Privacy Policy

Overview

Welcome to chAIr — a corporate governance and board management platform. We're committed to protecting your privacy and being transparent about how we handle your data. This policy explains what information we collect, how we use it, and your rights under GDPR and Icelandic data protection law.

chAIr is operated by Scaling Legal ehf., an Icelandic company. We comply with the General Data Protection Regulation (GDPR) as it applies in Iceland through our EEA membership, and with Act No. 90/2018 on Data Protection and the Processing of Personal Data.

Our two roles

Controller: for data about our own customers and users (accounts, sign-in, billing contact, support, company verification) Scaling Legal ehf. is the controller.

Processor: for the governance records your company keeps in chAIr (for example minutes, attendee and shareholder names, contracts, cap tables) your company is the controller and we process that data on its behalf and on its instructions, under our Data Processing Terms. Questions about that data from people outside your company (for example a shareholder) should go to the company that holds it; we will help the company respond.

Who We Are

Controller: Scaling Legal ehf., kt. 430325-0510, Hvannhólmi 16, 200 Kópavogur, Iceland

Service Name: chAIr — Corporate Governance Suite

Domain: chair.is

Data Protection Authority: Persónuvernd (Icelandic Data Protection Authority)

Data protection officer: We have not appointed a data protection officer, as we are not required to. All data protection questions go to privacy@chair.is.

Contact Information

What Data We Collect

We collect the minimum data needed to deliver chAIr effectively. Here's what we gather:

Account Information

• Name — your full name
• Email address — for sign-in and account emails
• Password — if you sign up with email; stored only as a secure one-way hash
• Company membership — which company workspaces you belong to and your role there (admin or read-only)
• Acceptance records — when an admin accepts our Terms of Service or Data Processing Terms for a company, or you acknowledge this Privacy Policy, we record who did it (user ID and email address), for which company (name and kennitala), which version of which document (with a fingerprint of its text), and when

Company Verification

To make sure only people connected to a company can set up a workspace for it, we collect:

• The company's kennitala — each company can have one chAIr workspace
• Public company register information — the company's name, legal form, address and the people listed for it (such as the board chair and managing director), retrieved from Fyrirtækjaskrá at Skatturinn
• A name comparison — whether the name on your account matches a person listed in the register; a chAIr staff member reviews the result before the company is verified

If you are listed in Fyrirtækjaskrá for a company that signs up (for example as board chair), we process your name and role from the register for this check only. The result is kept while the company's workspace exists and is deleted with it. You have the rights described below, including the right to object.

What you must provide: your name, email address and your company's kennitala are needed to create an account and a company workspace. Without them we cannot provide chAIr. Everything else is optional.

Corporate Governance Data

When you use chAIr, you create and upload corporate documents and records:

• Meeting information — board meetings, shareholder meetings, agendas, minutes, attendees, decisions
• Cap table data — shareholder ownership, share classes, options, convertible notes, SAFEs, funding rounds
• Contracts — contract details, uploaded contract text, renewal and notice dates, parties, status
• Shareholder communications — names and email addresses of shareholder contacts you add, and the messages you send to them
• Company details — company name, incorporation date, jurisdiction, board members
• Trackers — deadlines, delegations of authority and decision log entries
• Governance health check — your answers and the improvement plans you create
• Compliance records — governance checklists, filings, resolutions

Authentication Data

• Google account data (if you sign in via Google) — name, email address, profile picture and your Google account identifier
• Electronic ID (if you sign in with Kenni, once available) — your name as confirmed by your electronic ID, an identifier from Kenni, and your email address if you agree to share it
• Session tokens — automatically generated to keep you logged in; stored in your browser's local storage, not in cookies

Activity & Usage Data

• Website statistics — page views, referring website, browser, operating system and country, counted by Plausible without cookies and without storing personal data or building profiles
• Sign-in records — when you last signed in, kept by our database provider
• Change history — which user created or changed which record in a company workspace, and when (audit log), and which user downloaded which file from it, and when (export log)
• Read confirmations — when a company shares a document or message through chAIr with a personal link, we record for that company when each recipient opened it (date, time and whether a phone or computer was used; no IP address). The recipient is told this before opening. The company is the controller of this record and we process it on its behalf.

Communication Data

• Support messages — if you contact us with questions or feedback
• Emails we send — account emails, invitations, shareholder communications you send, Contract Watchdog alerts and subscription reminders; our email provider keeps delivery logs (recipient, time, delivery status)

Device & Technical Data

• IP address and browser details — seen by our hosting provider (Netlify) and database provider (Supabase) when your browser connects, and kept in their technical logs for a short period
• Abuse protection — to limit repeated requests we store a one-way, salted hash of your IP address (never the address itself) for at most 24 hours
• Browser storage — your login session and two display preferences (dark mode and language) are kept in your browser's local storage

All of chAIr's scripts and fonts are served from chair.is itself. The only exceptions are Paddle's checkout, which loads when you start a trial or payment, and Plausible's statistics script.

