Privacy Policy

1. Introduction

Data Value Partners B.V. ("DVP", "we", "us") operates Cockpit, a knowledge management and data intelligence platform. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Platform.

We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

Our commitment: We use your data solely to deliver and improve Cockpit for you. We will never sell your data or share it with third parties for their own purposes. We may analyze anonymized usage patterns and interactions to improve the Platform's accuracy and features. Everything we do with your data serves one goal: making the product better for you.

2. Data Controller

Data Value Partners B.V., registered in the Netherlands, is the data controller for the personal data processed through the Platform. For questions about data processing, contact us.

3. Information We Collect

3.1 Account Information

When you create an account, we collect your name, email address, and authentication credentials. If you sign in via a third-party provider, we receive basic profile information from that provider.

3.2 Session and Usage Data

We collect session information including your IP address, browser type, and session timestamps. This data is used for security monitoring and to maintain your authenticated session.

3.3 Connected Storage Data

When you connect a cloud storage service (such as Microsoft OneDrive, SharePoint, Google Drive, or Dropbox), we access your files using secure, authorized connections that you control. This means:

• We request read-only access to your files. We cannot modify or delete your files in the connected service
• We access only the files and folders you have authorized
• We store encrypted credentials to maintain your connection. These are deleted when you disconnect
• We download and process content to power the Platform's search and intelligence features

3.4 Content and Data

When your data is processed, we create derived representations including indexes, summaries, and knowledge graph structures. This derived data powers the Platform's search and intelligence features.

3.5 Conversations and Interactions

When you use the Platform's AI-powered features, we store your questions, prompts, and the Platform's responses. This data is used to provide you with conversation history and to improve the accuracy and relevance of the Platform's answers. We do not share your conversations with third parties or use them to train AI models.

4. How We Use Your Information

We process your information for the sole purpose of delivering and improving the Platform. Specifically:

• Providing the service — authenticating your account, accessing your connected storage, processing your data, and enabling search and retrieval
• Security — monitoring for unauthorized access, preventing abuse, and maintaining the integrity of the Platform
• Product improvement — analyzing how features are used to make the Platform better for all users. We never use your content or conversations for purposes outside of delivering the product.
• Communication — sending you service-related notifications such as account approvals and system alerts

The legal basis for processing is your consent (connecting storage services), performance of a contract (providing the Platform), and our legitimate interest (security and service improvement).

5. Data Storage and Processing

5.1 Where Your Data Is Stored

Your data is hosted within the European Union (primarily the Netherlands, with some supporting services in other EU regions). Your data is stored in managed databases and search infrastructure within the EU. All storage is encrypted at rest, and all connections are encrypted in transit.

5.2 AI Processing

Your content is processed by AI services hosted within the European Union to generate search indexes and intelligent answers. Our AI service providers operate under data processing agreements that prohibit them from using your data for their own purposes, including training their models. We may use aggregated interaction patterns to improve the Platform's accuracy, but we will never provide your content to third parties.

5.3 Data Retention

We retain your account data for as long as your account is active. Content and derived data are retained until you disconnect the source or delete the workspace. Session data is retained for security monitoring purposes.

When you disconnect a storage connector, the associated content and all derived data are deleted. Encrypted credentials for the connection are removed immediately.

When your account is deleted, we remove your personal data within a reasonable timeframe. Backup copies may persist briefly as part of standard disaster recovery processes.

6. Data Sharing

We do not sell, rent, or trade your personal information or your content. We do not provide your data to third parties for advertising, profiling, or any purpose other than operating the Platform. We share your data only in these circumstances:

• Infrastructure and AI providers — we use trusted cloud and AI service providers to host and operate the Platform, subject to strict data processing agreements that prohibit them from using your data for their own purposes
• Within your workspace — other members of your workspace may access shared content and search results, as configured by your workspace administrator
• Legal requirements — we may disclose information if required by law, regulation, or legal process

7. Your Rights

Under the GDPR and applicable data protection laws, you have the right to:

• Access your personal data and request a copy
• Rectify inaccurate personal data
• Erase your personal data ("right to be forgotten")
• Restrict processing of your personal data
• Port your data to another service. This includes your personal information and the original content you provided to the Platform
• Object to processing based on legitimate interest
• Withdraw consent at any time for consent-based processing

To exercise these rights, contact us via our contact form. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.

8. Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption of all data in transit and at rest
• Encrypted storage of connection credentials, removed immediately when you disconnect a service
• Protection against common web security threats on all endpoints
• Role-based access controls at both system and workspace levels
• Regular security assessments and dependency monitoring

9. Revoking Access to Connected Services

You can disconnect a storage connector at any time from the Platform's Settings page. Additionally, you can revoke the Platform's access directly from your storage provider:

• Microsoft — account.microsoft.com/privacy/app-access
• Google — myaccount.google.com/permissions
• Dropbox — dropbox.com/account/connected_apps

When your account is removed from the Platform, whether by you, your workspace administrator, or as part of account cleanup, all stored connection credentials are permanently deleted, and derived data associated solely with your account is scheduled for removal.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform and updating the "Last updated" date. We encourage you to review this policy periodically.

11. Contact

For questions or concerns about this Privacy Policy or our data practices, contact us via our contact form.