Your data. Your control.

Who is responsible?

The legal operator name is awaiting confirmation. A public privacy email is not yet configured. During the private test, submit a Privacy or data request in Help & requests.

Information the service handles

Sign-in supplies an account identifier, email and available name. We store your membership settings, selected advisors, optional preferred name, cropped profile photo and business context, onboarding choices, briefs, clarifications, saved advisor responses, conversation history, files and extracted text, support requests and replies, decision review dates, outcomes and feedback. Business context is supplied to a debate only when you choose to include it in that brief. Technical records include usage totals, provider request identifiers, administrative changes and security/hosting logs. Public-source advisor notes can identify the people whose work is being referenced.

Why it is used

Account and workspace information is used to provide the service you request. Operational records support reliability, abuse prevention, cost controls and resolving disputes. The proposed UK GDPR bases are contract for requested account/service functions, legitimate interests for proportionate security and administration, and legal obligation where applicable. The operator must confirm and document these legal bases; this review remains outstanding. We do not add your private documents to the shared advisor library through the member workflow.

AI processing and service providers

When a live request is explicitly started and authorised, the question, relevant selected advisor notes, chosen document excerpts and relevant debate/chat history are sent to the configured OpenAI API service. Hosted identity and application infrastructure are provided through ChatGPT Sites and its infrastructure providers; this app uses Cloudflare D1/R2 bindings for structured records and files. These are external processors, so this is not end-to-end private storage. A technical provider review is available from owner Platform controls. OpenAI API text requests use store=false; background responses are temporarily retained for polling, and provider abuse-monitoring retention is separate. Account-specific contracts, processing locations and international-transfer safeguards still need operator confirmation. Stripe test checkout receives a pseudonymous account reference and subscription choices; card details are entered on Stripe, not stored by Round Table. A Netlify-hosted relay receives signed sandbox billing events and forwards them to the private app. Those events can contain customer/subscription identifiers, contact information and invoice details. The relay code does not log event bodies or credentials; provider operational records remain subject to Netlify’s policies. No member briefs, advisor knowledge or AI credentials are sent through this relay. The operator must include Netlify in the final provider and transfer review; that review remains outstanding. No UK-only residency or zero-retention guarantee is made.

Who can see it?

Other members cannot browse your workspace or request inbox. Application routes check ownership. The operator and authorised service providers may access information where necessary to operate, investigate or protect the service. Member-management screens do not expose private chat and vault content. Details you place in a support request are visible to the owner and authorised support staff; files and briefs are not automatically attached to it.

Retention and deletion

Your records remain saved until you remove them or the operator handles an account request. Deleting a vault item does not remove excerpts already saved inside other briefs or conversations. Usage/audit receipts and cached provider-job records are held separately and may remain after a workspace record is deleted. The operator has a monthly, explicitly confirmed cleanup process for settled/completed provider-response caches after 30 days and closed support content after 180 days. Knowledge and saved workspace content are not automatically deleted by age. Daily snapshots are encrypted in the hosting storage using a recovery key kept outside the website. Completed snapshots older than 30 days are removed when a new backup succeeds. Account closure purges hosted snapshots and rehearsal copies that could contain erased content; interrupted cleanup keeps the account locked for retry. Manual exported copies remain the operator’s responsibility and must be encrypted, limited to 30 days and reconciled with erasure. Same-host snapshots do not provide independent off-site protection. Final production periods for pseudonymous receipts and provider backups still require legal/provider review; this remains a public-launch blocker. We do not promise immediate deletion from every provider system.

Your choices and rights

Ask to access or correct information, request erasure or restriction, and request portability where applicable. You can object to processing based on legitimate interests. If optional consent-based processing is introduced, you can withdraw that consent. Rights depend on the purpose and applicable law; we may need to verify your identity and explain any lawful exception. Use a Privacy or data request in the member inbox.

You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. You do not have to complete our complaints process first.

Required information and decision-making

An account identifier and email are needed to associate your workspace with your sign-in; without them the member service cannot work. Documents and optional context are your choice. Advisor outputs are suggestions for you to assess, not automated eligibility decisions or professional advice. Do not use the platform to make consequential decisions about other people without appropriate human judgement and lawful safeguards.