Privacy Policy
Version v1.7 · 21 September 2026
This policy explains what Ishizenz does with personal data, who else touches it, how long it is kept, and what you can require of us. It describes the product as it works today — not as it is planned.
1.Who we are
Ishizenz is a web application for root-cause analysis, operated by Andrea Bosco in Italy. For the account data described below we are the data controller, which means we decide why and how it is processed.
You can reach us at support@ishizenz.com about anything in this policy, including any request about your rights. It is the only address we publish, and it reaches a person.
We are also a processor, for one part of the data
The content you put inside an analysis — the problem statement, the causes, the notes and the names of the people on the team — is yours, or your employer’s. For that content we act as a data processor: we hold it and serve it back to you, and we do not decide what goes in it. If you record a colleague’s name on an analysis team, you are the controller of that name and we process it on your behalf.
Business customers who need a written data processing agreement for that arrangement should write to us. One is not yet offered as a standard document.
2.What we process, and why we are allowed to
Everything in this table is either something you typed or something the service records in order to work. We do not buy data about you, we do not build profiles, and there is no advertising anywhere in this product.
| What | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Email address, and the password hash if you signed up with one | To create your account, sign you in, confirm your address and let you reset your password. | Art. 6(1)(b) — performing the contract you entered into by creating an account. |
| First name, last name, workspace name | To address you in the interface and to label your work. All three are optional and editable in Settings → Profile. | Art. 6(1)(b) — performing the contract. |
| The date and version of the terms you accepted | To prove the consent required to publish this policy was actually given, and to know when to ask again. | Art. 7(1) — documenting consent. |
| Your analyses: the problem, the description, the causes, the notes and the team members you list | This is the service. It is stored so you can come back to it. | Art. 6(1)(b) — performing the contract. For any third party named in it, we act as processor on your behalf. |
| Your 8D report: the notes you write under each discipline, and the corrective actions with the person you assign them to and the date they are due | It is part of the analysis it belongs to, and it is stored for the same reason. | Art. 6(1)(b) — performing the contract. The people you name as owners are third parties, and for their names we act as processor on your behalf. |
| Your subscription record: the plan, its status and the trial dates | To decide what the account may use. No payment is taken today and no payment data exists. | Art. 6(1)(b) — performing the contract. |
| Whether you asked to receive product email | To know whether we may write to you about the product. Off unless you switch it on, and switchable off at any time in Settings → Notifications. | Art. 6(1)(a) — consent, which you may withdraw at any time. |
| The IP address and browser of each sign-in session | Recorded by our authentication provider so that sessions can be managed and abuse can be noticed. | Art. 6(1)(f) — our legitimate interest in keeping accounts secure. You can end all of them from Settings → Security. |
| A record of each AI request: the date, which feature, which model and how many tokens it used | To count requests against your plan’s monthly allowance and to notice abuse. It records the size of a request, never its content. | Art. 6(1)(f) — our legitimate interest in enforcing limits and preventing abuse. |
There is no analytics service, no error-tracking service and no advertising or tracking technology in this application. If that changes, this policy changes with it before the change ships.
3.Who else processes it
We use other companies to run the service. They process personal data only on our instructions, under a contract, and each is listed below with what it actually does. This list is the complete set of them today — not a list of everything we might one day use.
| Who | What they do for us | Where they are | Transfers outside the EU |
|---|---|---|---|
| Supabase | Database, authentication and file storage. Holds your account and your analyses. | European Union — Frankfurt (eu-central-1) | None. Data stays in the EU. |
| Vercel | Hosting and content delivery. Serves the application to your browser. | United States (company), global edge network | Standard Contractual Clauses, included in Vercel’s data processing agreement. |
| Resend | Sends the transactional email the account needs: address confirmation, password reset and email-change confirmation. | European Union — Ireland (eu-west-1) | None. The sending region is in the EU. |
| Cloudflare | DNS for ishizenz.com, and the email routing that forwards messages sent to our contact address. | United States (company), global network | Standard Contractual Clauses, included in Cloudflare’s data processing addendum. |
| Google (Gmail) | The mailbox our contact address forwards to. It receives whatever you choose to write to us, including any request about your rights. | United States, global | Standard Contractual Clauses, included in Google’s terms. |
| Anthropic | The AI assistant behind the cause suggestions, the evidence review and the 8D report drafts. When you ask for suggestions it receives the problem statement, its description, and each category with the causes already in it. When you ask for a review it receives the problem, its description, and every cause with its status and the notes you attached. When you ask for a report draft it receives all of that plus the report as you have written it so far. It never receives the team you listed or the owners you assigned to actions, and it is not called unless you ask it for something. | United States | Standard Contractual Clauses, in the data processing addendum incorporated into Anthropic’s commercial terms. |
Transfers outside the European Union
Your account and your analyses are stored in Frankfurt and the email we send you leaves from Ireland, so the data at the centre of the service does not leave the EU. Four of the companies above are established in the United States, and where personal data reaches them it is covered by Standard Contractual Clauses approved by the European Commission. You can ask us for a copy of the safeguards that apply.
