Some company details on this page are still placeholders in [brackets]. The operator sets them in the server configuration.
Privacy policy
Effective 2026-11-09
This policy explains how [Company name and legal form] ("we") processes personal data when you visit https://app.isendi.eu and when you use Standdown. It is written to meet Articles 13 and 14 of the General Data Protection Regulation (GDPR).
1. Who is responsible
Controller: [Company name and legal form], [Street and number, postcode, city, country]. Email: [privacy contact email].
We are not required to appoint a data protection officer. Send privacy questions to the address above.
Two roles. For your account, billing and our website we are the controller. For the content your team puts into Standdown (updates, recordings, transcripts, tasks), your organisation is the controller and we process that content on its behalf under our data processing agreement. Questions about your team's content are best sent to your organisation first.
2. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, work email, password (stored only as a salted hash), team name, time zone | Create and run your account | Art. 6 (1) (b) GDPR, contract |
| Updates you post: text, voice or video recordings, transcripts, summaries, tasks and blockers | Provide the service your organisation ordered | Art. 6 (1) (b) GDPR; for team content, on behalf of your organisation under Art. 28 GDPR |
| Usage records: which days you opened the app or posted | Count active seats for billing, show who has posted | Art. 6 (1) (b) and (f) GDPR, accurate billing |
| Billing details: company name, billing address, VAT ID, payment method | Charge for paid plans, keep invoices | Art. 6 (1) (b) and (c) GDPR, contract and tax law |
| Technical data: IP address (held only in memory to limit login attempts), time and URL of failed requests | Keep the service secure and find faults | Art. 6 (1) (f) GDPR, security of the service |
| Emails we send: invites, password resets, digests, blocker alerts | Tell you what happened in your team | Art. 6 (1) (b) GDPR |
You can use Standdown without a recording: typing an update works on every plan.
3. AI processing
When your team's plan includes it, the text of an update is sent to Anthropic's API to extract tasks and blockers and, once a week, to write a short brief. Recordings are sent to our transcription provider to turn speech into text. These providers process the data only to return the result to us. Anthropic does not use API inputs to train its models under its commercial terms.
The results are suggestions. Nothing is posted until the person who recorded the update has checked it. No decision with legal or similarly significant effect is made automatically (Art. 22 GDPR).
4. Who receives data
We use these processors, each bound by a data processing agreement:
| Provider | What for | Location |
|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Hosting the application, database and recordings | Finland (EU) |
| Anthropic, PBC, San Francisco, USA | Extracting tasks and writing briefs (Team and Business plans) | USA |
| OpenAI, L.L.C., San Francisco, USA | Transcribing recordings (Team and Business plans) | USA |
| Stripe Payments Europe, Ltd., Dublin, Ireland | Payment processing, invoices, tax calculation | EU, with transfers to the USA |
| Resend, Inc., San Francisco, USA | Sending emails | USA |
If your team connects Slack, Microsoft Teams, Jira, Linear or Asana, we send digests, alerts or task titles there on your organisation's instruction. Those services are chosen and contracted by your organisation.
For transfers to the USA we rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR).
5. How long we keep data
- Voice and video recordings: deleted automatically 90 days after upload. Transcripts stay with the update.
- Updates, tasks and briefs: until a member, an admin or the team owner deletes them, or the team is deleted.
- Your account: until you delete it in Settings. Your updates and recordings are deleted with it.
- Invoices and accounting records: for the periods required by German commercial and tax law (§ 257 HGB, § 147 AO).
- Error logs: rotated automatically by size and overwritten. They contain no IP addresses.
6. Cookies
We set one cookie, sd_session, which keeps you signed in. It is strictly necessary for the service you asked for (§ 25 (2) no. 2 TDDDG), so we don't ask for consent. We use no tracking, advertising or analytics cookies. The website loads fonts from Google Fonts, which means your browser sends your IP address to Google when it fetches them.
7. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Team admins can export all team data as JSON in Settings, and you can delete your account there yourself. For anything else, write to [privacy contact email].
You also have the right to complain to a data protection supervisory authority, for example [data protection authority of your federal state].
8. Security
Connections are encrypted with TLS. Passwords are stored as salted scrypt hashes. Credentials for connected tools are encrypted at rest with AES-256-GCM. Recordings are only served to signed-in members of the team they belong to.
9. Changes
We will update this policy when the service or the law changes, and tell account holders by email about material changes.