Privacy Policy

Who is responsible for your data

AI Launchpad (AIL) is operated by rhubarb llc (the data controller). For any privacy or data protection question, contact us at privacy@ail.academy. We will respond within 30 days as required by GDPR Article 12(3).

What data we collect

• Assessment responses (your answers to intake questions)
• Profile scores (capability estimates, skill depths, mindset dimensions)
• Action completions (experiment titles, dates, reactions)
• Reflection text (your optional written reflections)
• Sharing preferences (your coach sharing settings)
• Device and browser metadata (for analytics and performance)

How we use your data

• Building and updating your personal AI profile
• Sharing summaries with your coach (only with your permission)
• Generating anonymous aggregate patterns for organisations (groups of 10+)

Who can see what

• You: everything about your profile, responses, and history
• Your coach: only what you choose to share (capability summary, experiment completions)
• Your organisation: only aggregate analytics across groups of 10 or more, never individual data

Data retention

Your data is retained while your account is active. When you delete your account, all personal data is permanently removed. Anonymised aggregate data may be retained for research purposes.

Third-party processors

• Supabase Inc. — database hosting and authentication (data hosted in Frankfurt, EU).
• Vercel Inc. — application hosting and CDN (regions configured for EU traffic).
• Resend, Inc. — transactional email (sender domain: ail.academy).
• Anthropic PBC — AI model provider for personalised narratives and recommendations.
• Sentry / Functional Software — error reporting (used only with your analytics consent).
• Langfuse GmbH — AI request observability (used only with your analytics consent).

International data transfers

Some of our processors are based outside the European Economic Area. We rely on Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework where applicable to ensure your data is protected at an equivalent level. You may request a copy of the relevant transfer mechanisms at any time.

Cookies and local storage

• Session tokens (authentication)
• Onboarding completion flag (to avoid showing the welcome overlay again)
• Language preference (your chosen language)

Your rights under the GDPR

• Access (Art. 15): request a copy of all personal data we hold about you.
• Rectification (Art. 16): correct inaccurate or incomplete data.
• Erasure (Art. 17): delete your account and personal data ('right to be forgotten').
• Portability (Art. 20): export your data in a machine-readable format (JSON).
• Restriction (Art. 18): ask us to limit how we process your data while a concern is being resolved.
• Objection (Art. 21): opt out of processing based on legitimate interest, including aggregate analytics.
• Withdraw consent (Art. 7(3)): for processing based on consent, withdraw at any time without affecting prior lawful processing.

To exercise any of these rights, email privacy@ail.academy. We will respond within 30 days. There is no fee unless the request is manifestly unfounded or excessive.

Right to lodge a complaint

If you believe we are not handling your data lawfully, you have the right to lodge a complaint with your local supervisory authority. For users in the EU, you can find your authority at edpb.europa.eu/about-edpb/about-edpb/members_en. We'd appreciate the chance to address your concern first — please contact us at privacy@ail.academy.

Legal basis for processing (GDPR Art. 6)

Consent (Art. 6(1)(a)) for optional features such as analytics cookies and aggregate-research contribution. Performance of a contract (Art. 6(1)(b)) for delivering your personal profile and discovery flow. Legitimate interest (Art. 6(1)(f)) for core service operation, fraud prevention, and security — balanced against your rights and freedoms.

Contact

Email: privacy@ail.academy For general queries: hello@ail.academy