Privacy

Privacy policy

How we handle personal data, as the current code does it.

Last updated 26 September 2026

Controller

mrbooz AB, Sweden, is the data controller for personal data processed through CDSBench and Mastermind.

What we collect

Your email address when you create an account (by email code or by signing in with Google, which shares your email address with us), follow a company or topic, join a desk, or subscribe to the weekly newsletter.
The documents and instrument details you submit for analysis, the results, and comments you write on a case.
A voluntary role, if you choose to give one.
First-party product events (page views, clicks, timings) keyed by a random visitor id.
Billing identifiers from Stripe (customer, subscription, price and invoice ids, never card numbers).
Basic security signals (the network address a request came from) to stop abuse, such as many accounts from one network.

How we use it

To run the analyses you ask for and keep your case book.
To send the emails the service depends on: sign-in codes and links, a welcome email at your first sign-in, plan and billing notices, alerts and digests you chose, the weekly newsletter if you subscribed, desk invitations and case comments. Alerts and digests can be switched off in your email settings or from the link in each email.
To keep the service safe and within its spending limits, and to understand, in aggregate, how the site is used.
We do not sell personal data and do not use it for advertising.

Analytics

First-party events carry ids, event names, paths of public pages and aggregate metadata, never document text, private results or evidence excerpts. A subset of events is sent to Google Analytics 4 only after you accept the cookie banner; before that, Google Consent Mode denies analytics and advertising storage. Our own traffic is excluded. Bots are dropped at ingest.

Customer documents

Uploaded documents are parsed on the CDSBench server and stored with the result in the CDSBench database (Google Cloud SQL, europe-west1, Belgium) against your account. They are private: not published unless you publish a case yourself, not searchable, not indexed and not used to train models. Share links you create are random, expiring and revocable. See exactly what the code does.

AI model provider

Anthropic: system + user prompt (case header, document sections, question). Retention: Organisation default: inputs, outputs and other data retained 30 days for safety and security (checked 2026-09-17). Zero Data Retention is available on request to Anthropic support and has not been requested. Training: Not used for training under Anthropic's commercial terms; no console setting enables it (checked 2026-09-17).

For long documents, such as an indenture, Mastermind sends the model only the sections that state the terms it checks. Short documents (under about 60,000 characters, such as notices and confirmations) are sent whole.

Service providers

These companies process data on our behalf, only for the purpose listed:

Google Cloud (hosting and database, EU region europe-west1).
Anthropic (AI analysis of the document sections described above).
Stripe (payments, invoices and tax).
Resend (sending email).
Google (sign-in with Google, if you use it, and Google Analytics, only with your consent).

Some of these providers are in the United States. Transfers are covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Billing

Payments are processed by Stripe on Stripe-hosted pages. CDSBench stores the Stripe customer, subscription, price and invoice identifiers and the billing email; card details never touch CDSBench servers.

Retention

Your account, cases and documents are kept until you delete them or your account.
Billing and invoice records are kept for seven years, as Swedish bookkeeping law requires.
Product events are kept to understand long-term use; when you delete your account they are detached from it and stay only as anonymous events.

Your rights and deleting your account

You can delete your account yourself on the account page. That removes your account, every case and analysis in it and your email settings, and we send a confirmation to your address. You can do this once your subscription has ended. A case you made public stays public until you ask us to remove it.

Under the GDPR you may also request access to, correction of, export of, or restriction of your data, and object to processing; we answer within one month.

We process data to provide the service you request (contract), to meet legal and accounting obligations, to keep the service secure (legitimate interest), and, for analytics, on your consent or our legitimate interest in improving the service.

Cookies

Essential cookies, needed for the service to work:

Your sign-in session, and short-lived cookies used while signing in with a code or with Google and when confirming an account deletion.
A known-device cookie (cdsb_dev), for one year, set when you sign in and kept after you sign out. It holds signed markers for up to five addresses that have signed in on this browser, never the email address itself, so a stranger requesting codes for your address cannot lock this browser out of signing in.
A referral code from a referral link, for 30 days, so the discount can be applied at checkout.
Your cookie choice, stored in your browser.
A flag that marks our own team’s visits so they are left out of analytics.

Analytics cookies, only if you accept them: Google Analytics, and a one-day marketing session that links a visit to the campaign it came from. No advertising cookies are used.

Contact

Privacy and rights questions: support@cdsbench.com. You may also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Want to reach out?

A question about your data?

Send access, correction, export and deletion requests to the privacy address.