Privacy Policy

This Privacy Policy explains how we collect, use, and protect your personal data when you use Agendaflow. We are committed to handling your data lawfully and transparently under the EU General Data Protection Regulation (GDPR) and Norwegian data protection law.

1. Who we are

Agendaflow is operated by Agendafix AS (org.nr. 937 071 280), a company registered in Norway. “Agendaflow” is the brand name under which we provide the service at agendaflow.com. In this policy, “we”, “us”, and “our” refer to Agendafix AS, the data controller for the personal data described below.

For any privacy question or to exercise your rights, contact us at hello@agendaflow.com.

2. What data we collect

• Account data — your name and email address. Your email address is your account identifier.
• Content you create — the agendas, sessions, blocks, comments, and any material you upload or generate while using the service.
• Billing data — your subscription plan and status. All card payments are handled by Stripe; we never receive or store your full card number.
• Technical logs — limited technical information such as request logs generated when you use the service, used to keep the service secure and reliable.

Participant names you enter. When you add participants to an agenda, their names — and any spreadsheet columns you choose to keep — are personal data about people who are not our users. For that data, your organisation is the data controller and Agendafix AS is the data processor, acting on your instructions under our Data Processing Agreement. Those names are stored in the EU with your other content and are covered by the subprocessor list below. You may choose to display group allocations on a participant link; if you do, the names on the roster become visible to anyone who holds that link, and that disclosure is your decision as controller. A person whose name appears in an agenda should ask the facilitator who created it to correct or remove it; if they contact us instead, we will pass the request on.

3. Why we process it (legal bases)

• Performance of a contract — to create your account, provide the planning tools, store your content, and manage your subscription.
• Legitimate interests — to keep the service secure, prevent abuse, and improve and maintain the product, balanced against your rights.
• Consent — for optional marketing email, which we send via Loops.so only where you have opted in. You can withdraw consent at any time using the unsubscribe link or by emailing us.

4. AI processing

Agendaflow includes AI features that help you draft and refine agendas. When you actively use an AI feature, the relevant agenda content is sent to Anthropic’s API to generate the response. This processing happens only when you invoke an AI feature — your content is not sent to AI providers in the background.

Your content is not used to train AI models. When you use exercise search or AI-assisted agenda features, your search query is converted into an embedding via OpenAI to power semantic matching.

How long AI providers keep your content. AI providers process your content to generate the response. Under their API terms, they may retain inputs and outputs for up to 30 days for abuse monitoring, after which the data is deleted. Your content is never used to train AI models.

Uploaded files stay in the EU. Files you upload — for example a strategy document attached as pre-read material — are stored only in our EU database and are not sent to AI providers. What is sent when you actively use an AI feature is the text in your agenda blocks, notes, and briefs, and screenshots you submit through the brief flow.

5. Where your data lives

Your primary application data is stored in the EU, in Supabase’s Frankfurt (Germany) region. We use the following subprocessors to run the service — the current list, with each one’s purpose, location and transfer safeguard, is maintained at Subprocessors:

• Supabase — application database, file storage, authentication (EU / Frankfurt).
• Vercel — application hosting and content delivery.
• Stripe — payment processing. Card data is handled directly by Stripe and never touches Agendaflow’s servers.
• Anthropic — AI text generation when a user invokes an AI feature.
• OpenAI — embeddings for semantic exercise search.
• OpenRouter — AI request failover routing (only if Anthropic is unavailable). Requests still run on Anthropic’s Claude models but transit OpenRouter’s servers.
• Google — in-app preview of uploaded Office documents. Rendered via Google’s document viewer.
• Resend — transactional email. For example account notifications and password-reset mail.
• Loops.so — marketing email (opt-in only).
• PostHog — product analytics (EU / Frankfurt).

Some of these subprocessors (Vercel, Stripe, Anthropic, OpenAI, OpenRouter, Google, Resend, and Loops.so) may process data in the United States. Where data is transferred outside the EU/EEA, we rely on the European Commission’s Standard Contractual Clauses as the transfer safeguard.

6. Data retention

We keep your account data and content for as long as your account is active. You can request deletion of your account and content at any time by contacting us. When content is deleted, it is removed from our active systems and purged from backups on a rolling basis as older backups age out. We may retain limited records where required for legal, tax, or accounting purposes.

7. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate data (rectification);
• request erasure of your data;
• receive your data in a portable format;
• object to certain processing;
• lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).

To exercise any of these rights, email hello@agendaflow.com.

8. Cookies and analytics

We use strictly necessary cookies — specifically, session cookies required to keep you signed in — and analytics cookies, described below. We do not use advertising cookies.

We use PostHog, a product analytics service, to understand how Agendaflow is used — for example, which features are used and where people encounter problems. PostHog is configured to store and process this data exclusively in the European Union (PostHog EU Cloud, hosted in Frankfurt). Analytics data includes pages visited, actions taken in the app (such as creating an agenda), your browser and device type, and — once you have an account — your email address as an identifier. We do not use session recording: we do not capture your screen, keystrokes, or the contents of what you write. We do not use analytics data for advertising, and we do not sell it or share it with third parties for their own purposes. Analytics cookies and similar identifiers are used solely to make this measurement work.

9. Changes to this policy

We may update this policy from time to time. When we do, we will update the date below. If we make material changes, we will notify you by email.

10. Contact

Agendafix AS · org.nr. 937 071 280 · Norway. Questions about this policy? Email hello@agendaflow.com.