Privacy Policy

Retrium Next (Beta)

Effective Date: August 10, 2026

This Privacy Policy describes how Retrium, Inc. (“Retrium,” “we,” “us,” or “our”) collects, uses, and shares information in connection with Retrium Next (the “Beta Service” or “Service”), our new beta product for team retrospectives and related collaboration. By accessing or using the Beta Service, you acknowledge that you have read and understood this Privacy Policy.

Beta notice. Retrium Next is a pre-release, beta version of the Service and is provided “as is” and “as available” for evaluation purposes. During the beta period we do not make any data retention, backup, availability, or uptime commitments, and we do not provide a contractual backup or recovery service (see the Terms). These disclaimers concern non-preservation only—they mean your data may be deleted or lost and may not be recoverable. They do not permit us to retain or use your information beyond the purposes and retention periods described in this Privacy Policy. Please do not rely on the Beta Service to store the only copy of any information that is important to you.

1. Scope and Beta Status

This Privacy Policy applies only to the Retrium Next beta Service and the information we process through it. It does not apply to Retrium’s generally available products, to third-party websites or services, or to information you provide offline. Because the Service is in beta, its features, data flows, and this Privacy Policy may change frequently. We encourage you to review this page periodically.

2. Our Roles: Controller and Processor

When Retrium processes retrospective content and related information on behalf of a customer organization, the customer organization controls that information and Retrium acts as its processor or service provider. Retrium acts as an independent controller or business for information used to administer accounts, secure the Service, provide support, communicate directly with users, and manage its business. Requests concerning content controlled by a customer organization may need to be directed to that organization. Where Retrium acts as a processor or service provider, our processing is also governed by our Data Processing Addendum (“DPA”).

3. Information We Collect

a. Information you provide to us

When you create an account or use the Service, we collect information such as your name, email address, organization or team name, and account credentials. If you contact us for support, we collect the information you include in your communications.

b. Content you create (“Customer Content”)

The Service allows you and your team to create, upload, and share retrospective content, comments, notes, votes, interview and survey responses, action items, and other materials (“Customer Content”). We process Customer Content to provide the Service to you and your team, including through the AI features described below.

c. Information collected automatically (“Usage Data”)

When you use the Service, we and our service providers automatically collect certain information through log files, cookies, pixel tags, and similar technologies (“Usage Data”). This may include your IP address, browser type, device and operating system information, referring/exit pages, timestamps, and usage and interaction data about how you use the Service.

d. Information from third parties

If you sign in using a third-party authentication provider (for example, Google single sign-on), we receive basic profile and authentication information from that provider as permitted by your settings with them. We may also receive analytics and usage information from the service providers listed in our Subprocessor Information.

4. How We Use Your Information

We use the information we collect to: provide, operate, maintain, and improve the Beta Service; create and manage accounts and authenticate users; respond to your requests and provide customer support; monitor, analyze, and understand usage, performance, and reliability; detect, prevent, and address security incidents, fraud, and abuse; develop new features and evaluate the beta; communicate with you about the Service, including beta-related notices; and comply with legal obligations and enforce our Terms & Conditions.

5. How We Use Information in AI Features

The Service uses artificial intelligence (“AI”) features to help summarize, organize, group, and surface themes from retrospective content and to provide related suggestions. AI inference is routed through OpenRouter to Google’s Gemini models; Retrium uses Google Gemini as its sole model provider, so requests are processed only on Google’s infrastructure. Every request is configured for zero data retention with model training explicitly disabled. Content is sent without direct identifiers, so the AI provider cannot link it to a specific individual unless a user includes personal information within the retrospective content itself. This section explains how information is handled in those features.

• What is processed by AI. The retrospective content you and your team submit—such as notes, comments, and interview or survey responses, which may contain personal information—is sent to the AI provider to generate summaries, topics, and suggestions. Requests are tagged only with pseudonymous internal identifiers (for example, an internal user, team, or retrospective ID) used for cost tracking and analytics; we do not send names, email addresses, or other direct identifiers as request metadata.
• Purpose limitation. We use AI to process Customer Content solely to provide, secure, support, and evaluate the Service.
• Zero data retention. Every AI request is sent under a zero-data-retention configuration, so the AI provider and the model endpoints do not store your prompts or the generated outputs. If no endpoint can meet this requirement, the request fails rather than routing to a non-compliant provider.
• No training. We do not use Customer Content to train AI models, and our AI provider is restricted from using it to train models or for any purpose other than returning outputs to us. We may use Usage Data and de-identified information (information that cannot reasonably be linked to a customer or individual) to improve our products and services, and we do not attempt to re-identify de-identified information.
• Who can access it. Within the Service, Customer Content and derived topics may be visible to other members of your team, workspace, or organization according to the retrospective’s settings. Authorized Retrium personnel may access Customer Content where reasonably necessary to provide, support, secure, and evaluate the Service, subject to confidentiality obligations.
• Internal AI logs. We keep internal logs of AI usage for cost tracking and reliability—recording the model used, token counts, timing, status, and pseudonymous identifiers. These logs do not contain the text of your prompts or the AI’s responses.

6. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Service, remember your preferences, keep you signed in, understand how the Service is used, and support analytics and marketing. You can manage non-essential cookies through our cookie banner and preference controls, and through your browser settings. Disabling certain cookies may affect how the Service functions. For more detail on the categories of cookies we use, see our cookie banner and cookie preferences.

