Privacy PolicyDraft
- Status:
- Draft
- Last updated:
- 5 October 2026
- In force from:
- not yet in force
What personal data Sprinthero handles, why, who processes it for us (including our AI provider), and what rights you have.
1. Who we are
Sprinthero.com is owned and operated by Stakeholder Agency (sole proprietorship), CVR no. 26943108 (VAT DK26943108), Robert Jacobsens Vej 26M, 2300 Copenhagen S, Denmark ("Sprinthero", "we", "us").
For questions about this policy or your personal data, write to hello@sprinthero.com.
This policy explains what personal data we handle when you visit sprinthero.com, use the portal, or take part in a Sprint, and what rights you have. It follows the EU General Data Protection Regulation (GDPR) and the Danish Data Protection Act.
2. Two roles: your account, and your organisation's Sprint material
For your account, our website, our own communication with you and our usage statistics, we decide why and how the data is used. We are the data controller.
When a client organisation runs a Sprint with us, the material its team puts into the Sprint (documents, evidence, decisions, questions to the AI coaches, meeting recordings) belongs to that organisation. For personal data inside that material we act on the organisation's behalf, as its data processor, under a data processing agreement with the organisation. If you are a team member and have questions about that material, you can ask us or your own organisation.
3. What we collect
- Account: your name, email address, company, job title and profile picture if you add one. Your password is stored only in protected (hashed) form by our sign-in provider.
- Invitations: if a client organisation gives us your email address so that you can join its Sprint, we create an account for that address and send you an invitation.
- Sprint participation: the Sprint and team you belong to, your role, assignments and what you submit, evidence, deliverables, decisions, daily updates, messages to and from your coach, and announcements.
- AI coach conversations: the questions you and your team ask, the answers, any feedback you give on an answer, and the texts your team adds for the coaches to read.
- Meetings: the team meeting room is provided by Whereby. Meetings are not recorded unless a team member switches recording on, which is always shown to everyone in the team. When it is on, a recording and a transcript are stored.
- Forms on the website: what you enter in the readiness scan, surveys, the Sprint wizard and contact or quote requests.
- Payments: if you pay us online, our payment provider handles your payment details. We receive confirmation of the payment, not your card number.
- Email records: which emails we sent to you and whether they could be delivered, and whether you have unsubscribed.
- Usage and technical data: pages you view and actions you take in the portal, your IP address, browser and device type, and server logs.
We do not ask for sensitive personal data (such as health information, political opinions or trade union membership), and we ask you not to put such data, or personal data about other people that you have no right to share, into the portal or into questions to the AI coaches.
4. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Giving you an account and the portal; running the Sprint you take part in; the AI coaches; the meeting room | Performance of our contract with you or with your organisation (GDPR Art. 6(1)(b)), and our and your organisation's legitimate interest in running the Sprint (Art. 6(1)(f)) |
| Sending invitations, sign-in links, announcements and notifications about your Sprint | Contract and legitimate interest |
| Recording and transcribing a meeting | The team's decision to switch it on; the legitimate interest of the team and its organisation in keeping a record. [To be confirmed in legal review: consent of each participant.] |
| Answering enquiries, readiness scans and quote requests | Steps taken at your request before a contract; legitimate interest |
| Newsletters and marketing email | Your consent, which you can withdraw at any time (Art. 6(1)(a)) |
| Usage statistics to improve the service | [Your consent, once a cookie choice is in place. See section 9.] |
| Security, preventing misuse, and keeping the service running | Legitimate interest |
| Bookkeeping and tax | Legal obligation (Art. 6(1)(c)) |
5. The AI coaches and other AI features
The portal includes AI coaches that answer questions, review submitted work and prepare teams for decisions. They are run on Claude, an AI model from Anthropic. Some other features (for example the written summary of a readiness scan, or a first draft of a Sprint charter for the coach) use the same provider.
- What is sent: when someone asks an AI coach a question or requests a review, we send Anthropic the question, the conversation so far, the Sprint charter, and the parts of the team's Sprint records and added knowledge sources that are relevant. Names of team members appear where they are part of that material.
- No training: under Anthropic's commercial terms, Anthropic may not train its models on content we send through its service. We do not use your Sprint material to train AI models either, and we do not send it to any other AI provider.
- How long Anthropic keeps it: Anthropic states that it deletes inputs and outputs within 30 days, except where it must keep them longer to enforce its usage policy (content flagged as a violation can be kept for up to two years) or to comply with law.
