TeamChoice
Contact: notifications@team-choice.ai
This policy explains how TeamChoice ("TeamChoice", "we") handles personal data when you visit team-choice.ai, contact us, or use the TeamChoice workspace.
1. Our two roles
Controller. For the data we collect for ourselves (website visitors, demo requests, the contact details of our customers' administrators, billing), we decide why and how it is used.
Processor. For the data a company puts into its TeamChoice workspace about its people (profiles, skills, projects, time off, attendance, reviews, goals), that company is the controller and we process the data only on its instructions, under our Terms and a data processing agreement. If you are an employee of one of our customers, please contact your employer first about your data; we will help them answer you.
2. What we collect
- Contact and demo requests: name, work e-mail, company, team size and your message.
- Account data: name, e-mail, password (stored only as a hash), or the identity Google or Microsoft confirms when you sign in with them.
- Workspace data: whatever the customer and its users add: people's profiles, roles, managers and teams; skills and levels; projects and allocations; leave requests, including their type (for example medical leave); timesheets; reviews and feedback; goals; files; assistant conversations; and, when a meeting is recorded, its audio and transcript.
- Integration data: when a customer connects Slack, Asana, Google Calendar or another tool, the data needed for that link, such as the out-of-office events added to the calendar or Slack user IDs.
- Technical data: IP address, browser and device details, and logs of requests and errors, kept for security and to fix problems.
- Usage data: which pages and features are used, and when, under a random account id, never your name or e-mail. To fix problems we may record sessions; every text and input is masked in them, so a recording shows the layout and the clicks, not what is on the screen.
3. Why we use it, and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the workspace a customer subscribed to | Contract (Art. 6(1)(b)), and the customer's instructions as controller (Art. 28) |
| Answering contact and demo requests | Steps before a contract, or our legitimate interest in replying (Art. 6(1)(b), (f)) |
| Billing, invoicing and accounting | Legal obligation (Art. 6(1)(c)) |
| Security, abuse prevention and fixing errors | Legitimate interest (Art. 6(1)(f)) |
| Service e-mails (invitations, approvals, reminders) | Contract (Art. 6(1)(b)) |
| Understanding how the site and the app are used, to improve them | Legitimate interest (Art. 6(1)(f)) |
We do not sell personal data, show advertising, or use workspace data to build profiles of people for anyone else.
4. AI features
The assistant, team planning, drafts and meeting notes run on the AI provider account the customer sets in its workspace (today an OpenAI API key). When someone uses these features, the relevant workspace data is sent to that provider to produce the answer, under the customer's own agreement with it. The assistant only sees what the person asking is allowed to see in the app.
We do not use workspace data to train AI models. Under OpenAI's API terms, data sent through the API is not used to train its models by default.
Meeting audio is deleted once it has been transcribed. Recordings are used to follow the discussion and find project ideas, not to evaluate people.
5. Who processes data for us
We use these providers to run TeamChoice. Each is bound by a data processing agreement, and data is stored in the European Union unless noted.
| Provider | What for | Where |
|---|---|---|
| Laravel Cloud (on Amazon Web Services) | Application hosting | Frankfurt, Germany |
| Neon | Database | Frankfurt, Germany |
| Cloudflare | DNS, file storage (R2), bot protection on the contact form | EU storage; global network |
| Amazon Web Services | Search service | Frankfurt, Germany |
| theMarketer | Sending service e-mails | European Union |
| OpenAI | AI features, on the customer's own key | United States |
| PostHog | Usage analytics and session recordings (masked) | Frankfurt, Germany |
| Google, Microsoft | Sign-in; Google Calendar when connected | EU / United States |
| Slack, Asana | Only when the customer connects them | EU / United States |
Where data leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
6. How long we keep it
- Workspace history: as long as the customer's plan keeps it (3, 5 or 7 years), after which it is deleted following a 30-day notice to the company's administrators.
- Notifications: one year.
- Assistant conversations: deleted after 90 days without new messages.
- Meeting audio: deleted after transcription.
- Ended trials: the whole workspace is deleted three months after the trial ends, if the company never subscribed.
- After a subscription ends: the customer can export its data; we then delete the workspace within 90 days, except what the law requires us to keep (such as invoices).
- Contact and demo requests: up to 24 months after our last exchange.
7. Security
Data is encrypted in transit (TLS) and at rest. Each company's data is kept separate, access inside a workspace follows the roles and permissions the customer defines, and secrets such as API keys are stored encrypted. Our staff access customer data only when needed to provide support or keep the service running.
8. Cookies
We use only the cookies the site and the app need to work: a session cookie to keep you signed in and a security token against forged requests. Your light or dark theme is remembered in your browser's local storage. We measure how the site and the app are used with PostHog, hosted in the EU (Frankfurt), without cookies: nothing is stored in your browser, and session recordings mask every text and input. We do not use advertising cookies, so there is no cookie banner.
9. Your rights
Under the GDPR you can ask for access to your data, its correction or deletion, a copy in a portable format, a restriction of its use, or object to processing based on our legitimate interest. Write to notifications@team-choice.ai; we answer within one month. For workspace data, we pass the request to the company that controls it.
You can also complain to a data protection authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP).
10. Changes
We update this policy when our practices or providers change. The date at the top shows the latest version; we tell customers' administrators by e-mail about significant changes.