Legal & Privacy — The Chairman's Lounge

Effective date: November 14, 2026

01Terms of Use & Disclaimer

Acceptance of Terms

By accessing or using The Chairman's Lounge platform ("the Platform"), you agree to be bound by these Terms of Use. If you do not agree, do not access or use the Platform. The Platform is application-only; access is granted solely at the discretion of the Platform operator.

Not Professional Advice. Nothing on this Platform — including AI-generated board member responses, strategic recommendations, health summaries, governance guidance, financial commentary, or any other content — constitutes financial, legal, investment, tax, medical, or professional advice of any kind. All content is generated for informational and personal productivity purposes only.

Informational & Productivity Use Only

The Platform is a private productivity and decision-support tool. It is designed to help you organize your thinking, track personal metrics, and structure strategic reflection. It is expressly not a licensed financial adviser, registered investment adviser, law firm, medical provider, or any other regulated professional service. You should consult qualified professionals before making any financial, legal, medical, or other consequential decisions.

AI-Generated Content

The Platform uses artificial intelligence to generate responses from virtual board members and other advisory content. AI-generated content may be incomplete, inaccurate, outdated, or unsuitable for your specific situation. You acknowledge that AI systems can produce errors and that no AI-generated content should be acted upon without independent verification.

Use at Your Own Risk. Your use of the Platform and any reliance on its content is entirely at your own risk. The Platform operator expressly disclaims all warranties, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, and non-infringement.

Third-Party Data & Integrations

The Platform may allow you to import data from third-party services (such as Quest Diagnostics, Oura Ring, or Fitdays). The Platform operator makes no representations regarding the accuracy of third-party data and is not responsible for errors in data originating from external sources.

Permitted Use

The Platform is licensed for your personal use only. You may not: (a) share access credentials with unauthorized parties; (b) reverse-engineer, copy, or redistribute any part of the Platform; (c) use the Platform for unlawful purposes; or (d) attempt to gain unauthorized access to any system or data.

02Limitation of Liability

No Consequential Damages

To the maximum extent permitted by applicable law, the Platform operator and its affiliates, agents, and licensors shall not be liable for any indirect, incidental, special, consequential, or punitive damages — including but not limited to loss of profits, loss of data, business interruption, personal injury, or any other loss — arising out of or in connection with your use of or inability to use the Platform, even if advised of the possibility of such damages.

Cap on Liability

In no event shall the Platform operator's total cumulative liability to you for any cause of action exceed the greater of (a) the amount you have paid to access the Platform in the twelve (12) months preceding the claim, or (b) one hundred U.S. dollars (US $100).

Reliance on AI Output

You expressly acknowledge that any decision made in reliance on AI-generated content from the Platform — including investment decisions, health interventions, legal actions, or business transactions — is made solely at your own risk. The Platform operator assumes no liability for outcomes resulting from such reliance.

Indemnification

You agree to indemnify, defend, and hold harmless the Platform operator and its affiliates from any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising from your use of the Platform, your violation of these Terms, or your infringement of any third-party rights.

Force Majeure

The Platform operator shall not be liable for any failure or delay in performance resulting from causes beyond its reasonable control, including but not limited to acts of God, war, cyberattacks, power outages, or third-party service disruptions.

03Privacy Policy

Effective date: November 14, 2026

What We Collect

To operate the Platform, we collect and store the following categories of information:

Account credentials: Email address and hashed password used to authenticate your session.
Profile information: Name, title, date of birth, height, biological sex, and avatar — provided voluntarily by you.
Strategic content: Annual plans, quarterly goals, governance rules, decisions, journal entries, and other content you create within the Platform.
Health data: Biometric readings, lab results, sleep data, and other health-related files you choose to import or log manually.
Conversation history: Messages exchanged with AI board members and the Chairman's Rhythm coach, stored to maintain context across sessions.
Usage metadata: Timestamps, session identifiers, and request logs used for platform security and reliability.

How It's Stored

Where your data lives. Your data is stored on the Platform operator's own private server, not with a cloud hosting provider. The server can be reached only over a private, encrypted network, and its storage is encrypted. Data leaves the server only when a feature needs it: requests to OpenAI for AI responses (see section 04), to ElevenLabs to turn replies into speech when you use voice replies, to Microsoft or Google if you connect those accounts, to our email delivery provider when the Platform emails you, and to Apple (through Expo) to deliver push notifications.

Data is logically isolated per user — each user can only access their own records. Passwords are never stored in plaintext; they are hashed using industry-standard algorithms before storage. Files you upload or attach — images, documents, PDFs and audio recordings — are kept in private storage on the server so you can open them again. Only your account can open them, and they follow the same retention and deletion terms as the rest of your data.

How We Use Your Data

Your data is used exclusively to operate and personalize the Platform for you. Specifically:

To generate AI board member responses and strategic guidance tailored to your context.
To display your health metrics, trends, and imported data on your dashboards.
To support your planning, governance, and decision-making workflows.
To maintain session security and prevent unauthorized access.

We do not sell your data. Your personal information, health records, strategic plans, and conversation history are never sold, rented, shared, or disclosed to third parties for marketing, advertising, or any commercial purpose. Your data belongs to you.

Third-Party AI Processing

The Platform uses the OpenAI API to power its AI board members, coaching sessions, strategic planning, and health analysis features. When you interact with these features, relevant context from your stored data — such as goals, health metrics, governance rules, and profile information — is included in the request sent to OpenAI in order to generate a personalized response. This processing occurs exclusively through OpenAI's private API, not through any consumer-facing OpenAI product. See the AI Data Processing & OpenAI Standards section below for full details on what this means for your privacy.

Your data is never used to train AI models. Because this Platform connects to OpenAI through a private, paid API key — not through a consumer product — OpenAI's API data usage policy applies. Under that policy, OpenAI does not use your data to train or improve their models. Your health information, family details, strategic plans, faith entries, and conversations remain private to you and to this Platform.

Microsoft 365 (Outlook)

If you connect a Microsoft account, the Platform can show your Outlook calendar, create events you ask for, send emails you approve, and sort your inbox with rules based on sender and subject (Inbox Cleanup). It keeps a short log of moved messages (sender, subject, date) so a move can be undone. Outlook email and calendar content, including those sender and subject details, is not included in requests to OpenAI or any other AI service. You can disconnect at any time in Settings or in your Microsoft account's app permissions.

Data Retention & Deletion

Your data is retained for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting the Platform operator. Upon confirmed deletion, your data will be permanently removed from our systems within 30 days, except where retention is required by law.

Security

We implement technical and organizational safeguards to protect your data. Key measures include encrypted transport (HTTPS/TLS) for all communications, access-controlled database environments with strict per-user data isolation, session-based authentication with PostgreSQL-backed session storage, per-user rate limiting on all AI endpoints to prevent abuse, and industry-standard bcrypt password hashing. No system is perfectly secure; you accept residual risk inherent in any online platform. See the Security Safeguards section for full details.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active users. Continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.

04AI Data Processing & OpenAI Standards

How the AI Connection Works

This Platform generates AI responses by sending requests to OpenAI's API using a private, paid API key held exclusively by the Platform operator. This is fundamentally different from using a consumer product such as ChatGPT. The distinction matters: consumer products operate under different data handling terms. The API connection routes your data through a private, authenticated channel that is subject to OpenAI's enterprise-grade API data usage policy.

OpenAI does not train on API data. OpenAI's official policy, in effect since March 2023, explicitly states that content submitted through the API is not used to train or improve OpenAI's models. Your data — including health records, family information, business strategy, faith entries, and conversations — does not feed into any current or future OpenAI model.

What OpenAI Receives

When you interact with an AI feature on the Platform, a request is assembled on our server containing:

Your message or prompt: The question, directive, or content you submit to the AI.
Relevant personal context: Portions of your stored data selected to make the response useful — such as your goals, governance rules, or health summary.
A system instruction: Instructions that define how the AI should respond (your board member personas, tone, and format).

This data travels over an encrypted HTTPS connection directly to OpenAI's servers. No third party intercepts or has access to this transmission.

OpenAI's Data Retention

Under OpenAI's API usage policy, OpenAI may retain API request and response data for up to 30 days solely for the purpose of monitoring for policy violations and abuse. After that period, the data is deleted from OpenAI's systems. This retention is security-focused and operational — it is not used for product improvement or model training.

Private API Key Standards

Our OpenAI API key is a private credential that:

Is stored exclusively on the server — it is never transmitted to your browser or any client device.
Authenticates every request we make to OpenAI, ensuring that only this Platform can use our account's quota.
Enables us to operate under OpenAI's API terms, which carry stronger data privacy protections than consumer products.
Is rotatable at any time if a security concern is identified, immediately terminating any prior access.

OpenAI's Own Privacy Commitment

For users who wish to review OpenAI's commitments directly, the applicable documents are:

API Usage Policy: openai.com/policies/usage-policies
Privacy Policy: openai.com/policies/privacy-policy
Data Processing Addendum (DPA): Available to enterprise customers on request — establishes OpenAI's data processing obligations in writing as a legal contract.

05Security Safeguards

Encryption in Transit

All communications between your device and the Platform are encrypted using TLS (Transport Layer Security). This applies to both the web application and the mobile app. Data sent to third-party services such as OpenAI is also transmitted exclusively over encrypted HTTPS connections.

Per-User Data Isolation

Every database query is scoped to your authenticated user account. It is architecturally impossible for one user's data to appear in another user's session. This is enforced at the database query level — not just at the interface level — so that even internal bugs cannot inadvertently expose cross-user data.

Authentication & Session Security

Access to the Platform requires a valid authenticated session. Sessions are:

Stored in a PostgreSQL database — not in browser memory or local storage.
Verified against the database on every request to ensure they remain valid.
Immediately invalidated upon logout.
Protected by HttpOnly cookies in the web app, making them inaccessible to browser-based JavaScript.
Transmitted only over HTTPS in production (Secure cookie flag).

Password Storage

Passwords are never stored in plaintext. They are hashed using bcrypt with a high work factor before being written to the database. Even in the unlikely event of a database breach, raw passwords cannot be recovered from stored hashes.

Rate Limiting & Abuse Prevention

To protect all users and prevent misuse, the Platform enforces rate limits on every endpoint. AI-powered endpoints apply stricter per-account limits — meaning each user's quota is tracked independently, so one account cannot consume resources at the expense of others. Authentication endpoints are further restricted to prevent brute-force login attempts.

Input Validation

All data submitted through the Platform is validated before processing. Messages sent to AI endpoints are capped at a maximum length. Uploaded files are validated by type and size. These controls prevent malformed or excessively large inputs from reaching the AI processing layer.

No system is perfectly secure. While we implement industry-standard safeguards, no online platform can guarantee absolute security. You acknowledge and accept the residual risk inherent in using any internet-connected service.

06Health & Fitness Data

Your health data is yours alone. Health and fitness information you share with this Platform is used for one purpose only: to surface meaningful insights within your personal Chairman's Lounge. It is never sold, rented, shared, licensed, or disclosed to any third party for any reason — including advertising, research, or insurance purposes.

What Health Data We Collect

Health and fitness data enters the Platform through two pathways:

Manual entry: Biometric readings you log directly — weight, body fat percentage, lean mass, resting heart rate, blood pressure, and similar metrics.
Lab & diagnostic imports: Lab results from providers such as Quest Diagnostics, uploaded as files and parsed into structured readings (e.g. cholesterol panels, hormone levels, metabolic markers).
Wearable sync via Chairman's Mobile Command: Data from connected devices and health platforms — including Oura Ring sleep and readiness scores, Apple Health (via HealthKit), and Google Health Connect — synced through Chairman's Mobile Command iOS/Android app.
Sleep & recovery data: Sleep hours, HRV, and readiness scores from supported wearables.
Subjective wellness notes: Free-text entries or notes you add alongside any health log.

How Your Health Data Is Used

Health data is used exclusively to enhance your personal experience on the Platform:

Displayed on your personal Health dashboard — trends, charts, and milestone tracking.
Included in Alfred's intelligence context, so the board can account for your physical capacity and recovery when providing strategic guidance.
Surfaced in weekly and monthly performance briefings as part of your Performance Score.
Used to generate personalized observations (e.g. "Sleep has dropped below 7 hours for the last three weeks — this is affecting your recovery window").
Referenced in board sessions when relevant to decisions about energy, capacity, travel, or workload.

Health data is never sent to AI models in raw form. When health context is included in an AI board session, it is formatted as a summarized, structured snapshot (e.g. "HRV: 58ms · Sleep: 6.4h · Readiness: 72") — not as raw files, PDFs, or personally identifying health records. Lab results you import through Health are turned into structured values and the original file is not kept. A file you attach to a conversation or board session is kept with that conversation.

What We Will Never Do With Your Health Data

The following uses of your health and fitness data are absolutely prohibited and will never occur:

Sell, license, or transfer your health data to any third party.
Share health data with insurers, employers, advertisers, data brokers, or any commercial entity.
Use your health data to build profiles for marketing or behavioral targeting.
Disclose health data to researchers, academic institutions, or government entities without your explicit written consent (except as required by law).
Use health data to train, fine-tune, or improve any AI model — including models used by this Platform.
Keep the original files from a Health import (lab reports, wearable exports) after they have been processed.

Chairman's Mobile Command & Device Permissions

Chairman's Mobile Command (iOS and Android) requests access to health data on your device through Apple HealthKit and Google Health Connect. These permissions are:

Read-only access: The app only reads health data. It never writes anything to Apple Health or Health Connect.
Automatic sync: The app syncs your health readings when you open it or tap Sync, and in the background from time to time (iOS decides when; at most every 30 minutes, the last two days only). To stop background syncing, turn off Background App Refresh for the app or remove its Health access in Settings.
Device-to-server encryption: All health data transmitted from your device to the Platform server travels over an encrypted HTTPS connection and is never stored locally on the device beyond the active session.
Revocable at any time: You can revoke health permissions from your device's Settings app at any time, which immediately stops the app's ability to read any health data.

Health Data Deletion

You may request deletion of all health data associated with your account at any time. This includes all logged metrics, imported lab values, wearable sync history, and any health context stored in session history. Upon a confirmed deletion request, all health records will be permanently removed from our systems within 30 days. Deletion of health data does not affect your account or other Platform data unless you also request full account deletion.

07Independent Platform

Independent Platform. The Chairman's Lounge is an independent platform built around the Chairman's Framework — a vocabulary and rhythm developed for and by its members, where the Chairman governs every domain of life from one room. It is not affiliated with, endorsed by, sponsored by, or licensed by any third-party coaching, training, or consulting organization.

Personal Planning Tool — Not Professional Advice

The frameworks, prompts, board commentary, and recommendations displayed within this Platform are personal planning tools intended to support the Chairman's own thinking. Nothing on this Platform constitutes professional coaching, business consulting, legal, financial, tax, medical, or investment advice. Members are responsible for their own decisions and should engage qualified professionals where appropriate.

08Google Workspace API — Limited Use

Google User Data Policy — Limited Use Commitment. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

What Google Data We Access

This Platform integrates with Google Workspace APIs solely to support features you explicitly activate — specifically Google Calendar integration and Google Mail (Gmail) integration. When you connect your Google account, the Platform may access:

Google Calendar: Reading and creating calendar events at your direction, so Alfred can schedule meetings, check availability, and surface upcoming commitments in your briefings.
Google Mail (Gmail): Sending emails you approve, and — if you use Inbox Cleanup — sorting your inbox with rules based on sender and subject. The Platform keeps a short log of moved messages (sender, subject, date) so a move can be undone; it does not otherwise read or store your inbox. Gmail sender and subject details are not sent to OpenAI or any other AI service.

How We Use Google Data

Data obtained from Google Workspace APIs is used exclusively to operate the features you have connected and authorized. Specifically:

Calendar data is used only to display your schedule within the Platform, check availability when scheduling, and create events at your explicit direction.
Gmail access is used only to send emails you have approved and, if you use Inbox Cleanup, to move messages by your sender and subject rules.
No Google Workspace data is used to train, fine-tune, or improve any AI model.
No Google Workspace data is shared with or transferred to any third party.
No Google Workspace data is used for advertising, profiling, or any purpose beyond the specific feature you activated.

Revoking Google Access

You can disconnect your Google account at any time from the Platform's settings, or by visiting myaccount.google.com/permissions and removing The Chairman's Lounge from your authorized applications. Revoking access immediately stops the Platform's ability to interact with your Google account.

Google API Services User Data Policy

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.