Privacy notice

Bernhard Kerres & Friends GmbH, Hoher Markt 4/20, A-1010 Vienna, Austria. Contact: office@bernhardkerres.com · +43 1 225 635 580.

We are the controller for account and sign-in data. Content a team captures on behalf of its organisation (decision text, ratings, team figures) is processed by us as a processor on that organisation's instructions.

Contract performance (Art. 6(1)(b) GDPR) for running the exercise and providing access; legitimate interests (Art. 6(1)(f) GDPR) for secure operation, abuse prevention and troubleshooting. There is no advertising, no sale of data and no profiling for other purposes.

• Account data: display name, email address, language, sign-up time.
• Team membership: team, role (member, facilitator, admin), and when you joined or were removed.
• Per-decision capture: the decision text, your own alignment score, your estimate of each other participant, and optional free text on what you would need and what could go wrong.
• Computed team metrics and AI-generated review summaries over the course of the exercise.
• Email delivery logs (invitations, reminders, password resets) and technical logs from the hosting and database provider (IP address, timestamps, errors).

Running the alignment exercise, computing and showing team results, producing the three-month review, sending invitations and reminders, support, and operating the service securely.

• Your rating of an individual colleague is never shown to anyone as an individual number. It only enters averages and spreads.
• Each person sees their own score and how the room read them on average — only when enough people took part.
• A team's facilitator sees team-level numbers, participation and the team's decision text, not individual peer ratings.
• The operator's administrators can access all teams for support and troubleshooting, including decision text.
• A team needs at least three active members, because with two people every aggregate resolves back to the other person by arithmetic.

Captured rounds are kept for the duration of the exercise and then for 12 months so the team can revisit its results; after that they are deleted unless something else is agreed in writing. Account data is kept for the active account period. Business records are kept for 7 years under § 132 Austrian BAO. Email delivery logs and technical logs are short-lived and deleted on a rolling basis.

When someone is removed from a team, rounds already completed stay exactly as they were, so past results are never silently recomputed.

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15-21 GDPR). Send requests to office@bernhardkerres.com.

On request we erase your account, your name, your email address and your free-text answers; already-computed team figures remain as numbers with no link to you, so past team results are not altered. You may lodge a complaint with the supervisory authority: Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna (dsb.gv.at).

• Lovable (Sweden) — application hosting and delivery of the web application (EU) — GDPR-compliant, EU data centres
• Supabase Inc. — database hosting, authentication and file storage (AWS, EU region) — SOC 2, ISO 27001, GDPR-compliant
• Google LLC — AI language processing for review summaries (USA) — EU Standard Contractual Clauses, DPA, no training on customer data
• OpenAI LLC — AI language processing for review summaries (USA) — EU Standard Contractual Clauses, DPA, no training on customer data
• Resend Inc. — transactional email delivery for notify.mail.mocaia.com (EU region) — DPA, EU Standard Contractual Clauses

On request we provide a current subprocessor list and a data processing agreement.

Transfers to the USA (Google, OpenAI) are made exclusively on the basis of EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and executed data processing agreements. Decision text and aggregated numbers are sent to the language models; names and email addresses are not. Training of the models on this content is contractually prohibited.

We use strictly necessary storage only: your sign-in session and your language preference. There are no analytics or marketing cookies and no cross-site tracking.

We implement technical and organisational measures under Art. 32 GDPR (encryption in transit and at rest, row-level access control in the database, separation of roles). Personal data breaches are notified under Art. 33 GDPR within 72 hours. Report a vulnerability to office@bernhardkerres.com.

Terms and conditions · Imprint