Privacy Policy & GDPR
Last updated: October 17, 2026
This privacy policy explains how 360 Sprint collects, uses, and protects your personal data in compliance with GDPR (EU Regulation 2016/679).
0. Data Controller
360 Sprint ApS, CVR 27700489, Akademigrunden 30C, 4180 Sorø, Denmark is the data controller for the processing of your personal data. Data protection contact: Daniel Wegener, privacy@360sprint.dk.
1. Data We Collect
We collect information you provide directly to us and information generated through your use of the platform. The categories of personal data we process are:
- Identity data: name, email address, and profile information provided via Clerk authentication.
- Strategic business data: information you enter into boards, nodes, and strategy projects.
- Usage data: page views, feature interactions, timestamps, and session metadata.
- AI interaction data: which AI models were used, which data fields were sent, and audit logs of every AI request.
- Technical data: hashed IP addresses (SHA-256), browser type, and language preference.
- Voice data: audio recordings sent for speech-to-text transcription, text-to-speech synthesis and podcast generation via ElevenLabs, and, if you join the live voice facilitation beta, audio, session transcripts and saved canvas content sent to OpenAI. Recorded audio is processed in real time and not stored; generated podcast audio is stored with the project until it is deleted.
- Push notification data: device tokens (iOS/Android) and notification delivery metadata. Tokens are stored encrypted and used solely for delivering app notifications.
- Mobile app data: photos you choose from your photo library (used solely as podcast cover images), and data stored locally on your device — sign-in credentials in the iOS Keychain and a local cache of your conversations. Local data is removed when you sign out or delete the app.
2. How We Use Your Data
Your data is used solely to provide and improve the 360 Sprint service. We never sell or share your personal data with third parties for marketing purposes.
Below is an overview of our processing purposes and their legal basis under GDPR:
| Purpose | Legal basis |
|---|---|
| Providing the 360 Sprint platform and your account | Art. 6(1)(b) — performance of contract |
| AI-powered strategic analysis (AWS Bedrock EU) | Art. 6(1)(b) — performance of contract |
| Product improvement and internal analytics | Art. 6(1)(f) — legitimate interest (service improvement) |
| Security monitoring and abuse prevention | Art. 6(1)(f) — legitimate interest (security) |
| Compliance with legal obligations (e.g. bookkeeping) | Art. 6(1)(c) — legal obligation |
| Sending service-related communications (transactional emails) | Art. 6(1)(b) — performance of contract |
| Voice processing (speech-to-text, text-to-speech and podcasts via ElevenLabs; live voice facilitation beta via OpenAI) | Art. 6(1)(a) — explicit consent |
| Push notifications (mobile app alerts via Expo/APNs/FCM) | Art. 6(1)(a) — explicit consent |
3. Data Security
All data is encrypted in transit (HTTPS/TLS) and protected at rest via infrastructure-level encryption provided by our hosting provider. On every strategy analysis, we apply field-level data masking via our Data Guardian system before the data reaches an AI provider. Sensitive fields (such as personal identification numbers, financial details, and passwords) are automatically detected and blocked.
A detailed overview of our technical and organizational measures (TOMs) is available at our Trust Center: trust.360sprint.dk
4. Your Rights (GDPR)
Under GDPR you have the following rights regarding your personal data. To exercise any of these rights, contact privacy@360sprint.dk.
- Right of access (art. 15) — obtain a copy of all personal data we process about you.
- Right to rectification (art. 16) — correct inaccurate or incomplete personal data.
- Right to erasure (art. 17) — request deletion of your personal data.
- Right to restriction (art. 18) — limit how we process your data in certain situations.
- Right to data portability (art. 20) — receive your data in a structured, machine-readable format.
- Right to object (art. 21) — object to processing based on legitimate interest.
- Right not to be subject to automated decisions (art. 22) — see Section 7 for details on AI processing.
You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, dt@datatilsynet.dk, if you believe your data is being processed in violation of GDPR.
5. Data Retention
We retain personal data only as long as necessary for the purposes described in this policy. Specific retention periods are:
| Data type | Retention period |
|---|---|
| Account & profile data | Until account deletion + 30 days |
| Strategic board data | Until account deletion |
| AI audit logs | 90 days (auto-purged) |
| Server access logs | 30 days |
| Error tracking (Sentry) | 90 days |
| Transactional emails | 12 months |
| Bookkeeping data (invoices) | 5 years (Danish Bookkeeping Act) |
| Voice data (audio and transcripts) | Recorded audio: not stored (real-time processing). Live voice session transcripts: until the model, your account or the organisation is deleted. Generated podcast audio: until deleted |
| Push notification logs | 90 days (auto-purged) |
6. Contact Us
For data requests (access, export, deletion), contact: privacy@360sprint.dk
7. AI Data Processing
360 Sprint uses AI to power strategic analysis features. This section explains exactly what data is processed, how it is protected, and your rights regarding AI processing.
