Privacy Policy

Who we are

Impact Alignment Hub (“we”, “us”) is a web application operated on the Base44 platform. This policy applies to two audiences: registered consultants who hold an account, and invited stakeholders who review a brief without creating an account.

Information we collect

From consultants (account holders)

• Account email and name, used for authentication and account management.
• Project brief content you author, including narratives, strategy, audience, scope, voice, ethics, moodboard images, and administrative metadata.
• Comments and internal notes you add to a project.

From invited stakeholders (no account required)

• Name and email address, entered by the inviting consultant — not by you. By inviting you, the consultant confirms they have a lawful basis to share your contact details with us for this review.
• A one-time review code used to open your review link. The code is delivered to your email and expires after 24 hours.
• Comments you leave on brief fields and your sign-off decision (approve or request changes).
• A frozen copy of the brief at the moment you were invited (“brief snapshot”), stored so your sign-off is tied to the exact version you reviewed.

Automatically

• Basic usage analytics events to understand feature adoption and improve the product.
• Standard server logs generated by the hosting platform.

How we use your information

• To provide the brief editor, review portal, and sign-off recording features.
• To email you review invitations, one-time codes, and sign-off reminders (stakeholders), or account-related notifications (consultants).
• To maintain an auditable record of who approved which brief version.
• To operate, secure, and improve the service.

Lawful basis for processing (GDPR)

For consultants, we process account and project data on the basis of contract performance (providing the service you signed up for) and legitimate interests (security and product improvement). For invited stakeholders, we process your name, email, review code, comments, and sign-off on the basis of the consultant’s legitimate interest in securing formal alignment, and your consent each time you open a review link and submit a decision. You may withdraw consent by not participating, or by requesting deletion (see below).

Your CCPA rights (California)

If you are a California resident, you have the right to know what personal information we collect, request deletion, and opt out of any “sale” or “sharing” of personal information. We do not sell personal information. To exercise these rights, contact us using the details below.

Your GDPR rights (EEA/UK)

• Access, rectify, or port your personal data.
• Request erasure or restriction of processing.
• Object to processing based on legitimate interests.
• Lodge a complaint with your supervisory authority.

Sub-processors

We use Base44 as our hosting and backend provider, which acts as a sub-processor and stores application data on our behalf. Email delivery and the external license-verification service (used to validate Pro license keys) also process limited data as sub-processors. We do not share personal information for advertising.

International data transfers

Servers and sub-processors may be located outside your country of residence. Where personal data leaves the EEA/UK, it is protected using appropriate safeguards such as standard contractual clauses.

Data retention

Project data is retained for as long as your account is active. Sign-off decisions and the brief snapshot are retained as an audit record even after a project is archived, because they document what was reviewed and approved. One-time review codes expire after 24 hours. You may request deletion at any time; see below.

Security

We apply access controls, row-level authorization on project data, and one-time codes for the no-login review portal. No method of transmission or storage is fully secure, but we work to protect your information as described in our security documentation available on request.

Cookies

We use only essential cookies and local storage needed to keep you signed in and remember your theme preference. We do not use advertising cookies.

Children

The service is intended for professionals and organizations. It is not directed to children under 16 (EEA/UK) or under 13 (US), and we do not knowingly collect their personal information.

Changes to this policy

We may update this policy from time to time and will revise the “last updated” date above. Material changes will be communicated through the app or by email where practical.

Contact

For privacy requests, deletion requests, or questions about this policy, contact us through the support channel provided in the app. Consultants can also reach the project owner named in the brief they were invited to review.