PRIVACY POLICYPrivacy Policy
This policy explains what DISCINTEL, LLC, a North Carolina limited liability company ("DISCINTEL", "we", "us"), collects when you use app.getdiscintel.com and related pages (the "Service"), why we collect it, and the choices you have.
- Personal tier: your DISC profile, personas and activity log are encrypted on your device. We never receive them.
- Business tier: your workspace records are stored with our hosting provider, isolated to your account.
- No selling, no ads, no trackers: we do not sell or rent personal information, and the Service runs no advertising or third-party analytics scripts. The product activity described below is recorded by DISCINTEL itself, not by an outside analytics service.
- No AI providers: the Service does not send your content to any AI model provider.
- Who is responsible
- What we collect
- What we do not collect
- How we use information
- Cookies and browser storage
- AI processing
- Service providers and sharing
- Evidence records
- Retention and deletion
- Security
- Your rights
- Children
- Where data is processed
- Changes
- Contact
1. Who is responsible
DISCINTEL is responsible for your account information and for operating the Service. When an organization uses a Business workspace, the organization decides what records go into it. For that workspace content, we process data on the organization's behalf and under its instructions, and the organization is responsible for having a lawful basis to put it there.
2. What we collect
| Data | Source | Where it is kept |
|---|---|---|
| Account identity: email address, whether it is verified, sign-in method (for example passkey or password), and an account identifier | You, through our sign-in provider Auth0 | Auth0 (Okta, Inc.) and our account record on Netlify |
| Account activity: account type (Business or Personal), created and last-seen times | The Service | Our account record on Netlify |
| Business workspace records: institutions, people and roles, agents, tools, governed actions, decisions, approvals, execution records, evidence events, file metadata and fingerprints, and any text you choose to store | You and your organization | Netlify managed storage, separated per account |
| Personal vault: DISC answers and scores, personas and their rules, request checks and your activity log | You | Only your browser on your device, encrypted with AES-GCM (256-bit) using a key derived from your passphrase. It is never sent to us. |
| Product activity (signed-in accounts that accepted the confidentiality agreement): how many times each screen was opened and each named control was used, by day | Recorded by the Service as you use it; counts and control names only, never what you type or the contents of your workspace | Your account record in DISCINTEL's storage, visible to the founder in the founder dashboard |
| Technical data: IP address, browser and device type, request times, errors | Collected automatically when you use the Service | Service logs kept by Netlify and Auth0 |
| Messages you send us: the content of emails or requests | You | Our email provider |
3. What we do not collect
- Payment card or bank details. The Service is free during early access.
- The contents of your Personal vault, your passphrase, or anything that would let us open your vault.
- Advertising identifiers or cross-site browsing activity.
4. How we use information
- To provide the Service: sign you in, keep your workspace available, and carry out the actions you request.
- To keep it secure: verify every request, keep accounts separated, and detect and stop abuse.
- To understand and support use: our founder dashboard lists every account with its email address, sign-in method, account type, creation date, the date the confidentiality agreement was accepted and when it was last used, and shows the product activity above for each account. It also shows the number of records in a workspace by kind. It does not show workspace contents or anything from a Personal vault.
- To communicate with you: about your account, security, and material changes to these documents.
- To meet legal obligations and to enforce our Terms of Service.
If you are in the European Economic Area or the United Kingdom, our legal bases are: performance of our contract with you (providing the Service), our legitimate interests (security, abuse prevention and aggregate measurement, balanced against your rights), compliance with legal obligations, and your consent where we ask for it.
5. Cookies and browser storage
- Sign-in: the Auth0 sign-in library stores your sign-in tokens in your browser's local storage so you stay signed in. Auth0 also sets cookies on its own sign-in pages to manage your session.
- Personal vault: stored, encrypted, in your browser's IndexedDB storage for app.getdiscintel.com. Clearing your browser data, or using a private window, deletes it. Export a backup first.
- We do not use advertising or analytics cookies.
6. AI processing
Neither tier sends your content to an AI model provider. Governance decisions in the Service are made by deterministic rules that you can inspect. If we add an AI feature, it will be opt-in, will tell you exactly what is sent and to whom, and we will update this policy before it launches.
7. Service providers and sharing
| Provider | Purpose | Data involved |
|---|---|---|
| Auth0 (Okta, Inc.) | Sign-in, passkeys, email verification | Account identity, sign-in events, technical data |
| Netlify, Inc. | Hosting, server functions and storage | Account record, Business workspace records, technical data |
| Fly.io, Inc. | Hosting for DISCINTEL's runtime governor, a second, independent check on each governed decision, tool use and research retrieval, at getdiscintel.com in Fly.io's US East (Virginia) region | For each check: the agent and tool identifiers, the requested effect, amount, environment, consequence class and DISCINTEL record identifiers, and for research the source address (URL) and its source type. Not file contents, payee names or your sign-in identity. Kept in the governor's audit log |
| Cloudflare, Inc. | Domain name resolution (DNS) for getdiscintel.com, and a network proxy in front of the runtime governor | DNS lookups, and the runtime-governor requests described above, which pass through Cloudflare's network. Your browser's traffic to the app (app.getdiscintel.com) does not pass through Cloudflare |
We also disclose information when the law requires it, to protect the rights and safety of users or the public, or as part of a merger, acquisition or sale of assets. Any acquirer remains bound by this policy for the information it receives. We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising.
8. Evidence records
Business workspaces keep a hash-linked evidence log, so that changes to past records can be detected. Within a live workspace, evidence events are not edited or removed one by one; that is the point of the log. Deleting your account deletes the entire workspace, including its evidence log. Evidence packages you have downloaded are your copies, and we cannot delete them.
9. Retention and deletion
- Account and workspace data: kept while your account is active. Request deletion at privacy@getdiscintel.com. We will delete your account record and Business workspace within [30] days, unless we must keep something for a legal reason, and we will also ask Auth0 to delete your sign-in identity.
- Service logs: kept by Netlify, Auth0, Fly.io and Cloudflare for their standard retention periods.
- Runtime governor audit log: each check is kept for [retention period] as part of the governor's tamper-evident audit trail.
- Personal vault: you can delete it yourself at any time under Vault & backup. We never hold it, so we cannot delete or recover it for you.
10. Security
Safeguards include passkey-capable sign-in, a signed and verified access token on every request, separate storage for each account, encryption in transit (TLS), and hash-linked evidence logs. Personal vaults use AES-GCM encryption with a key derived from your passphrase (PBKDF2, 600,000 iterations). No system is perfectly secure. If you find a vulnerability, please report it to privacy@getdiscintel.com.
11. Your rights
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. To make a request, email privacy@getdiscintel.com from the address on your account. We will verify your request and respond within the time the law requires. If we decline a request, you may appeal by replying to our decision. You may also complain to your local data-protection authority. We will not treat you differently for exercising these rights.
If your workspace is administered by an organization, we may refer requests about that workspace's content to the organization.
12. Children
The Service is for people 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
13. Where data is processed
We and our providers process data in the United States. If you use the Service from elsewhere, your information will be transferred to the United States, where data-protection law may differ from yours.
14. Changes to this policy
We will post updates on this page with a new date. For material changes, we will notify you by email or in the Service before they take effect.
15. Contact
DISCINTEL, LLC · privacy@getdiscintel.com · legal@getdiscintel.com