7. Who May Access Your Personal Data

We do not sell your personal information, and we do not sell or share Customer Content, use it for advertising, or use it to train AI models. We share information only in the following limited circumstances:

• Service providers and subprocessors. We share information with third parties that perform services on our behalf, such as hosting, data storage, AI processing, analytics, customer support, and communications. These parties are listed in our Subprocessor Information and are authorized to use personal information only as necessary to provide services to us.
• Within your team or organization. Content you contribute in a retrospective may be visible to other members of your team, workspace, or organization.
• Legal and safety. We may disclose information if required to do so by law or in the good-faith belief that disclosure is necessary to comply with legal process, enforce our agreements, or protect the rights, property, or safety of Retrium, our users, or others.
• Business transfers. If Retrium is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy.

8. How We Protect Your Information

Retrium uses commercially reasonable and industry-standard administrative, technical, and physical safeguards designed to protect personal information, including access restrictions, encryption in transit, and hosting in secure data centers.

Beta limitation. No method of transmission or storage is completely secure, and during the beta period we do not guarantee the security, integrity, retention, backup, or recoverability of any information or content. You are responsible for maintaining your own copies of any content that is important to you.

9. Data Retention

This section describes Retrium’s intended data-handling and deletion practices for the Beta Service. These practices are not a contractual guarantee: as explained in the Beta notice and the Terms, we do not provide a contractual backup or recovery service and content may be deleted or lost at any time during the beta. We retain each category of information only as long as needed for the specific purpose for which it was collected, and then delete it or de-identify it. We do not retain Customer Content for undisclosed purposes, and the criteria we use to determine retention are limited to whether we still need the information to provide the Service to you, to comply with a legal obligation, to resolve a dispute, or to enforce our agreements. Our intended retention approach is:

• Workspace and retrospective content (Customer Content): retained while the account remains active (including while an account is closed or inactive). When a user initiates the account-deletion flow, the associated content is purged from our active systems within 7 days.
• Account and registration data: retained while the account exists, including after it is closed or made inactive. A closed account is not the same as a deleted one; account data is purged on the same 7-day timeline once the deletion flow is initiated.
• Backups: any residual copies of deleted content held in routine backups are overwritten in the ordinary course of our backup rotation and are not restored to active use.
• Security and event logs: retained on an ongoing basis for security, troubleshooting, and abuse-prevention purposes.
• Support communications: retained on an ongoing basis to maintain a record of support history.
• Usage Data and analytics: retained on an ongoing basis, often in aggregated or de-identified form.
• Legal and compliance records: retained only as required to meet legal, tax, or regulatory obligations, and then deleted.
• De-identified and aggregated data: we may retain data that has been de-identified or aggregated so that it cannot reasonably be linked to you or an individual; we maintain it as de-identified and do not attempt to re-identify it.

To delete your account and its retrospective content during the beta, use the in-product account-deletion flow or contact us at next@retrium.com; the associated content is purged from active systems within 7 days. Where Retrium acts as a processor for a customer organization, deletion and return of Customer Content are also governed by the DPA, which controls in the event of a conflict.

10. International Data Transfer

Our servers and service providers are located primarily in the United States. If you access the Service from outside the United States, you understand that your information, including personal information, will be transferred to, stored, and processed in the United States and other countries where our service providers operate. These countries may have data protection laws that differ from those in your country. Where required, international transfers of personal data we process on a customer’s behalf are addressed in the DPA, including applicable Standard Contractual Clauses and UK transfer terms.

11. Children’s Privacy

The Service is intended for use by businesses and their personnel and is not directed to children. You must be at least 18 years old to use Retrium Next; this also aligns with the requirements of the AI providers that process content for the Service. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal information, please contact us at next@retrium.com and we will take steps to delete it.

12. Your Rights and Choices

Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, update, or delete your information, to object to or restrict certain processing, and to opt out of marketing communications. You can update account information within the Service, unsubscribe from marketing emails using the link in those emails, and contact us to exercise your rights. Residents of California, Maryland, and other U.S. states with applicable privacy laws, and individuals in the EEA and UK, may have additional rights; we will honor those rights as required by applicable law. Because Retrium acts as a processor for retrospective content controlled by a customer organization, we may direct requests about that content to the relevant organization. Where required by law, we honor recognized browser opt-out preference signals, such as Global Privacy Control (GPC), through our cookie consent management. To make a request, contact next@retrium.com. We will respond as required by applicable law and may need to verify your identity before acting on a request.

13. Third-Party Links and Services

The Service may contain links to third-party websites or integrate with third-party services. We are not responsible for the privacy practices of those third parties, and this Privacy Policy does not apply to them. We encourage you to review the privacy policies of any third-party services you use.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time and at our sole discretion, particularly while the Service is in beta. Changes are effective when posted on this page, and we will update the “Effective Date” above. If we intend to materially expand how Customer Content is used—for example, to use identifiable content to train AI models—we will provide notice and obtain any consent required by law before doing so. Your continued use of the Service after changes are posted constitutes your acceptance of the updated Privacy Policy.

15. How to Contact Us

If you have questions or requests regarding this Privacy Policy or your personal information, contact us at:

Retrium, Inc.

Privacy inquiries: next@retrium.com

Support: next@retrium.com