Privacy Policy

Information we collect

We collect account and contact details such as name, work email, company name, role, company size, and information submitted through our lead forms.

When you upload CSV, XLSX, or other business files, we process the file contents to generate dashboards, metrics, and related analysis for your workspace.

If you choose paid direct integrations, we collect the authorization tokens and metadata needed to connect to the tools you approve. We do not ask for or store your source-system passwords.

How we use information

We use customer data to provide CEODash dashboards, process uploads, maintain integrations, respond to requests, improve reliability, and protect the service from abuse.

We may use aggregate, de-identified usage information to understand product performance and improve onboarding. We do not sell customer data.

Files and direct integrations

File-based use of CEODash is free. Paid direct integrations are optional and only connect after you authorize them.

Uploaded files and integration results are scoped to the customer workspace. Connected sources remain under your control and can be disconnected at the source or in CEODash.

Cookies

CEODash uses essential cookies for security, sessions, preferences, and basic site operation.

With your permission, CEODash may also use two first-party attribution cookies: cd_utm remembers campaign parameters such as utm_source, utm_medium, and utm_campaign for up to 30 days, and cd_attr remembers how you first reached the site (those campaign parameters, the referring site without its address details, the page you landed on, and when) for up to 90 days. If you create an account, that first-visit record is stored with it so we can see which channels bring customers.

If you do not accept marketing cookies, CEODash still notes how you reached the site for the duration of that single visit: the record is held in your browser tab’s memory, nothing is written to your device, and it is sent only if you create an account in that same visit. Close the tab, reload the page, or come back another day without accepting, and it is gone and your channel is recorded as unknown.

You can decline marketing cookies in the cookie banner. Declining removes the attribution cookies and prevents CEODash from writing them again unless you later accept.

Sharing and processors

We use the providers named below to operate the service. They may process data only as needed to provide their services to CEODash.

Sub-processors we use: Hetzner — hosting and compute plus DNS — Helsinki, Finland (EU). Supabase — database and file storage, the primary customer-data store — Stockholm, Sweden (EU). Anthropic — AI processing for the in-product assistants — United States (cross-border). Stripe — payments and subscription billing — US / global (cross-border). Resend — transactional email such as verification and password reset — US (cross-border). ImprovMX — inbound support-email forwarding — region being confirmed (cross-border).

Also in the processing chain: Google is engaged only if you connect Google (Calendar/Gmail), a private-beta integration, and not otherwise; GitHub / GHCR hold our source and builds, not your application data by default; Cloudflare hosts an internal DevOps tool that receives administrator-filed diagnostics, and the customer app itself does not run on Cloudflare.

Cross-border transfer, stated explicitly: your data is stored in the EU, but AI processing (Anthropic) occurs in the United States. Payments (Stripe) and transactional email (Resend) are US / cross-border. If you connect Google, that processing is global.

Voice input is transcribed on our own servers in the EU. We do not share recordings with any provider, and we do not keep them: the audio is discarded once it has been turned into text.

We may disclose information if required by law, to protect users or the service, or as part of a business transaction such as a merger or acquisition.

Retention and deletion

We keep customer data only as long as needed to provide the service, comply with legal obligations, resolve disputes, and maintain security records.

Customers can request export or deletion by contacting support@ceodash.tools. Some audit, billing, or security records may be retained where required for legitimate business or legal reasons.

Contact

Questions about privacy or data requests can be sent to support@ceodash.tools. We will route privacy requests to the appropriate team member and respond as soon as practical.