Privacy Policy

Email Address

We use your email address to identify your account. We will never:

• Send you unsolicited emails
• Use your email for marketing purposes without your explicit consent

If your account has no display name, the members of your team see your email address in its place when they mention you in an icebreaker answer. We do not share your email address with third parties, with two exceptions. When you open the checkout to subscribe a team to Premium, Stripe receives it, as the "Payments" section describes. And for a premium team, an answer that mentions you this way can be sent to Google, as the "AI Features" section describes.

Display Name

We store the name of your account and the name you join a retrospective room under. Guests, who join a room without an account, give only the name they join under. The other participants of a room see that name.

Retrospective Content

We store what you write in a retrospective room: your icebreaker answers, your cards and your action points. An icebreaker answer can mention other participants by name.

Profile Picture

If you sign in with Google or GitHub, we store the address of the picture of that account. If you upload a profile picture, we store the picture.

Payment Details

When the owner of a team opens the checkout for Premium, we store who would pay for the team: the name and email address of the owner's account. Once they subscribe, we also store the reference Stripe gives them as its customer, and the subscription: its price, how often it renews, when its current period ends and whether it is cancelled. We never receive card details.

Achievement Badges

When a room of a premium team opens its brainstorm phase or its summary, a badge is made for every participant in the room whom an icebreaker answer mentions. This happens without a choice per person: neither the person mentioned nor the author of the answer is asked, and both may be guests. For each badge we send Google:

• The display name of the person the badge is for
• Every icebreaker answer that mentions that person, as it was written, with the display name of its author
• The names of everyone such an answer mentions, the person the badge is for included, each with the identifier the mention carries: the identifier the room gives a participant, or the account identifier of a team member who is not in the room. A team member whose account has no display name is mentioned by email address
• The profile picture of the person the badge is for, when they have uploaded one to RetroAgent, from which the badge image is drawn. A picture that comes from a Google or GitHub account is not sent

What Google receives about you can therefore come from an answer that another participant wrote. Google returns the badge image and a short text, which we store and show in RetroAgent. Google says every image generated through the Gemini API carries an invisible watermark, SynthID.

AI Suggestions

Suggestions are made only when a participant presses the AI Suggestions button in a summary, asks for more, or asks to refine an action point. For each request we send Google:

• The text of every card of the room with the name of its category, without the names of the authors
• The text of every action point of the room, or the one text a participant asks to refine

The Room's Agent

The agent drafts and changes the action points of a room, in a chat in the room's Agent panel. It runs only when a participant asks it something there: a question they type, a suggested question they press, or Draft with the agent under Top Topics or in a summary. Nothing is sent without such a request. To answer one request the agent may call Anthropic up to six times, and each call sends Anthropic:

• The title of the room
• The display name of the participant who asks
• The display names of the participants present in the room, except those who joined anonymously
• The text of the cards the participant who asks can see, each cut to 300 characters, with the name of its category, the cards it is grouped with and, once the totals of a vote are shown, its votes, without the names of the authors. Until the cards of a phase are revealed, the participant sees only their own. A room with more than 300 such cards sends 300 of them and every card the participant tagged
• The text of the action points of the room, each cut to 300 characters, with its owner, due date, status and the cards it is linked to. A room with more than 100 action points sends 100 of them and every action point the participant tagged
• The participant's conversation with the agent in that browser tab: what they asked, the cards and action points they tagged, and what the agent answered, drafted and changed

Anthropic returns drafts of action points, changes to them and a short reply. A draft is shown only to the participant who asked, and we do not store it. A change becomes an action point of the room, which we store marked as made with the agent. The agent changes action points only as the participant who asked could change them themselves, and it is instructed to set an owner or a due date only when that participant has said who or when. We store no conversation with the agent: the participant's browser keeps it in that tab until the tab is closed.

Why We May Do This

The lawful basis for all three features is our legitimate interests (Article 6(1)(f) of the GDPR): to give premium teams the badges, the suggestions and the agent that are part of the service they use. None of the features makes a decision about a person: a badge, a suggestion and a draft are only shown in RetroAgent, and what the agent changes is an action point of the room, which its participants see.

What Google Does With the Data

We use the paid service of the Gemini API. For that service Google says that it does not use prompts or responses to improve its products, and that it processes them on our behalf under its data processing addendum. Google says it logs prompts and responses for a limited period to detect abuse of its service. Its page on abuse monitoring gives 55 days, and says that a project its systems flag may be reviewed manually by authorised Google staff.

The Gemini API as we use it offers no choice of where this processing happens. Google's terms allow it to process the data in any country where Google or its subprocessors have facilities, so the data may leave the European Union. Google's data processing addendum relies on the Data Privacy Framework for transfers to a certified Google entity in the United States, and on the European Commission's standard contractual clauses where no other transfer arrangement applies. Google publishes the addendum at business.safety.google/processorterms.

What Anthropic Does With the Data

We use the commercial Claude API, under Anthropic's commercial terms. In those terms Anthropic says that it may not train models on what we send it or on what it returns, and that it processes the data under its data processing addendum, in which Anthropic is our processor. Anthropic says it deletes what we send and what it returns within 30 days, unless it needs to keep it longer to enforce its usage policy or to comply with the law. Its page on retention says that content its automated systems flag as violating that policy may be kept for up to two years. Content its systems flag may be reviewed manually by authorised Anthropic staff.

For a customer in the European Union, the Claude API is provided by Anthropic Ireland, Limited. The Claude API offers no choice of keeping this processing in the European Union. Anthropic says that by default it may route requests to countries in the United States, Europe, Asia and Australia, that it stores the data in the United States, and that it may process the data for its own safety-related review in countries where it or its affiliates operate. So the data leaves the European Union. Anthropic's data processing addendum incorporates the European Commission's standard contractual clauses for transfers that need them. Anthropic publishes the addendum at anthropic.com/legal/data-processing-addendum, and the providers it uses to process the data, among them Google Cloud, Amazon Web Services and Microsoft Azure, at trust.anthropic.com/subprocessors.

Objecting and Turning the Features Off

You have the right to object to this processing. To object, write to us using the form at the end of this page. The form takes a message only from someone who is signed in to RetroAgent. There is no setting for a single person, and no switch for the AI features of one team alone: all three features are part of a team's premium plan. We can take a team off the premium plan, which ends the three features for that team. Badges already being made for its rooms at that moment are still made.