CXO Scenario Planner

Privacy Policy

Last updated: 28 February 2026

1. Who We Are

CXO Scenario Planner is an AI-powered strategic planning tool operated by Amit Shah. For any questions about this policy, contact us at [email protected].

2. What Data We Collect

We collect only what is needed to operate the service:

• Google sign-in — when you authenticate via Google, Google confirms your identity to us. We use your name to personalise the session display. We do not store your Google account details on our servers.
• Session token — a secure, HTTP-only cookie is issued for the duration of your session so you remain signed in. It contains no personal data and expires when you sign out or close your browser session.
• Scenario inputs — the strategic scenario, role, budget, and risk parameters you enter during a session. These are sent to OpenAI's API to generate responses and are not stored on our servers.
• Reference documents — PDF files you optionally upload are used within the session only and permanently deleted at session end, or within 2 hours of upload at the latest.
• Feedback — a voluntary rating (1–10) and optional comment at the end of a session. This is stored in anonymised, encrypted form with no link to your identity.
• Usage analytics — anonymised usage events via Google Analytics. No personally identifiable information is included.

3. How We Use Your Data

• To verify your identity via Google and maintain a secure session.
• To run your C-suite scenario planning session by sending your inputs to OpenAI's API.
• To improve the product using anonymised feedback and analytics only.

We do not use your data for advertising, profiling, or any purpose beyond operating the service.

4. Third-Party Processors

• Google LLC — identity verification (Google OAuth) and anonymised analytics. Google Privacy Policy.
• OpenAI, Inc. — AI processing of your scenario inputs. Content you enter is transmitted to OpenAI's API to generate responses. OpenAI Privacy Policy.
• Railway — cloud hosting infrastructure based in the United States.

We do not sell, rent, or share your personal data with any other third parties.

5. Data Retention

• Account data — we do not store user accounts. No personal data is retained on our servers after your session ends.
• PDF uploads — deleted immediately at session end, and no later than 2 hours after upload.
• Feedback — stored in encrypted, anonymised form to help improve the product. Not linked to any personal identity.
• Analytics — retained in anonymised form per Google Analytics' standard retention settings.

6. Security

Connections to the service are protected by HTTPS. Any data temporarily processed on our servers is handled in memory only and not written to disk. Session cookies are HTTP-only and inaccessible to client-side scripts.

7. Your Rights

Since we do not store personal data on our servers, there is no personal profile to access, correct, or delete. For any questions, contact us at [email protected].

8. Cookies

We use one functional cookie — a secure, HTTP-only session token — which is strictly necessary to keep you signed in during a session. We also use Google Analytics, which may set its own cookies to measure anonymised usage. You can opt out via Google's opt-out tool.

9. Children's Privacy

This service is intended for business professionals and is not directed at children under 16. We do not knowingly collect data from anyone under 16.

10. Changes to This Policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Continued use of the service constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions, email [email protected].