One of those four is different in kind from the others and has its own section below: the AI assistant is the only one that receives what you wrote, rather than the traffic and the mail around it.
4.The AI assistant, and what it is sent
Three parts of the application ask an AI assistant for help, and they are the three buttons named “Brainstorm”, “Evidence review” and “Generate draft”: the first suggests possible causes for a diagram, the second reviews the evidence behind the causes you have already recorded, and the third drafts parts of the 8D report from them. All three are answered by Claude, a model run by Anthropic in the United States, and this section says exactly what leaves and when — because this is the only part of the service that sends what you wrote to another company.
Only when you ask
Nothing is sent while you work. It happens when you open one of the panels and press the button in it. Each press is one request, and nothing is sent between them.
Brainstorm — suggested causes
One request, covering the whole diagram, and it sends three things:
- The problem statement.
- Its description, if you wrote one.
- Each category of the analysis by name, with the text of the causes already in it — so that the suggestions do not repeat what is there, and so that each new one is filed under the right category.
It does not send the status of a cause or the notes attached to it: the suggestions do not need them.
Evidence review
One request, covering the whole analysis, and it sends more than the brainstorm does:
- The problem statement and its description.
- Every cause in the analysis, with its text, whether you have marked it open, confirmed or excluded, and the notes you attached to it. A very long note is shortened before it is sent.
The status and the notes are the point of this feature rather than an addition to it: what it does is tell you where a cause you marked confirmed has nothing recorded behind it, and where one you excluded was dismissed too quickly. It cannot do that without seeing what you recorded.
8D report drafts — the “Generate draft” button
One request, covering six of the nine disciplines — the emergency response, the containment, the verification summary, the corrective and preventive actions, and the close-out. It sends the most of the three, because it is the only one that reads the report as well as the analysis:
- The problem statement and its description.
- Every cause in the analysis, with its text, whether you marked it open, confirmed or excluded, and the notes you attached to it — the same as the evidence review.
- The 8D report as you have written it so far: the actions already listed under each discipline, whether each is done, the batch or lot number an action takes effect from, the five-W fields in D2, the verification summary in D4, the close-out, and the To do / In progress / Complete marker you set on each discipline.
The report goes because the disciplines are a chain, and a draft written without it repeats you: an action already in your containment list is one the assistant needs to see in order not to propose it again as a corrective action. The batch or lot number goes for the same reason — it is what tells the containment and the correction apart, since each takes effect from a different point in production. It identifies a batch of product, not a person. The progress marker goes so that a discipline you have marked Complete is left alone: without it the assistant drafts into sections you consider finished, which is both work you did not ask for and effort spent away from the sections that still need it.
What comes back is a suggestion and nothing more. It is not saved anywhere until you press “Insert” on a discipline, it is added below what you have already written rather than replacing it, and the assistant is not asked for the owner of an action or its due date — those stay yours to fill in, and it is not sent the people it could pick from.
What is never sent, by any of them
This is a short list on purpose, and it is short because it is the list we can keep. Each of these is refused by a check that runs when the application is built, so a future feature cannot start sending one of them by accident:
- The team members you listed on the analysis. Their names and roles never leave, on any request — and neither does the owner you picked for an action in the 8D report, which is one of those same names.
- Your account: your name, your email address, and the internal identifiers of your account and your workspace.
- The reference numbers: the one the analysis carries in your own system, and the number of the 8D report itself.
One thing follows from this that we would rather say than let you discover: the problem, the description, the causes and your notes are free text, and if you have written a colleague’s name into one of them, that name is part of what is sent. We cannot remove it without destroying what you wrote. What we can do, and have done, is make sure the one field that always holds people’s names is never part of a request.
