Privacy

People ask this platform questions they would not ask in a team meeting: how to handle a restructure, what to do about a leader who will not communicate, whether a decision is defensible. Those questions are sensitive to your career and to your organisation. That is why incognito exists, and why this page is specific rather than boilerplate.

Comms Genius is the data controller for the information described here. For any privacy question, or to exercise the rights below, email hello@commsgeniushq.com. It reaches the founder directly.

To give you an account: your email address, name, organisation and role. Name, organisation and role are collected at sign-up so the founder knows who is in the founding cohort and can curate for the membership that actually exists.

When you use it: the questions you ask, the answers you receive, the answers you save to your library, and the feedback and issue reports you submit. We also store a topic tag per question (for example measurement or change) so the founder can see which subjects need better curated answers.

If you tell us: the biggest IC challenge you are facing, which is optional at sign-up and shapes what gets written first.

When you tick “Incognito” before asking a question, the question and answer are not stored: no row in our database, nothing at info level in our logs, and no topic tag is generated. The answer is shown to you once and then discarded.

Two honest limits. The question is still sent to Anthropic to produce the answer, because that is how the answer gets made — it is not retained by us, and their commercial API does not train on it. And incognito is a choice made per question, so it protects the question you ticked it for, not the ones you did not.

We process your account data to perform our contract with you — you cannot have an account without it. We process question and feedback data under legitimate interests: curating better answers for the membership, which is the substance of what the platform offers. You can object to that processing at any time by emailing us, or end it entirely by deleting your account.

Your questions are not used to train any AI model. We pay Anthropic and OpenAI for inference, and their commercial APIs do not train on customer prompts. We do not sell your data, and we do not provide it to any third party for training, advertising or any other purpose.

We use a small number of providers to run the platform. Each receives only what it needs:

• Supabase — database and authentication. Holds your account and activity.
• Vercel — hosting. Processes requests and short-lived operational logs.
• Anthropic — generates answers. Receives your question and the retrieved source material.
• OpenAI — creates the embeddings that retrieve relevant sources. Receives your question text.
• Resend — sends account email. Receives your email address and name.

Some of these process data outside the UK. Transfers rely on the providers’ standard contractual clauses.

Internal analytics is topic-level and aggregate only: how many questions were asked about change this week, what proportion got Helpful feedback, and so on. We never share individual questions or user identities in analytics. There are no third-party analytics or advertising trackers on this site.

You can see only your own questions, saves and feedback. The founder can read all non-incognito activity, in aggregate and in detail, in order to curate better answers.

This separation is enforced by row-level security in the database, not only by application code — so a bug in the interface cannot expose one member’s questions to another.

Your account data is kept while your account exists. Questions, saves and feedback are kept until you delete them or delete your account, because your library is only useful if it persists.

If you join the waitlist and are never released, your record stays until you ask us to remove it. Email us and it is gone.

You can delete your account at any time on the Account page. Deletion is a true cascade: your auth record, profile, waitlist entry, questions, saves, feedback and issue reports are all removed permanently. We do not retain a shadow copy.

It is immediate and cannot be undone, so export anything you want to keep first. Aggregate counts that contain no personal data — such as “41 questions about measurement this month” — are not reversed by deletion.

Under UK data protection law you have the right to access a copy of your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable form. Deletion is self-service on the Account page; for anything else, email us and we will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can put it right.

We use only the cookies required to keep you signed in (Supabase Auth session cookies) and a short-lived cookie used to render incognito answers immediately after you ask them. There are no third-party tracking cookies, so there is no consent banner to dismiss.

Data is encrypted in transit and at rest by our infrastructure providers. Access separation is enforced at the database level. No platform can promise perfect security, but if a breach affected your data we would tell you and the ICO, as the law requires.

If we change how we handle your data in a way that materially affects you, we will email you rather than quietly updating this page. The review date at the top always reflects the current version.