This policy explains how C-Suite HQ handles data during normal operation.
C-Suite HQ is invitation-only. If you submit the Request Access form on the sign-in page, we collect the following information solely to evaluate your request:
By submitting the Request Access form, you consent to this collection and to the transmission of the submission to the operator's review inbox via email (Amazon SES).
Lawful basis: consent (you opt in by submitting the form) and our legitimate interest in vetting prospective users and preventing abuse.
What we do not do: we do not create an account from this submission, do not add you to any marketing list, and do not share the submission with third parties (other than AWS SES purely as the email transport).
Retention: approved requests are retained while the resulting account is active; declined or unanswered requests are retained for up to 12 months for abuse-prevention pattern matching, then deleted.
Your rights: you can request deletion or a copy of your submission at any time by emailing the operator (see Contact below).
C-Suite HQ may process message content, tool inputs/outputs, session metadata, token usage, and audit records needed for system operation and debugging.
When you create an account, we store your email address, display name, tenant association, and a hashed version of your password. Plaintext passwords are never stored.
C-Suite HQ sends emails to registered users for the following purposes:
Emails are sent via Amazon Simple Email Service (SES) from the configured sending domain. Your email address is transmitted to AWS SES solely for delivery purposes.
C-Suite HQ performs automated checks including daily scans for accounts using default passwords. These checks compare password hashes only and do not expose or log plaintext credentials.
Data can be stored in local files or configured persistent storage (PostgreSQL). Retention and backup behavior depend on your deployment settings.
Operational controls include tool governance, audit logging, path restrictions, and bcrypt password hashing. You are responsible for infrastructure-level security, access control, and secret management.
When model providers or external tools are used, relevant request data may be sent to those services under your configured credentials. Email delivery is processed through AWS SES. C-Suite HQ does not sell or share personal data with third parties for marketing purposes.
For privacy questions, contact the project owner.