Privacy

Who we are

Discera is operated by Consensus ApS, the data controller under the GDPR. For privacy questions, or to exercise any of the rights described below, email privacy@consensus.dk.

What we collect and why

Essential diagnostics. When PostHog is configured, we collect operational error data so we can detect failures and keep Runs reliable. This is on whenever the app loads, because without it we cannot keep the service reliable. Run routes are reduced to templates, and raw join codes, internal Run IDs, and gameplay session IDs are excluded or redacted. Localization failures contain only a code, requested and fallback locales, route template, app version, and deployment environment. PostHog adds only a public project token, memory-only ID, and no-person-profile flag. Events exclude message keys, catalog or rendered text, interpolation values, and account or analytics identities. Browser-session IDs persist only after analytics consent; request IDs may correlate failures. Lawful basis: legitimate interest in service reliability (GDPR Art. 6(1)(f)).

Optional analytics. If you select Accept analytics in the cookie banner or an analytics preference control, we also record usage events (which screens you visit, when a quiz starts, how long sessions last) and may enable PostHog session replay so we can improve the product. Product event payloads do not include internal Run IDs, raw join codes, or gameplay session IDs; selected failure events may include bounded, sanitized error details. PostHog still uses pseudonymous analytics and browser-session identifiers. If you are signed in while analytics are accepted, we also attach your account ID and, when available, your account email and name to those PostHog events. Lawful basis: your consent (GDPR Art. 6(1)(a)). You can change your choice at any time using the analytics preferences below.

We do not collect address or payment data through the app. Apart from signed-in account details described above, Activity content you enter, including quiz titles, questions, slides, player nicknames, free-text answers, brainstorm ideas, and avatar choices, is stored with the Run and visible to the host or other players where the live Run experience requires it.

Public manual questions. If you use the FAQ ask box, we collect the free-text question, generated answer, cited manual concept keys, and a request-derived pseudonymous caller key used for abuse control. The question and answer are stored for up to 90 days and are not linked to an account or workspace, but free text can identify you. The question and the code-owned product manual are sent to OpenAI to generate a grounded answer. The raw request address is not stored in Convex; please do not include personal or confidential information.

Host-configured join details. A host can ask for up to three pieces of context when you join, such as department, table number, or cohort, so they can group players and report on participation. You see each question and its answer options before you join, and only the host can see what you entered — other players cannot. Answers are stored with the Run, are deleted with it on the schedule below, and are never used for advertising. If you would rather not share something, ask your host: fields marked optional can be left blank. Lawful basis: legitimate interest of the host organizing the event (GDPR Art. 6(1)(f)).

Private Audience rosters. A host may prepare a reusable list containing your display name and email, then explicitly link it to your player record during a Run. Participants never see this roster. Discera does not include roster names or emails in presentation, sharing, copied assets, workspace moves, or analytics. Lawful basis: legitimate interest of the host organizing and checking attendance for the event (GDPR Art. 6(1)(f)).

Who processes the data

The list below describes current production-relevant processors and infrastructure processors, what each is used for, what data categories they can receive, and whether the use is always-on, feature-triggered, or consent-gated.

Discera does not claim vendor no-training terms, no-retention terms, DPA coverage, SOC 2, ISO certification, or other enterprise processing commitments here unless those terms are separately documented and evidenced for the current account and vendor setup.

AI data use

AI features are optional. Discera only sends data to the listed AI processor when a host or public visitor chooses the matching feature.

OpenAI: AI quiz generation

Discera sends the host prompt or topic, audience context, requested count, difficulty, allowed question types, question-type mix, optional company facts, and one optional source: source PDF bytes, host-supplied source text (pasted text, meeting notes, or extracted public web page content), or the approved imported PowerPoint representation, so OpenAI can return draft quiz questions. The selected source is the primary factual source. The PowerPoint representation includes selected slide text, speaker notes, order, section labels, fallback state, and warning codes, but excludes image bytes, storage identifiers, credentials, and omitted media or animation content.

Only when a host asks Discera to generate quiz content.

OpenAI: AI answer-option generation

Discera sends the question text, question type, requested option count, and existing answer options so OpenAI can draft answer choices for that question.

Only when a host asks Discera to draft answer options.

OpenAI: AI event structure planning

Discera sends the event goal, tone, timebox, audience type, audience size, optional audience notes, optional company facts, optional preset preference, and whether source material exists so OpenAI can propose a run-of-show structure. When the host selects an imported PowerPoint Activity, Discera also sends its approved imported slide text, speaker notes, order, section labels, fallback state, and warning codes; image bytes, storage identifiers, credentials, and omitted media or animation content are excluded. Source PDFs and pasted source text are not sent in this planning request.

Only when a host asks Discera to plan the event.

OpenAI: AI segment content generation

Discera sends the event goal, tone, audience type, audience size, optional audience notes, planned segment kind, title, purpose, target duration, and optional company facts so OpenAI can draft one non-question segment slide plus host-private MC notes. When the host selects an imported PowerPoint Activity, Discera also sends its approved imported slide text, speaker notes, order, section labels, fallback state, and warning codes; image bytes, storage identifiers, credentials, and omitted media or animation content are excluded. Source PDFs and pasted source text are not sent for this request.

Only when a host asks Discera to draft non-question segment content.

OpenAI: AI event package review

Discera sends the event goal, tone, audience type, audience size, optional audience notes, optional company facts, and authored item kinds, titles, body text, question metadata, fact references, and host-private MC notes so OpenAI can identify tone or wording risks, risky free-text prompts, difficulty mismatches, and unsupported company claims. Discera does not automatically attach session IDs, source PDFs, player records, or cross-event records to this request. Text entered into the reviewed package is sent as authored, so hosts should omit sensitive or unrelated data.

