres) and Google Cloud Storage. IdP client secrets are encrypted at rest in the application. Customer-managed encryption keys (CMEK) are not offered on the current SaaS posture
• Tenant isolation: Application-level tenant separation; dedicated Google Cloud project options may be available for regulated enterprise customers
• Access control: Password hashing for email/password accounts; optional company SSO; role-based access (Viewer, Contributor, Administrator, Approver)
• Secrets: Operational secrets held in Google Secret Manager where applicable
• Audit: Administrators can export tenant security events; product and agent actions leave audit trails; LLM operational logs are metadata-oriented as described above

No method of transmission or storage is perfectly secure. We do not claim a customer-facing SIEM, CMEK on all stores, or that trial workspaces are excluded from provider backup mechanisms.

7. Data Retention

7.1 Active accounts and workspaces

We retain account and organisation personal data while your account is active and as needed to provide the Service. Workspace architecture content remains until your organisation deletes it, clears it, or closes the workspace under our processes.

7.2 Ask / chat retention

Ask / chat history stored for product use has a configurable retention window (default 30 days; enterprise customers may request a lower window). Landscape model data and evidence are governed separately by your workspace administrators.

7.3 Self-serve workspace clear

Workspace Administrators can clear map data, associated evidence as implemented by the clear-all tooling, and Ask / chat history from Admin (Import & cleanup), with confirmation. That removes customer content from the live workspace; it is not the same as deleting every account record, every audit row, or every copy that may exist in provider backup or disaster-recovery systems for a limited period.

7.4 Account deletion and erasure requests

When you request account deletion or exercise erasure rights (see Section 8):

• We will delete or anonymize personal data we no longer need, typically within 30 days of a verified request
• Some data may be retained longer if required by law or for limited legitimate purposes (for example fraud prevention, security incident records, or dispute resolution)
• Provider backups and replicas may retain residual copies for a limited period after live deletion, then age out according to the provider’s backup lifecycle

7.5 Legal requirements

We may retain certain data for longer periods if required by applicable laws, regulations, or legal proceedings.

8. Your Rights Under GDPR

As a data subject, you have the following rights regarding your personal data:

8.1 Right of Access (Article 15)

You have the right to obtain confirmation as to whether we process your personal data and to access that data, along with information about how it is processed.

8.2 Right to Rectification (Article 16)

You have the right to have inaccurate personal data corrected and incomplete data completed.

8.3 Right to Erasure ("Right to be Forgotten") (Article 17)

You have the right to request deletion of your personal data when:

• The data is no longer necessary for the original purpose
• You withdraw consent and there is no other legal basis
• The data has been unlawfully processed
• Deletion is required to comply with legal obligations

For customer architecture content in a shared organisation workspace, Administrators can also clear live map / Ask content as described in Section 7. Erasure of personal data in account records is handled via verified requests to us; organisation-owned workspace content may require coordination with your organisation’s administrator.

8.4 Right to Restrict Processing (Article 18)

You have the right to restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.

8.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller.

8.6 Right to Object (Article 21)

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

8.7 Right to Withdraw Consent (Article 7)

You have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

8.8 Right to Lodge a Complaint (Article 77)

You have the right to lodge a complaint with a supervisory authority if you believe your data protection rights have been violated.

9. International Data Transfers and residency

DecisionPen is operated by a UK controller. The SaaS default processes and stores primary application data and Vertex AI inference in the US East metro (managed Postgres on AWS in that metro; Vertex / related Google Cloud services in a paired US East Google Cloud region). If you access the Service from the EEA/UK, this involves an international transfer.

When we transfer personal data internationally, we use appropriate safeguards recognised under applicable law, which may include:

• Standard Contractual Clauses approved by the European Commission (and UK equivalents where required)
• Adequacy decisions where they apply
• Other legally recognised transfer mechanisms

Regulated enterprise customers may discuss dedicated deployment postures; defaults remain as stated on Security & trust unless otherwise agreed in writing.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Maintain your session and authentication state
• Remember your preferences
• Analyze Service usage and performance

On our public marketing website (decisionpen.com), we use Google Analytics 4 only after you opt in via the cookie banner. Analytics cookies are not set if you reject or have not yet chosen. You can change your choice at any time using the “Cookie settings” link in the website footer. You can also control cookies through your browser settings; disabling certain cookies may affect Service functionality.

11. Children's Privacy

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete that information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on the Service
• Sending an email notification to your registered email address
• Displaying a notice when you next access the Service

Your continued use of the Service after such changes constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions, concerns, or wish to exercise your rights regarding your personal data, please contact us:

• Email: Contact us via our contact form
• Address: 22 Sherway Drive, Timperley, WA15 7NU, England
• Data Protection Officer: Renjith Madathum Padikkal