Privacy Policy

1. Controller

The controller responsible for data processing in this application is:
Nicolas Bell
Sedanstr. 24, 81667 München, Germany
Email: hello@rigon.app

2. Data processed and purposes

Rigon is an application for the structured creation of consulting presentations with AI support. We process:

• Account data (email, name, organization membership) to provide login. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
• Deck content (briefings, phase outputs, conversation history) to create the presentations. Legal basis: Art. 6(1)(b) GDPR.
• Uploaded documents and URL content as phase input, if you use this feature. Legal basis: Art. 6(1)(b) GDPR.
• API keys (BYOK) that you store for access to the Claude API. They are stored only in encrypted form and are not passed on. Legal basis: Art. 6(1)(b) GDPR.
• Audit log (security-relevant actions without content data) for traceability. Legal basis: Art. 6(1)(f) GDPR (legitimate interest: security, accountability).
• Workflow analytics (anonymized usage data, no content) to improve the product. Legal basis: Art. 6(1)(f) GDPR.

3. Processors

The following service providers process data on our behalf. A data processing agreement (DPA) under Art. 28 GDPR is in place with all of them. Transfers to the USA are based on the EU-US Data Privacy Framework or on standard contractual clauses. For Anthropic, the standard contractual clauses in the data processing agreement apply.

• Anthropic, PBC (USA): Claude API for AI-supported workflow processing. Your content is not stored for training. Standard retention on the API provider's side is 7 days.
• Clerk, Inc. (USA): authentication and login management (email and password, Microsoft 365, Google).
• Vercel, Inc. (USA, compute region Frankfurt): app hosting, server logs, object storage for uploaded documents.
• Neon, Inc. (USA, data region Frankfurt): managed PostgreSQL database for persistent app data.

4. Retention period

• Account and deck data: until you delete your account.
• Audit log entries: 12 months.
• Uploaded documents: tied to the respective deck or phase, soft delete + 30 days.
• Anonymized workflow analytics: 24 months (raw data), aggregated indefinitely.

5. Your rights (Art. 15-22 GDPR)

You have the right to access, rectification, erasure, restriction of processing, data portability and objection.

Self-service: In your account settings you can export your data (Art. 20 GDPR) and delete your account with all associated data (Art. 17 GDPR).

For other requests, you can reach us at hello@rigon.app. We respond within 30 days.

You also have the right to lodge a complaint with the competent supervisory authority (in Bavaria: Bayerisches Landesamt für Datenschutzaufsicht, Ansbach).

6. AI processing

Rigon uses Claude (Anthropic) to structure presentations. Only the context relevant to the current phase and your briefing are sent to the Claude API. Anthropic does not use your input for AI training. All outputs are AI-generated and you must review them before use.

Processing runs directly through Anthropic's Claude API in the USA. Under Settings you can store your own Anthropic API key. Processing then runs through your own account with Anthropic, and your terms with Anthropic apply.

7. Encryption

All connections are encrypted with TLS 1.3. Data in the database is encrypted by the hosting provider. Stored API keys are additionally encrypted with AES-256-GCM.

8. Changes

This privacy policy applies to the beta phase and will be replaced before the public launch by a version reviewed by a specialist lawyer. We will notify you of changes by email to your account address.