Privacy Policy

Discovery Companion is operated by Vladimiros Tsamouridis (“we”, “us”), an individual trader established in Greece, at A. Papakonstantinou 16, 19002, Greece. We are the controller for the personal data described below. For privacy questions, contact privacy@discoverycompanion.app.

We hold the minimum needed to give you an account: your email address, your authentication details, and, for a paid subscription, subscription records held by our payment provider. Everything you create inside the product — accounts, opportunities, discovery answers, requirements, notes and documents — is stored in your browser’s local database on your own device. In normal operation the product does not transmit that content to us, and we do not back it up for you. The one way it can reach us is if you choose to send it — for example by attaching a workspace export to a support email. If you do, we hold it as support correspondence (section 3).

Account data. Your email address, a hashed password or the identifier supplied by Google if you sign in with Google, plus sign-in timestamps and basic security metadata. Purpose: to authenticate you and secure the service. Legal basis: performance of a contract.

Subscription data. When you take a paid subscription, Paddle.com acts as Merchant of Record: it will sell the subscription, take payment and issue the invoice, and will decide for its own purposes how it handles the data that involves. In broad terms it would process identity and contact details, billing and payment details, transaction and tax information, subscription status, and fraud, security and device information where needed to complete a purchase. We would receive subscription status and invoice-level records — not your full card details, which we never see or store. Purpose: to sell and support the product. Legal basis: contract and legal obligation.

Nothing you create inside the product is involved in that. Your accounts, opportunities, discovery answers, requirements, notes and documents stay in your browser on your device and are not sent to Paddle — enabling billing does not change that.

Support correspondence. If you email us, we keep the message, any attachment you send and our reply, in our Google Workspace mailbox. Purpose: to help you. Legal basis: legitimate interests. Please send only what is needed to resolve your question.

Workspace content. Not processed by us. It is written to your browser’s IndexedDB storage and stays there unless you export it or send it to us yourself.

Backups and exports. Workspace Backup writes a file to your device, and document export produces DOCX and PDF files on your device. Those files are created locally and are not uploaded to us. Once saved they are outside the product’s control and are yours to protect.

The product creates a database in your browser that is scoped to your signed-in account. Data in it is not encrypted separately from your device’s own protections, and anyone with access to your unlocked device and browser profile could read it. Treat it as you would a local file of customer notes: use disk encryption, lock your machine, and keep backups.

Clearing your browser’s site data, using private browsing, or an aggressive storage-cleanup tool can delete this workspace permanently. Use Workspace Backup to keep a copy.

We use only what is necessary to run the service: a session token so you stay signed in, and local storage for your workspace and preferences. We do not use advertising or tracking cookies, and the product does not include analytics, advertising pixels or third-party trackers.

Specifically, the storage in use is: an authentication session token issued by our identity provider so you remain signed in; browser local storage holding interface preferences such as theme and sidebar state; and an IndexedDB database on your device holding your workspace content. If we introduce analytics or any other non-essential technology in future, we will update this policy and seek consent where the law requires it.

We use a small number of providers to run the service. In normal operation none of them receives your workspace content.

Lovable — hosting for the application, the account database and the authentication service, and delivery of transactional email (sign-up confirmation, password reset and similar messages), sent from our notify.discoverycompanion.app subdomain. Processes account and authentication data.

Google — optional “Sign in with Google” authentication if you choose it, and Google Workspace, which hosts our support and privacy mailboxes and therefore stores correspondence you send us.

Paddle.com — our appointed Merchant of Record. While purchasing is closed the public site does not load Paddle code or set Paddle cookies. When you buy a subscription, Paddle will handle checkout, payment, invoicing and tax as the seller of record, acting as an independent controller of the transaction data it collects rather than as a processor acting on our instructions. Its privacy notice will govern that processing. It receives no workspace content.

The providers above operate internationally, so account, authentication and support data may be processed outside the European Economic Area. Where that happens, the transfer relies on the safeguards those providers put in place under their own data processing terms, such as the European Commission’s standard contractual clauses or an adequacy decision. You can ask us for details of the safeguards that apply to your data.

We keep account data while your account exists. When we action a deletion request, we delete the account record and its authentication data. Billing records are kept for as long as tax and accounting law requires. Workspace content on your device is under your control, and closing your account does not delete it — you remove it yourself from Settings → Workspace.

Depending on where you live, you may have rights to access, correct, delete, restrict or port your personal data, and to object to certain processing. To have your account and personal data deleted, email us from the address you sign in with — Settings → Account has the same request, and any subscription should be cancelled first in Settings → Billing. For this and anything else, email privacy@discoverycompanion.app. Note that we cannot access, export or delete the workspace content held on your device — that is under your control in the product. You also have the right to complain to your local data protection authority.

The product is intended for business use by adults and is not directed at children.

We will update this page when the product changes, and will note the date at the top. See also our Terms of Service.