What we do NOT collect: We do not use cookies for tracking or advertising. We do not collect biometric data, health information, or location data beyond what's needed to deliver the service.

How We Use Your Data

We use your data for these purposes:

Service Delivery

• Provide, maintain, and improve the chAIr platform
• Manage your account and subscriptions
• Handle subscriptions and payments through Paddle (see "Who We Share Data With")
• Verify that a new company workspace is set up by someone connected to the company
• Send emails you ask chAIr to send (invitations, shareholder communications) and automatic alerts you have turned on (such as Contract Watchdog deadline alerts)
• Store and retrieve your corporate governance documents

Communication

• Send you important account notifications (login alerts, password resets, security updates)
• Notify you about service changes or maintenance
• Respond to your support requests

Product Improvement

• Analyze how you use chAIr to improve features and fix bugs
• Understand user behavior through privacy-focused analytics (Plausible)
• Plan new features and enhancements

Legal & Security

• Detect and prevent fraud, abuse, or unauthorized access
• Comply with legal obligations and regulations
• Enforce our Terms of Service
• Protect the rights, safety, and property of Scaling Legal, users, and the public

Marketing (with your consent)

• Send you product updates and feature announcements
• Invite you to user research or beta testing (opt-in)

We will never sell your personal data to third parties or use it for purposes outside of those listed above without your consent.

Legal Basis for Processing (GDPR)

Under GDPR, we only process your data when we have a lawful reason. Here's what applies to chAIr:

If we process your data on the basis of legitimate interest, we have balanced our interests against your rights to determine that processing is fair and proportionate.

Who We Share Data With

We only share your data with service providers who help us operate chAIr. Processors act on our instructions under data processing terms.

Service Providers

Public Sources

When a company workspace is created we look up the company's public entry in Fyrirtækjaskrá (the company register at Skatturinn). We only send the company's kennitala to the register.

Calendar Sync

If you turn on calendar sync, your company's meetings and deadlines are published at a private, hard-to-guess web address. Your calendar app (for example Google Calendar, Outlook or Apple Calendar) fetches that address, and the calendar provider then handles the information under its own terms. You can turn sync off or create a new address at any time, which stops the old one working.

Other Situations

• Legal requirements: We may disclose data if required by law, court order, or government request. We will notify you whenever legally permissible.
• Business transfers: If Scaling Legal is acquired or merges with another company, your data may be transferred as part of that transaction. You will be notified of any such change.
• With your consent: We only share your data with other parties if you explicitly authorize it.

Apart from the service providers above, no third party has access to your governance data unless you share it, for example by sending a shareholder communication or turning on calendar sync.

How Long We Keep Your Data

Company Records

Your company's records are kept while the company has a chAIr subscription. If the subscription is cancelled, it runs to the end of the paid period and we remind the company's admins to export their records. We delete the records within 30 days after the subscription ends; until then we provide an export on request. Copies in backups are deleted as the backups expire, within a further 30 days.

The change history (audit log) of a company's records is kept while the workspace exists, so the company can see who changed what, and is deleted with the workspace.

Your User Account

You can delete your user account in Profile & Settings. Your account data (name, email, sign-in details) is then deleted, except the acceptance records described below. Your company's records belong to the company and stay available to its other members. If you are a company's only admin, you need to make someone else admin first.

Specific Data Types

• Company verification data: kept while the workspace exists and deleted with it
• Acceptance records: kept for as long as the company uses chAIr and for four years after the end of the year in which its subscription ends, also if the account or workspace is deleted earlier. The period follows the general four-year limitation period for claims in the Icelandic Act on the Limitation of Claims (No. 150/2007).
• Invoices and accounting records: kept for 7 years, as required by the Icelandic Bookkeeping Act (No. 145/1994). Payment details are held by Paddle, not by us.
• Emails sent through chAIr: our email provider keeps delivery logs according to its own retention settings
• Shared documents, read confirmations and the export log: kept while the workspace exists and deleted with it. A company can withdraw a share link at any time; the record of who opened it is kept with the workspace
• Analytics: Plausible stores only aggregate statistics and no personal data
• Support requests: kept for 3 years unless you ask us to delete them

We delete data that is no longer necessary for the purpose it was collected, unless we have a legal obligation to retain it.

Your Rights Under GDPR

You have rights over your personal data. Here's what you can do:

Right to Access

You have the right to request a copy of the personal data we hold about you. Contact us at privacy@chair.is and we'll provide it within one month.

Right to Rectification

If your data is inaccurate, you can request we correct it. Many corrections (name, email, company) can be made directly in your account settings.

Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data in most cases. We will delete it within one month unless we have a legal reason to retain it (e.g., tax records).

Right to Data Portability

You can request your data in a structured, portable format (JSON, CSV) so you can move it to another service. We'll provide this within one month. Admins can also export all their company's records themselves at any time (Profile & Settings → Data & Account → Export Data).

