Clear choices. Limited data. No hidden tracking.
This notice covers the public snapshot, requests for a full assessment, invited campaigns, reports and operator workspaces.
1. Controller and contact
Macrocyra UG (haftungsbeschränkt)
Balbronner Str. 4
14195 Berlin
Germany
Represented by Clemens Chaskel, Managing Director
Privacy: gdpr@innovationflow.app
General contact: admin@innovationflow.app
If a data protection officer is appointed or becomes legally required, their contact details will be published here.
2. Scope and controller roles
Macrocyra is controller for the public website and snapshot, full-assessment enquiries, its operator accounts, service security, direct support and optional product analytics. For a client-sponsored campaign, the named client will usually determine the purpose and participant group as controller, while Macrocyra processes campaign content under documented instructions and Article 28 GDPR terms. The invitation and campaign notice identify the actual controller, purpose and retention period before participation.
Do not include special-category data, personal allegations, trade secrets or unnecessary names in open text unless the controller has expressly approved the need and safeguards.
3. Data we process
| Data | Purpose and treatment |
|---|---|
| Technical requests | Network and hosting providers process IP address and request metadata to deliver and protect the service. Privacy-minimised application events record time, request ID, method, route, status, duration and deployment data; they exclude query strings, request bodies and assessment answers. |
| Public snapshot | Context choices and fifteen P-B-C answers are used to create the private individual result and recommend a route to depth. No name or email is required for the snapshot itself. |
| Contact enquiries | The Get in touch form sends your name, email and message to Clemens Chaskel through Resend so he can reply. It does not attach survey answers, private invitation links or page identifiers. Contact messages are handled in the email system, not stored as survey responses. |
| Full-assessment request | Name, work email, organisation, decision scope, expected participant group, selected topics, recommendation, consent version and timestamps are stored separately from snapshot answers. |
| Operator and participant access | Name or label, email, role/function, account or invitation status, timestamps, and hashed session, invitation and recovery tokens support authorised access, delivery, revocation and audit attribution. |
| Invited assessment data | Project context, topic-specific core answers, eligibility-based deepeners, factual checks, optional free text and saved drafts produce individual and privacy-gated cohort reports. Completed responses retain versioned question and answer snapshots. |
| Evidence and report governance | Evidence snapshots, calibration, review, approval, release, withdrawal, export checksums, actions and named operator attribution make reporting auditable. |
| Product feedback | Page path, feedback type, optional rating, note, status and timestamps support defect resolution and product improvement. Assessment answers are not copied into feedback. |
| Optional InnovationFlow Companion | Only an operator-confirmed, privacy-thresholded group aggregate is sent to the configured AI provider. It excludes names, email addresses, participant IDs, free text and raw individual submissions. Provider/model/prompt versions, response ID, evidence references and approval history are retained. |
4. Full-assessment requests and notification email
When you request a full assessment, the contact and scoping data listed above are recorded in the restricted facilitator pipeline. A transactional email containing those details and a protected internal review link is sent to the configured InnovationFlow facilitator. The email uses your address as the reply address so the facilitator can respond. Snapshot answers and the result identifier are not included.
Submission permits Macrocyra to respond, clarify scope and prepare requested pre-contractual steps. It does not create an account or campaign. You may withdraw the contact consent through gdpr@innovationflow.app.
5. Cookies and browser storage
Essential HTTP-only cookies protect operator and invited-participant sessions and the private public-snapshot result. They contain opaque or signed identifiers and expire automatically. A host-specific preference cookie on each assessment subdomain remembers essential-only or analytics consent for 180 days. Assessment drafts use tab-scoped sessionStorage for refresh and save/exit recovery; invited full-assessment drafts are also saved server-side against the authorised participant record and removed on completion.
| Name | Purpose |
|---|---|
innovation_momentum_beta | Essential operator session, normally 12 hours. |
innovation_momentum_respondent | Essential invited-participant session, up to 12 hours and revocable earlier. |
innovation_momentum_result | Essential private access to a public-snapshot result, up to seven days. |
innovation_momentum_privacy | Essential record of the privacy choice on the current host, 180 days. |
im_assessment_draft:v1:… | Essential tab-scoped snapshot draft, removed after successful submission. |
im_beta_session | Optional first-party analytics session UUID, limited to the current tab. |
Essential browser storage is used under Section 25(2)(2) TDDDG to provide a service you request. Optional analytics starts only after consent. You can change that choice at any time: open privacy settings.
6. Optional product analytics
Analytics remain off until consent. Consent starts two limited systems. InnovationFlow's first-party product analytics stores an opaque tab session UUID, event name, page path, optional campaign or step key, elapsed time, server timestamp and consent record in Supabase. It does not store assessment answers, free text, names, email addresses, report content or advertising identifiers.
