Last updated: 19 October 2026
This notice explains which data the AI Decision Matrix tool on mit.ai-decision-matrix.com processes, why, and for how long. This version of the tool is used in executive education sessions at MIT CISR. You can use it without an account, and we do not ask for your name or email address. We do not use cookies for tracking or advertising, and we do not run analytics on this site.
Launch Labs GmbH
Berl 14, Gut Berl, 48324 Sendenhorst, Germany
Represented by Tobias Zimmermann, Managing Director
Privacy contact: tobias.zimmermann@launch-labs.ai
Launch Labs developed the tool in cooperation with the MIT Center for Information Systems Research (MIT CISR), 245 First Street, Cambridge, MA 02142, USA.
The site and its database are hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Workers and Cloudflare D1). The database with the saved results is stored in data centres in the United States. Requests are handled at the Cloudflare data centre nearest to you; Cloudflare is certified under the EU-U.S. Data Privacy Framework. When you open the site, your browser sends technical data such as your IP address, date and time, the page requested and your browser type. We need this data to deliver the site and keep it secure (Art. 6(1)(f) GDPR). Technical logs of our application (error messages, no request data) are kept for 3 days.
To prevent abuse and keep costs under control, the server counts requests per IP address. It stores only a shortened one-way hash of the IP address, not the address itself, and deletes these counters after 70 minutes at the latest. We also store the number of AI requests per day, without any reference to a person.
Before the first question, the tool asks whether you agree that your answers are stored and analysed by AI. If you do not agree, you can still answer the questionnaire: your result is calculated in your browser only. Nothing is sent to our server or to the AI provider, nothing is stored, and the bot protection described in section 6 is not loaded.
One exception: if you open the link of a saved result (see section 4), your browser fetches that result from our server, and the bot check of section 6 runs for this request. Nothing new is stored by this.
If you tick the consent box, and only then, the following is processed:
We do not ask for your name or email address and do not store your IP address with your result. Please do not enter personal data (such as names of people or customer data) in your description or the company name field.
We use this data to provide the tool and, in anonymised or aggregated form, for research by Launch Labs and MIT CISR to improve the tool and the questionnaire. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future: untick the box, and the tool stops sending data. Because results are stored without your name or email address, we can only delete an already stored result if you send us its link (see below).
Each saved result gets a random link (the page address changes to it after saving). Anyone who has this link can open the result: the name of your decision and your answers, but never your description or the details about your organisation. We do not publish these links.
We delete stored results after 24 months at the latest. To have a result deleted earlier, send its link to the privacy contact above.
If you agree and describe your decision, or when you finish your report, we send your description, your answers and the optional details about your organisation to our AI provider Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA. The AI model Claude suggests answers to the questionnaire and summarises key facts for your report.
Anthropic processes the data on our behalf and does not use it to train its models. According to Anthropic, inputs and outputs of its API are deleted within 30 days. Data is transferred to the USA on the basis of the EU-U.S. Data Privacy Framework or the EU standard contractual clauses.
Cache: To avoid paying twice for identical requests, our server stores the AI’s result for a description (the suggested answers, short quotes from your text that support them, and the key facts). The cache key is a one-way hash of your text and the details about your organisation. Cached results are deleted after 30 days.
Only after you agree, when you send feedback, or when you open the link of a saved result, an invisible check by Cloudflare Turnstile confirms that requests to our server come from a human and not a bot. For this, Cloudflare, Inc. processes technical data from your browser and device, including your IP address. Turnstile does not use cookies for tracking. The legal basis is our legitimate interest in protecting the tool and its AI budget against automated misuse (Art. 6(1)(f) GDPR). More: Cloudflare privacy policy and Turnstile Privacy Addendum.
After your report you can rate the tool from 1 to 5 and leave a comment, both optional. Feedback is only sent when you click “Send feedback”, also if you did not agree in section 3. We store the rating, the comment and the date, without any link to your result and without your IP address. The legal basis is our legitimate interest in improving the tool (Art. 6(1)(f) GDPR). Please do not write personal data in the comment.
The “Dictate” button is only available after you agree. It uses the speech recognition built into your browser. Depending on the browser, your voice is processed by the browser vendor: Google (Chrome), Microsoft (Edge) or Apple (Safari). We only receive the resulting text, never the audio. If you do not want this, type your description instead.
All fonts and scripts of this site are served from our own server, except the Cloudflare Turnstile script (section 6). Links to other websites, such as MIT CISR or Launch Labs, only lead there when you click them.
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), to object to processing based on legitimate interests (Art. 21) and to withdraw your consent (Art. 7(3)). To exercise them, write to the privacy contact above.
You also have the right to lodge a complaint with a supervisory authority, for example the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, ldi.nrw.de.
