1. Who controls your data
Small Business Academy and Decision Lab are operated by DARE SUSTAINABILITY SRL ("DARE", "we", "us"). DARE is the data controller for personal data processed through this website. Questions or rights requests can be sent to info@theclimateschool.eco.
2. Data we process
Decision content. When you request a Decision Sprint, we process the question, context, decision category, reversibility and evidence rating you provide, together with the generated read. Do not submit personal, confidential, regulated or special-category data unless it is necessary and you are authorised to share it.
Free-sprint access data. We use a strictly necessary anonymous visitor cookie and store cryptographic hashes derived from that identifier and limited network information. This allows us to enforce one free sprint per visitor and prevent automated abuse. We do not store your decision text in this usage record.
Technical data. Hosting and security systems may process IP address, browser and device information, timestamps, request logs and security events.
Communications. If you contact us, we process the contact details and message you provide so we can reply and maintain an appropriate record of the conversation.
3. Why we process it
- To provide the Decision Sprint you request and return its result.
- To enforce the one-free-sprint limit, secure the service and control misuse and cost.
- To operate, diagnose and improve the reliability of the website.
- To respond to enquiries and comply with legal obligations.
Our legal bases are our legitimate interests in providing and protecting the service, taking steps at your request, performance of a contract where a paid service is purchased, and compliance with legal obligations. Where consent is specifically required, we will ask for it separately.
4. AI processing and service providers
Your Decision Sprint content is sent to the OpenAI API to generate the read. Decision Lab sets API response storage to off and does not use the submission to build a Decision Memory or user account. OpenAI states that API data is not used to train its models unless the customer explicitly opts in. Under OpenAI's standard controls, prompts and responses may still be retained in abuse-monitoring logs for up to 30 days, unless different approved data controls apply.
We also use hosting, content-delivery, database and security infrastructure provided through OpenAI Sites and Cloudflare. These providers process data only as required to deliver and protect the service. We may also disclose information where required by law or necessary to protect legal rights and service security. We do not sell personal data.
Where processing involves transfers outside the European Economic Area, we rely on appropriate safeguards required by applicable law, such as adequacy decisions or standard contractual clauses.
5. Retention
DARE does not currently save your decision content or generated read to a Decision Lab account. The pseudonymous free-sprint usage record is kept for up to 24 months so the free-use limit can be enforced, then deleted. Incomplete reservations are released after approximately 30 minutes. OpenAI's standard abuse-monitoring retention may be up to 30 days. Technical security logs are retained according to the hosting providers' operational schedules. Communications and transaction records are kept only as long as needed for the enquiry, contract or applicable legal and fiscal obligations.
6. Cookies
Decision Lab currently uses one strictly necessary cookie, sba_free_visitor, for up to 24 months. It does not track advertising activity or build a marketing profile. It exists only to recognise whether this browser has used its free sprint. Because the service cannot enforce free access without it, the cookie is necessary rather than optional.
7. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent where consent is the legal basis. You may also complain to the Romanian National Supervisory Authority for Personal Data Processing at dataprotection.ro.
Because the free-sprint record is deliberately pseudonymous, we may need information from your browser to locate it and may be unable to connect it to your identity without that identifier.
8. Security and children
We use proportionate technical and organisational measures, access controls and data minimisation. No internet service can guarantee absolute security. Decision Lab is a business tool and is not intended for children under 16.
9. Changes
We may update this policy when the product, providers or legal requirements change. The current version and update date will remain available on this page.