Project01 - Data Collection & Processing Disclosure

• Identity & account data: name, email address, encrypted password or Google sign-in identifier, profile picture (if using Google sign-in).
• Security & session data: sign-in timestamps, session identifiers, and (via our infrastructure provider) IP address and browser/device information, used to detect suspicious activity such as credential stuffing.
• Audit trail: a security log of account events (sign-in, sign-out, password changes, account deletion, etc.), used for fraud and abuse prevention.
• Startup / business content: your startup's profile, description, business model, team, target audience, competitive landscape, funding and revenue status, and traction - treated as confidential business information.
• User-generated workspace content: chat conversations, canvases, generated documents, templates, and product-planning items (features, flow diagrams) created inside the platform.
• Customer & market research content: research boards, interview records, transcripts and quotes (which may include personal data about people who are not Project01 users - see Section 3), and competitor profiles.
• Uploaded files: any file you upload to a research or idea-workspace attachment, currently without a file-type restriction.
• AI-derived data: summaries, extracted "signals," and vector embeddings generated by our AI features from the content above, used to power search, clustering and insight features.
• Analytics data: page views, referring page, browser/OS, device type and country, collected without cookies and without storing IP addresses.
• Local device data: unsaved form drafts and interface preferences, stored only in your browser and never transmitted to us.

Our research tools are designed to help you organize customer interviews and competitive research - by nature, this means the platform can hold personal data about people (interviewees, contacts) who never signed up and never saw a Project01 privacy notice. As explained in our Terms & Conditions and Privacy Policy: if you enter this kind of data, you are responsible for it as the controller, and we process it as your processor, on your instructions. We do not independently reach out to these individuals or use their data for any purpose beyond providing you the Service.

We do not currently operate an automatic data-minimization or deletion schedule for content inside the platform. This is an intentional, honest disclosure rather than a promise of automatic deletion: content persists until you or we remove it.

• Row-level security enforced on every database table, so a user can only access data belonging to their own workspace(s).
• File storage buckets are private (not publicly accessible).
• Encryption in transit (TLS) and at rest across all of our infrastructure providers.
• Database backups are encrypted before leaving our infrastructure.
• Access to sensitive service credentials is restricted to server-side systems and is not exposed to end users or the browser.

On formal certifications: Project01 does not currently hold an independent security certification such as SOC 2, ISO 27001, or similar. This is common for a pre-launch product and something we may pursue as the platform matures. Several of the infrastructure providers we rely on (for example, our hosting and database providers) maintain their own independent compliance certifications and audit reports, details of which are available in their own public documentation.

If we become aware of a security incident affecting personal data, we will: (1) investigate and contain the incident; (2) assess whether it constitutes a reportable personal data breach under applicable law; (3) where required, notify the competent supervisory authority (AZOP in Croatia) without undue delay, and where feasible within 72 hours of becoming aware; and (4) notify affected users directly where the breach is likely to result in a high risk to their rights and freedoms.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and similar U.S. state privacy laws. California and other applicable U.S. state residents may exercise rights to know, delete, and correct their personal information, and will not be discriminated against for doing so, by contacting support@project01.io.

The only cookie set by Project01 is a strictly necessary authentication cookie required to keep you signed in. Our analytics provider (Umami) does not use cookies. Because no non-essential cookies are used, we do not currently display a cookie-consent banner. If this changes in the future (for example, if we add advertising or additional analytics tools), we will implement an appropriate consent mechanism at that time.

For any question about how data is collected or processed on Project01, contact support@project01.io.