ChiefLab privacy & data

you are the controller . We are the processor .

Account: email, workspace ID, API key (stored as a SHA-256 hash, never the raw key).

Billing: Stripe customer ID and plan tier (when wired). We do not store card numbers; Stripe does.

IP address, user agent, request timestamps for rate limiting and abuse detection.

Audit log — who accessed what within your workspace.

Brain — brand voice samples, repo facts, ICPs, proof points, competitor watch, approved drafts

Operate the service you signed up for.

Bill you (when applicable).

Detect and prevent abuse.

Improve the service using aggregated, non-identifying signals only.

Comply with law and respond to legally valid requests (and challenge improper ones).

Active workspace data — kept while your workspace exists.

deleted within 30 days of a workspace deletion request

Supabase point-in-time recovery retains up to 7 days of historical state past a hard delete.

Audit log — 90 days minimum, longer on Enterprise.

Billing records — 7 years (tax / accounting legal obligation).

Primary database: Supabase, US region by default.

EU region available on Enterprise.

For transfers from EEA / UK / Switzerland to outside, Standard Contractual Clauses (EU Commission Decision 2021/914) apply

Subprocessors at /legal/subprocessors , each bound by data protection terms substantively equivalent to this policy and the DPA .

The Data Processing Agreement is the contract that governs that relationship. Sign it with your enterprise buyers

chieflab_delete_workspace({ confirm: "DELETE-MY-WORKSPACE" }) — Shipped. Hard-purges all workspace data across 38+ tables, revokes the API key, returns a deletion receipt.

Access — chieflab_export_workspace() returns a full structured JSON dump.

Correction — edit via /app or email hi@chieflab.io .

Deletion — chieflab_delete_workspace({ confirm: "DELETE-MY-WORKSPACE" }) hard-purges across 38+ tables on confirmation.

Portability — same as Access; the export is structured JSON, importable elsewhere.

Object / restrict / withdraw consent — email privacy@chieflab.io .

California residents (CCPA/CPRA) — right to know, delete, correct, opt out of sale (we don't sell)

We do not sell personal data. Ever.