Vercel Web Analytics then loads through a first-party service path and records aggregate page views for an allowlist of public acquisition and assessment routes. Private results, client and operator areas, invitations, reports, APIs and any unrecognised route are blocked before sending; query strings and fragments are removed. Vercel may receive the event time, public path, referrer, coarse location, operating system, browser and device type. It uses no third-party analytics cookie; Vercel creates a request-derived visitor hash and discards that visitor session after 24 hours. Pulse and full-assessment answers are never sent.
Choosing “Essential only” prevents either analytics client from starting. Withdrawing after analytics has started reloads the page and stops future collection; withdrawal does not undo processing that was lawful before withdrawal. There is no advertising or cross-site tracking. See Vercel's Web Analytics privacy information.
7. Purposes and legal bases
- Public snapshot and requested service: Article 6(1)(b) GDPR for the service and pre-contractual steps you request.
- Full-assessment contact request: Article 6(1)(a) GDPR and, where applicable, Article 6(1)(b).
- Invited client campaign: the campaign-specific notice states the controller's legal basis; Macrocyra acts under documented processor instructions where applicable.
- Security, service integrity and necessary improvement: Article 6(1)(f), balanced through minimisation, access controls and restricted logs.
- Optional analytics: Article 6(1)(a) GDPR and Section 25(1) TDDDG.
- Legal obligations: Article 6(1)(c) where required.
There is no statutory duty to provide assessment answers. Required fields are necessary to generate the requested result or administer invited access.
8. Retention and deletion
| Category | Rule |
|---|---|
| Public snapshot and individual result | Deleted or irreversibly anonymised no later than 90 days after submission unless a shorter technical expiry applies or longer retention is legally necessary. |
| Unconverted assessment requests | Deleted no later than six months after the last meaningful contact. Converted requests follow the documented client engagement period. |
| Campaign invitations, responses and reports | Follow the campaign-specific period shown before participation, normally 90 days after the later of access expiry or campaign closure for participant delivery records and responses, unless the client agreement or legal requirements specify otherwise. |
| Accounts and audit records | Accounts remain while authorised. Necessary evidence/release attribution may remain for the engagement and up to three years where needed to establish or defend claims; unnecessary personal data are removed earlier. |
| Analytics and feedback | First-party product events are retained up to six months. Vercel's Pro reporting window is 12 months; Vercel states that it may keep aggregate analytics data longer to preserve upgrade options. Its request-derived visitor session is discarded after 24 hours. Feedback is deleted or anonymised after the applicable product-review cycle, normally within six months. |
| Security logs and backups | Security logs are ordinarily retained no more than 30 days. Encrypted backup copies expire under the applicable provider schedule and are isolated from ordinary use. |
9. Recipients, hosting and transfers
The production service uses Vercel Inc. for the web runtime and consented aggregate Web Analytics, Supabase for managed database, storage and authentication, and the configured transactional email provider, currently Resend, for request notifications and access messages. Email delivery receives addresses and message content; assessment answers are not placed in request-notification emails. Authorised Macrocyra operators and, for client campaigns, authorised client roles receive only the access their role requires.
Current sub-processors and processing information are published with the wider InnovationFlow legal documents. Vercel's Data Processing Addendum covers Pro plans and incorporates the 2021 EU Standard Contractual Clauses for relevant transfers. Where other processing outside the EEA occurs, Macrocyra uses the applicable provider agreement and a lawful Chapter V transfer mechanism. No advertising network receives assessment data.
InnovationFlow Companion is enabled. An authorised operator can deliberately send the limited frozen group aggregate described above for a private draft. The current provider is Anthropic (Claude). Its API inputs and outputs are normally deleted within 30 days, subject to legal, safety and agreed retention exceptions; EU-only processing is not promised. See Anthropic's API retention information. A named operator must review and approve the narrative before client release. Campaign documentation identifies the applicable controller, processing instructions and safeguards.
10. Your rights
Subject to the legal conditions, you may request access, rectification, erasure, restriction, portability and objection under Articles 15-21 GDPR, and withdraw consent with future effect. Contact gdpr@innovationflow.app. We normally respond within one month and may verify identity to protect other people.
You may complain to a supervisory authority, including the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany, datenschutz-berlin.de.
11. Security, automated decisions and changes
Measures include named least-privilege accounts, MFA support, hashed passwords and tokens, expiring and revocable sessions, same-origin protection, restrictive browser headers, encrypted transport, row-level database controls, privacy display floors, immutable evidence snapshots and governed report release. No internet service can guarantee absolute security.
The service does not make decisions producing legal or similarly significant effects about participants solely by automated means. Results are hypotheses for human review. Material changes to purposes, recipients or optional storage will be reflected here and, where required, presented for a new choice or acceptance.