AI Providers
We use AWS Bedrock (Anthropic Claude models) as our primary AI provider. All data is processed within AWS infrastructure in the EU (Ireland, eu-west-1). Neither AWS nor Anthropic use your data for model training. A full list of sub-processors is available on our DPA page.
What Data Is Sent to AI
Only data classified as PUBLIC or INTERNAL is sent to AI providers. Our Data Guardian system automatically scans all outgoing strategy-analysis data and blocks RESTRICTED fields (personal identification numbers, passwords, credit card numbers, salary information, API keys). CONFIDENTIAL fields (such as exact revenue figures and personal names) are anonymized before processing.
What Is Never Sent
The following data is never sent to an AI provider from your strategy analyses: CPR numbers, social security numbers, credit card numbers, bank account details, passwords or API keys, salary or compensation details, and SSH keys. These fields are automatically detected and blocked by our Data Guardian system, regardless of where they appear in your strategy data.
Audit Trail
Every AI interaction in chat, strategy analysis, voice features and podcast generation is logged in a full audit trail. The log records: which fields were sent, which fields were excluded, which AI provider and model were used, and the timestamp. Real-time speech-to-text and the live voice facilitation beta send audio directly from your browser to the provider, so for them the log records when a real-time session token is issued (and, for the beta, when each session is created and ended), not what was said. Narration and podcast episodes in the Academy are not yet covered by this log. You can request a copy of your AI audit logs at any time.
Model Training
Your data is not used to train AI models. Neither AWS nor Anthropic use customer data for model training. Your strategic data remains yours.
Legal Basis
AI data processing is based on GDPR Article 6(1)(b) — performance of contract. AI-powered analysis is a core feature of the 360 Sprint platform and necessary for delivering the service you have subscribed to.
Automated Decision-Making
360 Sprint uses AI to generate strategic analyses, recommendations, and summaries. These outputs are advisory in nature and are always presented for human review. No automated decisions with legal or similarly significant effects are made solely by the AI. You always retain full control over any actions taken based on AI outputs.
Voice Processing
When you use voice features, audio and text are sent to ElevenLabs, Inc. (USA) for speech-to-text transcription, text-to-speech synthesis and podcast generation. ElevenLabs offers EU data residency; until it is confirmed for our account, transfers to the USA are covered by Standard Contractual Clauses, and the current processing location is shown in our sub-processor list. If you join the live voice facilitation beta (a personal setting for beta participants), microphone audio, the session transcript and the saved canvas content are sent to OpenAI, LLC (USA); the data processing agreement with OpenAI is being finalised, and its status is shown in our sub-processor list. Recorded audio is not stored; generated podcast audio is stored with the project until it is deleted. Voice processing requires explicit consent (GDPR Art. 6(1)(a)) and can be disabled at any time in your settings.
Push Notifications
If you enable push notifications on the mobile app, your device token is stored encrypted on our servers and sent to Expo (notification relay), which forwards to Apple APNs (iOS) or Google FCM (Android) for delivery. Notification content is transient and not stored by relay services after delivery. Push notifications require explicit consent and can be disabled at any time in your device or app settings. Notification delivery logs are retained for 90 days.
8. Sub-Processors
A complete and up-to-date list of our sub-processors, including AI providers, hosting, and authentication services, is available on our Data Processing Agreement page.
View DPA & Sub-Processors →9. Cookies & Tracking
At 360 Sprint, we believe in radical transparency. Here is exactly what cookies we use and why.
Session Cookie (Strictly Necessary)
We use a single session cookie (connect.sid) to keep you logged in. This cookie is httpOnly, secure, and expires after 7 days. It contains only a random session ID, no personal information.
This cookie is strictly necessary for the app to function and does not require consent under EU's ePrivacy directive.
What We Don't Use
We do not use Google Analytics, Facebook Pixel, or any third-party tracking cookies. We do not sell or share your data with advertisers. We do not track you across other websites.
Privacy-First Analytics
We use Plausible Analytics for page-level usage statistics. It is cookie-free, collects no personal data and stores nothing on your device. Plausible processes this data in the EU on our behalf as a data processor and is listed in our sub-processor register. We use no advertising or cross-site tracking tools.
Browser Storage (Not Cookies)
We store your theme preference (light/dark) and language selection (Danish/English) in your browser's localStorage. This data never leaves your device and is not a cookie.
10. International Transfers
Your application data is hosted in the EU. Chat and strategy analysis run on AWS Bedrock in Ireland and do not leave the EU. Voice and podcast features use ElevenLabs, Inc. (USA) under Standard Contractual Clauses until EU data residency is confirmed for our account, and the live voice facilitation beta uses OpenAI, LLC (USA), whose data processing agreement is being finalised. For authentication, Clerk processes data in the United States under the EU-US Data Privacy Framework and Standard Contractual Clauses. A full overview of sub-processor locations is available on our DPA page.