Legal

Privacy Policy

Last updated: August 20, 2026

This Privacy Policy explains what data MissionKonsol ("we," "us") collects, how it's used, and who it's shared with. MissionKonsol is operated by Toby Aguero.

What we collect

• Account data: your email address and password (handled entirely by our authentication provider — we never see or store your raw password).
• Content you create: diagnostic answers and company name, canvas maps, generated documents and the notes you provide to generate them, and Secretary chat messages.
• Billing data: handled by Stripe. We store which plan your workspace is on and a reference to your Stripe customer record — not your card details.
• Anonymous usage data: if you use the free, no-account generator, we store a hashed (not raw) version of your IP address purely to enforce a daily generation limit — nothing else is linked to it, and it's not tied to any account.
• Email sending credentials (Campaigns): if you connect your own SMTP account to send campaigns, we store your SMTP password encrypted, and only decrypt it on our server immediately before sending — we never display it back to you or anyone else in your workspace after you save it.

Campaign email tracking

When your workspace sends a campaign email through Campaigns, we include a small invisible image and rewrite links in the message so we can tell you whether it was opened and which links were clicked — the same kind of tracking most email marketing tools use. This data (opens, clicks, bounces) is shown back to your workspace as campaign analytics; we don't use it for anything else, and it's not shared outside your workspace.

How your content is shared inside MissionKonsol

When you create an account, you get a workspace. If you invite teammates, the Systems Diagnostic results, Ecosystem Canvas maps, and Playbook documents your workspace creates are visible to everyone in that workspace — that's the point of the team feature. Secretary chat conversations are the one exception: they stay private to whoever started them, even from other people in the same workspace, since those conversations can involve sensitive questions about the business.

Third parties we share data with

We use a small number of third-party services to run MissionKonsol, and share only what each one needs to do its job:

• Supabase — our database, authentication, and file storage provider. Nearly everything you create in MissionKonsol lives here.
• Google (Gemini API) — powers the Systems Diagnostic's recommendations, the Secretary chat, and Playbook's document generation. The content you submit for generation (your notes, diagnostic context, canvas data) is sent to Google's API to produce a response; see Google's own terms for how they handle API inputs.
• Stripe — processes all payments and manages subscriptions. We never see full card numbers.
• Resend — sends transactional email only (team invites, and documents you ask to have emailed to you from the free generator). We only send emails you or your workspace owner explicitly trigger — no marketing email. Campaign emails you send from Campaigns do not go through Resend — see below.
• Your own SMTP provider, or AWS SES — Campaign emails are sent through infrastructure you control: your own connected SMTP account, or, only if you turn it on, a capped fallback we operate through AWS SES. We never use our own bulk-email service to send your campaigns.

Account deletion

You can delete your own account at any time from your account settings — this is fully self-serve, not a manual request. What happens depends on your role:

• If you're a member of a team workspace, your account and your private Secretary conversations are deleted. Diagnostics, canvases, and documents you created stay in the workspace for your remaining teammates, since those are shared workspace content, not personal data — they're simply no longer attributed to a specific person.
• If you're the sole person in your workspace, deleting your account deletes the entire workspace and everything in it.
• If you own a workspace with other people still in it, self-serve deletion is currently blocked — remove the other members first, or contact us to sort out ownership transfer.

Cookies

We use one essential cookie to keep you signed in. We don't use advertising or third-party tracking cookies.

Data retention

We keep your data for as long as your account exists, plus a reasonable period after deletion to satisfy legal, tax, or backup requirements. Anonymous rate-limit records (from the no-account generator) are tied to a day and naturally age out.

Your rights

You can access, correct, or delete most of your data directly in the product. For anything you can't do yourself — including a full data export or a request related to data protection law in your jurisdiction — contact us and we'll handle it manually.

Texas residents — rights under the Texas Data Privacy and Security Act

The Texas Data Privacy and Security Act (TDPSA) gives Texas residents specific rights over their personal data. We honor these rights for Texas residents regardless of whether TDPSA's applicability thresholds strictly apply to a business our size:

• Confirm and access — confirm whether we're processing your personal data and get a copy of it.
• Correct — fix inaccuracies in your personal data.
• Delete — have your personal data deleted (see "Account deletion" above for the self-serve path).
• Data portability — get a copy of your data in a portable, readily usable format so you can take it elsewhere.
• Opt out — of the sale of personal data, targeted advertising, and profiling in furtherance of decisions with legal or similarly significant effects. We don't do any of these three things today — we don't sell personal data, run targeted advertising, or profile you for automated decisions — so there's nothing to opt out of, but we'll honor the request if that ever changes.

To exercise any of these rights, email tobyaguero@gmail.com. We'll respond within 45 days (extendable once by another 45 days if reasonably necessary — we'll tell you if that happens, and why). If we decline a request, you can appeal by replying to our response explaining why; if we still decline after that, you can file a complaint with the Office of the Texas Attorney General. We won't deny you service, charge you a different price, or provide a different level of service because you exercised any of these rights.

Security and breach notification

We rely substantially on our infrastructure providers' (Supabase, Stripe) own security practices to protect your data, on top of the access controls (row-level security, scoped API keys) described throughout how MissionKonsol is built. If a breach compromises your sensitive personal information in a way that triggers notification under Texas law (Tex. Bus. & Com. Code § 521.053), we'll notify affected users without unreasonable delay.

Changes to this policy

We may update this policy as the Service changes. Material changes will be reflected by updating the date at the top of this page.

Contact

Questions about this policy or your data: tobyaguero@gmail.com.

Governing law

This policy is governed by the laws of the State of Texas.