Right to Restrict Processing

You can ask us to limit how we use your data while we resolve a dispute or verify accuracy. We'll honor this request while maintaining the service.

Right to Object

You can object to processing your data for legitimate interest reasons (e.g., analytics, marketing). We will honor your request unless we have a compelling legal reason to continue.

Right to Withdraw Consent

If we process data based on your consent (e.g., marketing emails), you can withdraw consent at any time. You can unsubscribe from marketing emails using the link in every email.

Rights Related to Automated Decision-Making

We do not use your data for automated decision-making that has legal or similarly significant effects without human review.

How to Exercise Your Rights

To exercise any of these rights, contact us:

• Email: privacy@chair.is
• Include "Data Subject Access Request" or the specific right in the subject line
• Provide enough information to identify you (email, name, company)
• We'll respond within one month. For complex or numerous requests this can be extended by up to two further months; if so, we'll tell you why within the first month.
• If your request concerns your company's records (for example you are a shareholder of a company that uses chAIr), we will pass it to that company, which is responsible for answering it, and help it to do so.

Right to Lodge a Complaint

If you believe we've violated your data protection rights, you can lodge a complaint with the Icelandic Data Protection Authority:

• Persónuvernd (Icelandic DPA)
• Website: www.personuvernd.is
• Email: postur@personuvernd.is

AI-Powered Features

chAIr includes AI features that draft meeting minutes, meeting briefings, governance improvement guidance, contract reviews and shareholder communications. Every AI result is a draft for a person to review and approve.

How It Works

• When you use an AI feature, the material needed for that task (for example your meeting notes and the meeting details) is sent to Amazon Bedrock in the European Union, which runs Anthropic's Claude model
• The draft is returned to chAIr and stored with your company's records only if you keep it
• AI features run only when you click to use them; nothing is sent to the AI service in the background

How Amazon Bedrock Handles the Data

• EU only: requests are processed in AWS regions within the European Union
• No training: AWS states that Amazon Bedrock does not use prompts or results to train models
• No storage: AWS states that Amazon Bedrock does not store or log prompts and results
• No access by Anthropic: AWS states that model providers such as Anthropic have no access to customer prompts or results

Your Control

• You decide whether to use an AI feature each time
• Generated content is not shared with anyone unless you choose to send it

Sensitive Data

Be cautious about including highly sensitive information (specific financial amounts, private cap table details, attorney-client privileged communications) in AI-powered features. Data is encrypted in transit, but you should still only include what the task needs.

International Data Transfers

Your governance records are stored in the European Union (Supabase, Paris) and AI processing takes place in the European Union (Amazon Bedrock). Some service providers are outside the EEA:

• United States: Netlify (hosting and server functions; Standard Contractual Clauses), Resend (email; certified under the EU-US Data Privacy Framework) and Google (only if you sign in with Google; certified under the EU-US Data Privacy Framework)
• United Kingdom: Paddle (payments). The UK has an adequacy decision from the European Commission.

Data Privacy Framework (DPF)

Where a US provider is certified under the EU-US Data Privacy Framework, transfers rely on that framework.

Standard Contractual Clauses (SCCs)

Otherwise, transfers rely on the European Commission's Standard Contractual Clauses in the provider's data processing terms.

Your Rights

You have the same GDPR rights even when your data is processed outside the EEA. If you have concerns about international transfers, contact us at privacy@chair.is.

Data Security

We take data security seriously and implement industry-standard protections:

Technical Measures

• Encryption in transit: All data sent to/from chAIr uses TLS/SSL encryption
• Encryption at rest: The database is encrypted at rest by our hosting provider
• Authentication: Secure password hashing, sign-in with Google, and electronic ID (once available)
• Separation between companies: Access rules in the database itself ensure users can only see the companies they belong to
• Roles: Company admins can edit; read-only members can view but not change records
• Company verification: New workspaces cannot send shareholder emails or invitations until we have verified the company
• Backups: The database is backed up daily

Organizational Measures

• Limited internal access — only authorized staff can access user data
• Confidentiality — everyone with access to user data is bound by confidentiality
• Incident response plan — we have procedures to detect, respond to, and report security breaches
• Regular security reviews — we audit our systems and processes for vulnerabilities

Limitations

While we use robust security measures, no system is 100% secure. If you're concerned about specific security measures, please contact us for details.

Security Incident Notification

If we discover a breach that puts your personal data at risk, we will notify you and relevant authorities within 72 hours as required by GDPR.

Children's Privacy

chAIr is not intended for users under 18 years old. We do not knowingly collect data from children. If we become aware that a child has provided us with personal data, we will delete it immediately and notify the child's parent or guardian.

If you believe we have collected data from a child, please contact us immediately at privacy@chair.is.

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes:

• Email notification: We'll send you an email at the address associated with your account
• Website announcement: Changes will be posted on this page

The date at the top of this page shows when the policy was last changed.

Contact Us

If you have questions about this privacy policy, your data, or our data practices, please reach out: