Privacy Policy
The plain-English summary. Decidan is a decision operating system for businesses. Your data exists in Decidan so that your own decisions can be prepared, recorded, and kept on your permanent record. We read your accounting data only with your authorization, we never sell or share your data for advertising, our support staff cannot see your numbers without your explicit time-limited permission, and every access is logged where you can see it. The formal version follows.
1. Who we are
Decidan (https://decidan.ai, application at app.decidan.ai and per-client subdomains) is operated by 10X Systems Inc., an Illinois corporation. This policy covers the Decidan website and application. Where Decidan is provided to you through your accounting firm under a service engagement, your firm’s engagement terms apply in addition to this policy.
2. What we collect
- Account data. Name, email address, and a salted cryptographic hash of your password (we cannot read your password). Roles and permissions your organization’s Principal assigns.
- Business data you provide. Files your organization uploads (for example receivables, transactions, engagements, pipeline data) and the typed inputs you submit (decisions, rationale, corrections, directives).
- Accounting data you authorize. If your organization connects QuickBooks Online, we access accounting reports (such as receivables aging and transaction data) under read-only scope, via OAuth authorization you grant and may revoke at any time. We never write to your accounting system and never access payment instruments.
- The record. Decidan’s core feature is an append-only, cryptographically chained record of operational events in your organization: what was proposed, decided, by whom, when, and why. This record is your organization’s property and its contents are visible to your organization.
- Technical data. Standard server logs (IP address, timestamps, user agent) for security and reliability. We do not use advertising trackers or sell analytics.
3. What we do not do
- We do not sell, rent, or trade your data. No advertising use, ever.
- We do not permit our personnel to view your business data without an explicit, time-limited access grant from your organization’s Principal. Every such session is visible to you, revocable with one click, and permanently logged on your record.
- We do not use your business data to train machine-learning models, and our AI subprocessor is contractually restricted from doing so (see Section 5).
4. How we use data
Solely to provide the service: preparing decision briefs and computations for your organization, executing the rules your organization sets, maintaining your record, providing support you request, securing the platform, and meeting legal obligations. Aggregate, de-identified operational statistics (for example uptime or feature usage counts) may be used to improve the product; these never contain your business figures.
5. Subprocessors
- Cloudflare, Inc. — hosting, storage, and network security (global edge; primary data residency in the United States).
- Anthropic, PBC — may generate narrative prose in decision briefs from figures our software has already computed. API traffic to Anthropic is not used to train models per its commercial terms.
- Intuit Inc. — QuickBooks Online, as the accounting data source your organization authorizes.
We will update this list before adding a subprocessor that can process your business data.
6. Security
Transport encryption (TLS) everywhere; passwords stored as salted PBKDF2 hashes; secrets held in encrypted platform storage; per-organization data isolation; append-only audit records; access controls enforced in software on every request. No security is perfect; we will notify affected organizations without undue delay of any breach affecting their data, consistent with applicable law.
7. Retention and deletion
Business data is retained for the duration of your organization’s use of the service. On termination, or on a verified request from your organization’s Principal, we delete business data within 30 days, except that (a) the organization may first export its record, and (b) minimal records may be retained where law or bona fide audit obligations require it. Disconnecting QuickBooks (see the Disconnect page) revokes our tokens immediately and stops all further reading of accounting data.
8. Your rights
Access, correction, export, and deletion requests go to hello@decidan.ai and are honored for your organization through its Principal. Where privacy law grants you individual rights (for example under applicable U.S. state privacy laws), we honor them within the statutory timelines.
9. Changes
Material changes are announced by email to organization Principals at least 14 days before taking effect. The current version always lives at https://decidan.ai/privacy.