- Where: Anthropic processes the data in the United States. The transfer is covered by the EU Standard Contractual Clauses in Anthropic's data processing addendum.
- Searching your material: the search that finds relevant passages for a coach runs inside our own database in the EU. Your material is not sent to a separate search or indexing provider.
- People stay in charge: every AI coach works within a charter approved by the human Head Coach of the Sprint, who can read every AI coach conversation. You or the AI coach can bring the Head Coach into a conversation at any time.
- Labelled and fallible: everything an AI coach writes is marked as coming from an AI coach. AI answers can be wrong or incomplete. The AI coaches do not make decisions about you, and we make no decisions with legal or similarly significant effect for you by automated means alone.
- Who can read a conversation: your whole Sprint team, the coaches of your team and Sprint, and Sprinthero's back office.
6. Who we share data with
We do not sell personal data. We share it only with the people in your Sprint as described above, and with the providers below, who process it for us under data processing agreements.
| Provider | What it does for us | Data it handles | Where |
|---|---|---|---|
| Supabase | Database, sign-in and file storage | All account and Sprint data | EU (Ireland) |
| Vercel | Hosting of the website and portal | Requests to the site, including IP address; server logs | Our server code runs in the EU (Dublin); Vercel is a US company |
| Anthropic (Claude) | The AI coaches and other AI features | The question asked, the Sprint charter, and the team's Sprint records and knowledge sources that are relevant to it | United States |
| Brevo | Sending email (invitations, sign-in links, announcements, notifications) | Email address and the content of the email | EU (France) |
| Whereby | Team meeting rooms; recordings and transcripts when a team switches them on | Audio and video during a meeting; recordings and transcripts if switched on | EU/EEA (Whereby is a Norwegian company) |
| Stripe | Payments | Name, email, billing and payment details. We never see or store full card numbers | EU (Ireland) and United States |
| PostHog | Usage statistics | Pages viewed and actions in the portal; for signed-in users also user ID, name, email, company and title | EU (Germany) |
| Cloudflare | Domain name service | Technical lookup data only | Global |
| Proton | Our own email inboxes | Emails you send to us | Switzerland |
We may also disclose data when the law requires it, or to advisers and authorities when necessary to establish or defend legal claims. If the business is sold or merged, personal data may pass to the new owner under the same protection.
7. Transfers outside the EU/EEA
Most of our data is stored in the EU. Some providers are based in, or process data in, the United States or another country outside the EEA (see the table above). For those transfers we rely on the European Commission's Standard Contractual Clauses in our agreements with the provider and, where the provider is certified, on the EU-US Data Privacy Framework. You can ask us for a copy of the relevant safeguards.
8. How long we keep it
- Account: until you ask us to delete it, or [24] months after your last sign-in.
- Sprint material, including AI coach conversations and knowledge sources: for the Sprint and [12] months after it ends, unless the client organisation asks for earlier deletion or a different period is agreed.
- Meeting recordings and transcripts: until the team, the client organisation or we delete them, and at the latest [6] months after the Sprint ends.
- Enquiries, readiness scans and quote requests: [24] months.
- Email records: [24] months. Unsubscribe and do-not-email records are kept for as long as needed to respect your choice.
- Bookkeeping records: five years after the end of the financial year, as Danish law requires.
- Usage statistics: [12] months.
9. Cookies and similar technologies
We store what is needed to keep you signed in in your browser. This is necessary for the portal to work.
We use PostHog to understand how the site and portal are used. [To be completed before publication: statistics cookies require your consent under Danish cookie rules. Until a cookie choice is in place on the site, this section and the site itself need to be brought into line.]
10. Security
Data is encrypted in transit and at rest. Access inside the portal is restricted in the database itself, so that a team can only read its own Sprint, and the AI coaches of one Sprint can only read that Sprint's material. Secrets and provider keys are kept on the server. No method of transmission or storage is completely secure, and we will tell you and the Danish Data Protection Agency about a personal data breach where the law requires it.
11. Your rights
You have the right to ask for access to your personal data, to have it corrected or deleted, to restrict or object to our use of it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to hello@sprinthero.com; we answer within one month.
If your request concerns material in a client organisation's Sprint, we may need to involve that organisation, since it decides over that material.
You can complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk), or to the authority in the EU country where you live.
12. Children
The service is for people acting in a professional capacity and is not intended for anyone under 18.
13. Changes to this policy
We will update this policy when the service or the providers we use change. If a change matters for how your data is used, we tell you by email or in the portal before it takes effect.
See also our Terms of Service.