Data-processing agreement

• Whose data: people you or your assistant put on your board or file in the incoming review — customers, leads, sign-ups, event registrants, contacts at companies.
• Which data: name, email address, company, role, links, notes you write about them, what happened and when, and next steps. We do not ask for special categories of data (health, religion and the like) and you agree not to put them in.
• What we do with it: store it, show it to your team, rank it, send your team reminders about it, and pass what you ask about to a language model to draft or summarise for you.
• How long: as set out in Annex 2, and until you delete it or your workspace is deleted.

We handle your data only as this agreement and your use of the product instruct, and as the law requires of us. If the law requires something else, we tell you first unless the law forbids that. If we think an instruction breaks data-protection law, we tell you.

We do not sell your data, share it for anyone's advertising, or use it to train models, and we ask our model provider for the same.

Only people who need it to run the service, and each is bound to confidentiality. Today that is one person: Ben Sufiani.

We keep the measures in Annex 2 in place. We may change them as the product changes, but never to a lower level of protection.

You agree that we use the companies in Annex 1. Each handles only what its line says, and we have an agreement with each that protects your data at least as well as this one. We answer for what they do with your data.

Before a new sub-provider starts, we tell you 30 days ahead, by mail to your workspace's notice address, and we date the change in the public change log. If you object for a reason to do with data protection, write to us within those 30 days. If we cannot resolve it, you may end the contract when the change takes effect and we refund what you paid for the time after.

Your data is stored and processed in the places Annex 1 names. Where a sub-provider handles it outside the European Economic Area, that rests on the basis named in its line (an adequacy decision such as the EU–US Data Privacy Framework, or the EU standard contractual clauses).

If someone asks you what you hold about them, or to correct or delete it, you can do that yourself on the board, with the export, and with the erase tool. If you need more, write to us and we help within 10 working days. If someone writes to us about your data, we pass it to you and do not answer for you.

We also help, as far as it concerns our service, with your own duties to assess risk and to report incidents.

If your data is lost, changed or seen by someone who should not have, we tell you without undue delay, and no later than 72 hours after we learn that your data was affected. By mail to your workspace's notice address; if none is set, to every admin of the workspace. We say what happened, which data, what we have done and what you should do. We send what we know and follow up.

The public trust page and its change log say what we do, with dates. Once a year, and after an incident, you may ask us questions in writing and we answer them. If a supervisory authority requires an inspection, we allow it, with reasonable notice and without exposing other customers' data. We hold no certificate or audit report and do not claim one.

You can export your deals at any time, including after a subscription ends. When you ask us to delete your workspace, we delete it and everything in it within 30 days, and it leaves our database backups when their history window runs out. We keep only what the law makes us keep, such as invoices.

Liability follows our terms. German law applies. If one part of this agreement turns out not to hold, the rest stays.

Questions: contact@pirateskills.com.

As of 2026-10-14 (facts version 2026-10-14.1).

Neon — Databricks, Inc., US (parent of Neon, LLC). Since 2026-07-15. The database. Which data: Everything in your workspace: deals, contacts, notes, history, incoming findings, settings. Where: Frankfurt, Germany (AWS eu-central-1). Whether Neon's own logs and control systems stay in that region is not established. Transfer basis: EU standard contractual clauses (modules 2 and 3); EU–US Data Privacy Framework by the provider's own statement; the official list could not be read on 11 Oct 2026.

Vercel — Vercel Inc., US. Since 2026-07-01. Runs the application and delivers its pages. Which data: Every request and response passes through it, with your IP address and browser details. It keeps server logs. Where: Server code runs in Frankfurt (fra1). Pages, the sign-in check on each request and cached files are served from the network location nearest the reader, worldwide. If Frankfurt fails, Vercel reroutes to the next closest region. Where logs are kept is not established. Transfer basis: EU standard contractual clauses (modules 1, 2 and 3); EU–US Data Privacy Framework by the provider's own statement; the official list could not be read on 11 Oct 2026.

Model providers behind Vercel's AI gateway — Anthropic, Amazon Web Services (Bedrock) or Google Cloud (Vertex), as sub-providers of Vercel. Since 2026-07-01. Answers for the assistant built into the app: the daily brief, drafts and chat. Your own connected assistant is not part of this; that is your tool and your provider. Which data: The deals, notes and workspace profile the built-in assistant is asked about, for that one call. Where: The gateway picks one of the three per call. The place is not established. Transfer basis: Covered by Vercel's agreement and its agreements with each provider.

