Project01 - Privacy Policy

Project01 is operated by an informal team of four founders based in Croatia. We are not yet a registered legal entity. For data protection purposes, we currently act as the data controller for the personal data described in this Policy, through that team. We have not appointed a formal Data Protection Officer, as we do not currently carry out large-scale systematic monitoring or large-scale processing of special-category data that would require one under Article 37 GDPR.

We collect data about four different groups of people, and this Policy addresses each:

• Registered users - people who create a Project01 account.
• Invited people who haven't signed up yet - if a user invites someone to a workspace, we hold that person's email address until the invite is accepted or revoked.
• People named in research you conduct - if you use Project01's research tools to record customer interviews, competitor information, or similar, the names and details of those third parties may be stored on the platform. See Section 4 below - this is important if you are a founder using these tools, and important if you are one of these third parties.
• Site visitors - anyone who loads the Project01 website, even without an account, generates limited, non-cookie analytics data.

We use the data described above to: operate and provide the Service; power AI features (via our AI provider, described below); maintain the security of accounts and detect misuse; respond to support requests; and, in the future, send product updates or a newsletter if you opt in.

We use a limited set of service providers ("sub-processors") to operate Project01. None of them are permitted to use your data for their own purposes. The table below lists who they are, what they receive, where they're located, and how international transfers are safeguarded.

A note on Anthropic specifically, since it powers our AI features: prompts and content you submit to AI features (including startup and research content, and text extracted from documents you upload) are sent to Anthropic for processing. According to Anthropic's own published terms, conversation content is not retained by default and is not used to train their models without permission; content may be retained longer only if flagged for trust-and-safety review (up to 2 years). You can read more about Anthropic's approach to privacy at their published privacy documentation.

Several of our providers are US-based (Anthropic, Vercel, GitHub, and the underlying entity behind Resend and Cloudflare, among others). Personal data may therefore be transferred outside the European Economic Area. Where this happens, we rely on Standard Contractual Clauses and, where applicable, the provider's certification under the EU-US Data Privacy Framework, as summarized in the table above.

We are honest that we do not yet have a formal retention schedule. In practice: content you and your team create is kept for as long as your account and workspace exist, with no automatic deletion. Certain provider-side logs and backups are deleted on a fixed schedule. See the table below for specifics.

Depending on your location, you may have the right to: access the personal data we hold about you; correct inaccurate data; request deletion; request a copy of your data in a portable format; object to or restrict certain processing; and lodge a complaint with your local data protection authority (in Croatia, this is AZOP - Agencija za zaštitu osobnih podataka, Zagreb).

To exercise these rights, email support@project01.io. We will respond within the timeframes required by applicable law.

We want to be specific and honest here, because "delete my account" can mean different things:

• If you are the only member of a workspace and you delete your account, that workspace and its data are deleted along with it.
• If you delete a workspace but keep your account, that startup's data is deleted, but your account itself continues to exist.
• In a shared workspace, only the workspace owner can delete the workspace itself.
• If you delete your account while remaining part of a shared workspace, your directly identifying account information (name, email) is removed or anonymized, but content you contributed to that shared workspace remains, now attributed to a "deleted user," so that your teammates' work is not disrupted.
• You have a 30-day window after requesting deletion to recover your account before the change becomes final.
• Certain AI-derived records (for example, excerpts used to generate research insights) are stored in an append-only format for integrity reasons and may not be fully removable through the standard deletion process today. If this affects you specifically, contact us and we will do what we can on a manual basis.

Project01 does not currently operate age verification or a minimum-age gate, similar to the general posture of other widely used AI platforms. If you are a parent or guardian and believe a minor has provided us with personal data you did not authorize, contact us at support@project01.io and we will address it.

We use industry-standard measures appropriate to a pre-launch product, including: row-level security on our database, private (non-public) file storage, encryption in transit (TLS) and at rest with all providers, encrypted database backups, and server-side-only access to sensitive service credentials. We have not yet obtained an independent security certification such as SOC 2; several of our infrastructure providers maintain their own compliance certifications, described in their own documentation.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (AZOP) without undue delay, and where feasible within 72 hours of becoming aware of it, and will notify affected users directly where required by law.

If you are a California resident, you have the right to: know what personal information we collect and how it's used; request deletion of your personal information; request correction of inaccurate personal information; and opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising. We will not discriminate against you for exercising these rights. To exercise them, email support@project01.io; we may need to verify your identity before acting on the request. An authorized agent may submit a request on your behalf with appropriate written permission.

We may update this Policy from time to time. We will post the updated version with a new "Last updated" date, and, for material changes, will make reasonable efforts to notify active users in advance.

Questions or requests regarding this Policy can be sent to support@project01.io.