Only when a host asks Discera to review an authored event package.

OpenAI: Public manual answers

Discera sends the visitor's free-text question and the code-owned product manual corpus so OpenAI can return a grounded answer. The question and generated answer are stored in Convex with cited manual concept keys for up to 90 days; visitors should not include personal or confidential information.

Only when a public visitor submits a question in the FAQ ask box.

Context.dev: Website-based brand theme extraction

Discera sends the domain extracted from the submitted public HTTPS company website so Context.dev can return brand colors, title metadata, and logo candidate URLs. When Discera uses a returned logo candidate, Discera fetches and rehosts that logo in Convex storage for the draft theme; no theme record is created until the host saves it.

Only when a host asks Discera to generate a theme from a website.

When a host requests a paid AI authoring feature in production, Discera uses the client address observed by Vercel to derive a one-way, purpose-limited rate-limit key. The raw address is not sent to Convex or an AI provider. The derived key is sent to and stored in Convex solely to enforce rate limits. The key changes at each UTC day boundary; people sharing one public address can share a limit, and environments without a trusted address use one shared fallback limit.

Discera does not use one customer's event briefs, company facts, source material, generated content, review payloads, or event outcomes to train models or personalize AI features for another customer.

Retention and data inventory

This inventory separates browser-scoped data from server-retained data, account data, uploaded assets, diagnostics, analytics, and processor-managed data.

Finished and cancelled Runs, cleanup-covered live-Run records such as rounds, player nicknames and answers, and Run-owned uploaded assets are retained through the approved 1, 7, 30, 90, or 365-day attached Event override, workspace default, or organization default, with unmanaged workspaces falling back to 30 days when none is configured. Backend expiry jobs then clean up the Run. Signed-in host account data remains until you delete the account or ask us to remove it. Browser storage entries listed below remain on your device until you clear them or until the listed expiry passes.

Host account export and deletion

Signed-in hosts can open Account to download a JSON export of their local Discera account data, including account profile fields, saved templates, custom themes, upload metadata, and retained Run metadata.

The same page can delete the local Discera account data stored in Convex: the account row, Convex Auth rows and sessions, saved Activities, templates, custom themes, and unreferenced uploads. Runs created by the host are kept until the normal Run-retention expiry, but the deleted account link is removed from those Run rows. The deletion flow can sign the browser out of Auth0 when Auth0 logout is configured, but Auth0 identity deletion is handled manually by an operator. For signed-in hosts who accepted analytics, deleting the local Discera account does not automatically remove the PostHog person profile or consented product-event history linked to the account. Any consented session replays are retained separately and are not removed by local account deletion. PostHog analytics and session replays are typically retained for up to 12 months. Account deletion detaches local identity from retained commerce evidence and schedules a current Host Pro subscription to cancel at the end of the paid period, but the Stripe-side customer record is retained under the commerce retention lifecycle. Microsoft Teams Workflow cards already delivered to a host-configured destination remain there and cannot be recalled by Discera. Email privacy@consensus.dk if you also want the Auth0-side identity removed or to request operator-handled removal of the PostHog person profile, associated events, and session replays.

Export, deletion, and sign-out act only on the regional Discera application (EU or US) you are signed in to, and the account settings page names that region. An export contains only that region's data. Deleting an account in one region leaves an account in the other region untouched, including its workspace access and sign-in session, even when both use the same email address. Signing out of one region does not sign you out of the other. To export or delete data in both regions, sign in to each regional application and repeat the action there.

Cookies and browser storage

The app uses your browser's local storage, session storage, and cookies. Nothing here is used for advertising.

sessionStorage entries are cleared when you close the tab. localStorage entries persist until you clear them in your browser. The history.state fallback entries live in the current tab history entry and are removed after transfer recovery.

Your rights

Under the GDPR you have the right to access, rectify, or delete personal data we hold about you, to restrict or object to processing, and to data portability. Signed-in hosts can export or delete local Discera account data from the account page.

The participant access, export, and erasure workflow applies only when a participant is linked by email to a private Audience roster. An authorized workspace or organization controller verifies that participant outside Discera, then can search the roster and Run links, download complete JSON and CSV records, or start erasure. Run records are included only where the host explicitly linked the roster entry to that participant's player record during the Run. Erasure removes covered active Discera product identifiers, metadata, responses, uploads, and standings. Before completion, Discera invalidates older workspace export jobs and packages that could contain the participant, deletes their server-held packages, and revokes their download handles. A later workspace export is generated from the post-erasure canonical state. The retained receipt and any aggregates do not identify the participant. A legal hold suspends erasure until released.

Product-level erasure completion does not claim that processor backups have already been purged; those copies follow separately disclosed processor-backup windows. Files a controller already downloaded have left Discera's control and follow the controller's retention policy. Discera removes identity-linked names from hosted recaps in place when the disclosed participant can be identified safely. Older identity-bearing recaps that cannot be mapped safely are revoked instead. A recap card already delivered to Microsoft Teams is recipient-controlled: when existing permissions cannot remove it, Discera records a follow-up requirement so the workspace owner can remove the card or notify the recipient.

If you joined with only a nickname and were not linked to a roster email, the controller workflow cannot find, export, or erase your records. Your Run-scoped data instead remains until the Run expires: its recorded policy uses an approved Event, workspace, or organization window, with a 30-day system fallback. Contacting the host can identify the relevant Run and controller, but it does not create an individual erasure path. A host can end or cancel an ongoing Run, which starts ordinary retention; current host controls cannot immediately delete a retained Run or shorten an expiry already recorded when a Run finished or was cancelled.

To exercise rights that need operator handling, including Auth0 identity deletion, email privacy@consensus.dk. You can also lodge a complaint with the Danish Data Protection Authority (Datatilsynet) at datatilsynet.dk.