Clerk — Clerk, Inc., US. Since 2026-07-22. Sign-up, sign-in, workspaces and members, API keys. Which data: Your team's names, email addresses, sign-in sessions, and which workspace each person belongs to. No deals or contacts. Where: United States. Clerk offers no EU option. Transfer basis: EU–US Data Privacy Framework by the provider's own statement; the official list could not be read on 11 Oct 2026; EU standard contractual clauses as the fallback.

Stripe — Stripe Payments Europe, Limited. Since 2026-08-05. Payments and invoices. Which data: Your company's name, billing address, VAT ID, the paying admin's email, and payment details. We never see a card number. Nothing during the trial: no Stripe customer exists until you pay. Where: Worldwide, including the United States. Transfer basis: EU–US Data Privacy Framework by the provider's own statement; the official list could not be read on 11 Oct 2026; EU standard contractual clauses as the fallback.

Resend — Plus Five Five, Inc., US. Since 2026-08-26. Sends our mails to your team: the morning mail, the Monday summary, trial and account notices. Which data: The recipient's email address and name, and the mail itself — which names the deals and next steps that are due. Where: United States. Transfer basis: EU standard contractual clauses (modules 1, 2 and 3); EU–US Data Privacy Framework by the provider's own statement; the official list could not be read on 11 Oct 2026.

PostHog (EU cloud) — PostHog, Inc., US. Since 2026-09-02. Shows us how the product is used. Which data: Which screens and buttons a signed-in person uses, with their user and workspace id, and their device. No deal or contact content. Where: Frankfurt, Germany. Transfer basis: EU standard contractual clauses; EU–US Data Privacy Framework by the provider's own statement; the official list could not be read on 11 Oct 2026.

Meta pixel — not established. Since 2026-09-02. Tells us which advertisement a sign-up came from. Which data: Page visits and sign-up events from your browser, only after you agree to marketing cookies. No workspace content. Where: not established Transfer basis: not established

iubenda — not established. Since 2026-09-02. The cookie choice and the hosted privacy policy. Which data: Your cookie choice and the IP address it was made from. Where: not established Transfer basis: not established

Where: Stored in Frankfurt, Germany (Neon Postgres on AWS eu-central-1), since 11 Oct 2026. Before that day it was in the US (AWS us-east-1). Processed in Frankfurt, Germany (Vercel functions, region fra1), since 11 Oct 2026; before that day in Washington, D.C. Five things happen outside Frankfurt: page delivery and the sign-in check (Vercel's network, nearest the reader), accounts (Clerk, US), payments (Stripe, worldwide), the mails we send you (Resend, US), and model calls for the built-in assistant (place not established).

Measures

• Every row belongs to one workspace, and every query is limited to it in the shared code path, not by a filter per screen. This is what our tests check hardest.
• Sign-in is handled by Clerk. We hold no passwords.
• An assistant connects by a consent screen in your browser, or with a workspace API key that reads only unless an admin grants more.
• Connections are encrypted in transit (TLS). The database is encrypted at rest by Neon.
• Every route that touches your data checks who is asking and is rate-limited. Tests read the source to hold that.
• Admin actions are written down with who and when.
• Secrets live in the hosting environment, never in the code.
• Internal errors are logged and never returned to a caller.
• No assistant and no background worker contacts anyone or has the final word on an incoming finding. A signed-in person does.

How long things are kept

• Deals, contacts, notes and history on the board: Until you delete them or the workspace is deleted. Your control: Edit or remove on the board; export any time.
• A closed finding in the incoming review (name, address, company, what happened, and the background assistant's reason, which can say what it found on public web pages): The person's details are removed 7 days after it is closed. Only a fingerprint, the category and the outcome stay. Your control: Your admin sets 0 to 30 days in Settings → Trust.
• A finding nobody decided: Closed and emptied after 30 days. Your control: Fixed.
• One person in the incoming review: Removed at once, whole rows, when asked. Your control: The assistant tool erase_person.
• Links in mails we send (Done, Push a week, Unsubscribe): Only a hash is stored. Action links expire after 7 days, unsubscribe links after a year; expired ones are deleted hourly. Your control: None needed.
• The record of admin actions (who, what, when): Until the workspace is deleted. Your control: None.
• Database backups at Neon: How long a deleted row stays restorable from Neon's history is not established. Your control: None.
• Invoices and what they are based on: For as long as German tax law requires. Held at Stripe. Your control: None.