What changed in version 1.6
The application can now draft parts of the 8D report, which is the third feature described above, and it is the first one that sends the report itself rather than only the analysis. That is what is new, and it is an addition: nothing this policy previously said would not be sent is being sent now.
That is worth saying plainly, because the two versions before it were not additions. Version 1.4 withdrew a promise about the other categories of your diagram, and version 1.5 withdrew one about the status and notes of a cause. This one withdraws nothing, and the reason is the change version 1.5 made to the shape of the list above: it stopped naming things that merely happened not to be sent yet, and started naming only the things a check in our build refuses to send. Two of those were tested by this feature. An action in your report carries an owner, chosen from the team you listed — so that name is removed before the report is sent, rather than the promise being withdrawn. The 8D report number is removed for the same reason.
What changed in version 1.5
Version 1.4 of this policy said, in its list of what is not sent, that the status of a cause and the notes attached to it do not leave. The evidence review sends both, so that was no longer true and we told you plainly rather than quietly dropping a line. It is also why the list above became shorter and different in kind: it names only the things a check refuses to send, rather than the things that happened not to be sent yet.
What Anthropic may do with it
- It is used to answer your request. Under our contract with Anthropic, neither what we send nor what comes back may be used to train their models.
- Anthropic’s own documentation states that prompts and responses are not retained by default. We do not store them either: the suggestions and the review stay in your browser and are gone when you close the panel — unless you accept a suggestion, which becomes an ordinary cause in your analysis.
- The transfer to the United States is covered by Standard Contractual Clauses, as the table above records.
What we do keep is the fact that a request happened: the date, which feature, which model, and how many tokens it used. That is the record described in the table further up, and it exists to enforce the plan limits and to notice abuse. It contains none of the text.
Neither one decides anything
Nothing the model returns changes your analysis. A suggestion is a list you read, and it becomes part of your work only when you add it yourself. A review is an opinion you read, and the only thing it can change is a cause you choose to reopen from it. There is no automated decision-making here in the sense of art. 22 — nothing is decided about anybody, by us or by the model.
5.How long we keep it
| What | Kept for | Deleted when |
|---|---|---|
| Your account and profile | As long as the account exists | You delete the account, from Settings → Account. |
| Your analyses and everything inside them | As long as the account exists | The account is deleted; they are removed with it, automatically. |
| Your consent record — the date and version | As long as the account exists | The account is deleted. Until then it is kept because it is the proof that consent was given. |
| Session records — IP address and browser | Until the session expires or you end it | You sign out, you end all sessions from Settings → Security, or the session expires on its own. |
| The record of your AI requests — date, feature, model, token counts | As long as the account exists | The account is deleted; the records go with it, automatically. They are also part of the archive you can download at any time. |
Deleting your account is immediate and it is not reversible. There is no archive to restore from and no waiting period we hold your data through — which is worth knowing in both directions before you press it.
6.Your rights, and how to use them
The GDPR gives you the following rights over your personal data. Two of them you can exercise yourself, right now, without asking us; for the rest, write to us and we will answer within one month of receiving your request, as art. 12(3) requires.
What you can do yourself
- Access and portability (art. 15 and art. 20) — “Download my data” in Settings → Account gives you a machine-readable archive of your profile and every analysis you own. It is available on every plan: a right is not a feature we sell.
- Rectification (art. 16) — your name and workspace are editable in Settings → Profile, and your email address in Settings → Account.
- Erasure (art. 17) — “Delete account permanently” in Settings → Account removes the account and everything attached to it.
- Withdrawing consent (art. 7(3)) — the product-email switch in Settings → Notifications turns off as easily as it turned on, and withdrawing it does not affect anything done before.
What to write to us about
- Restriction of processing (art. 18) — asking us to hold the data but stop doing anything with it.
- Objection (art. 21) — objecting to the processing we do on the legitimate-interest basis named above.
- Anything the two self-service routes do not cover, including a copy of the safeguards covering transfers outside the EU.
Write to support@ishizenz.com. We do not charge for this and we will not ask you to justify the request. If you think we have handled your data badly, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali, at https://www.garanteprivacy.it — you do not have to come to us first.
There is no automated decision-making and no profiling in this service, so art. 22 does not arise.
7.What we store on your device
Ishizenz shows no cookie banner, and this section is why. Under the ePrivacy rules — in Italy art. 122 of the Codice Privacy — consent is needed to store things on your device unless they are strictly necessary for a service you asked for, or you asked for them yourself. Everything below is one or the other. Being exempt from asking is not being exempt from telling you, so here is all of it.
| What | How | Why | How long |
|---|---|---|---|
| sb-<project>-auth-token | Cookie | Keeps you signed in. Without it the application cannot work at all. | For the session, refreshed while you use the app. Cleared when you sign out. |
| ishizenz_prefs | Cookie | Remembers the theme, diagram density and export colour you picked in Settings → Appearance. Written only when you change one of them, and read by our server so the page is drawn in your theme immediately instead of flashing the wrong one. | 1 year |
| ishizenz_trial_dismissed | Cookie | Remembers that you closed the expired-trial notice, so it is not shown to you again. Written only when you close it. | 1 year |
| ishizenz-offline | IndexedDB | Holds the changes you make to an analysis while your connection is down, so they survive closing the tab and are sent to us on their own as soon as you are back online. It holds everything the editor can change, which is more than the causes: the problem and its description, the cause tree with its notes, the 8D report, the reference number, the status, and the people you listed on the investigation team — so if you named a colleague, their name is on this device too, for as long as the change is waiting. It is the only place any of your own content is kept on your device, and only for the analyses you were editing when the connection went. | Until the change reaches the server, which normally happens the moment you reconnect. Signing out deletes it — including anything that has not been sent yet, which is why you are warned first. |
| workbox-precache, static-* and next-image caches | Cache Storage, written by the service worker | Stores the application’s own files — scripts, styles, fonts, images and the offline page — so it loads quickly and can tell you the network is gone instead of showing a browser error. It holds no analyses, no API responses and nothing about you. | Until your browser evicts it or you clear this site’s data. Signing out does not clear it, which is why nothing personal is put there. |
The rule is about storing information on your device, not about cookies specifically, so it covers local storage, caches and databases the same way. That is why the service worker’s caches are listed even though nothing in them is personal data. If we ever store something that does not fit one of the two exemptions, you will be asked first.
The offline queue, and why it is not asked about
One of those rows is different from the others, and it is worth saying why it is exempt rather than leaving you to take our word for it. The offline queue holds your own content — the changes you made to an analysis you had open when the connection went. It is there for one purpose: to deliver the edit you were making, to the analysis you opened, to us. That is storage strictly necessary to provide a service you asked for, in the same way the sign-in cookie is, so no consent is required for it. It is not used to recognise you, it is never read by us, and nothing is put in it that you did not type.
Two consequences you should know about. Signing out deletes the queue, including changes that have not reached us — we warn you before that happens, and the way to keep them is to stay signed in until you have a connection. And because a copy of your data covers what we hold, a copy taken while changes are still queued on your device will not contain them: they have not reached us yet, so they are not ours to give you. Reconnect first, let them save, and then ask.
8.How it is protected
Analyses are readable only by the account that owns them, enforced by the database itself rather than by the application asking nicely — so a bug in a page cannot hand your work to somebody else. Traffic is encrypted in transit, passwords are stored hashed by our authentication provider and never reach us in readable form, and new passwords are checked against known breached-password lists.
If a breach happens that is likely to put your rights at risk, we notify the supervisory authority within 72 hours of becoming aware of it, and we tell you directly if the risk to you is high.
9.Children
Ishizenz is a tool for work and is not directed at children. You must be at least 16 to have an account. We do not knowingly process the data of anyone younger; if you believe we have, write to us and we will remove it.
10.Changes to this policy
This document carries a version, shown at the top of the page, and the same version is recorded against your account when you accept it. When we change something that affects you, we publish a new version and ask you to accept it the next time you sign in — you will see the terms screen again, and you can read both documents before agreeing to anything. That is the mechanism, not a promise to remember: the application compares the version you accepted against the current one on every page load.
Corrections that change nothing about what we do — a typo, a clearer sentence — do not get a new version and do not interrupt you.
11.One thing you should know about where this product is
Ishizenz is in closed testing. It is run by one person, it is free, and it has no payment path — so nothing here describes billing, because there is nothing to bill. These documents have been written carefully and honestly, and they have not yet been reviewed by a lawyer; that review happens before the product ever accepts money. If accuracy today matters more to you than a countersigned document, this policy is accurate. If it does not, this is the moment to decide against creating an account.