Privacy Policy.

Last updated 16 August 2026.

Consillium AI SRL (“Consillium,” “we,” “us,” or “our”), a company registered in Bucharest, Romania, with its registered office at Intrarea Cooperativei 14-18, Building 2, Floor 4, Apartament 32, Bucharest, Romania, is the data controller responsible for your personal data when you use the Consillium platform at consillium.app (the “Service”).

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, how we protect it, and what rights you have. It applies to all users of the Service worldwide.

For any privacy-related questions or requests, contact us at support@consillium.app.

1. Data We Collect

1.1. Data you provide directly

• Account data: your name, email address, and profile picture, provided through Google authentication when you create an account.
• Business profile data: information you enter during setup, including your country, city, team size, available investment budget, skills, preferences, and any other details you choose to share about your business or situation.
• User inputs: questions, prompts, messages, and any other content you submit to the Service, including interactions with the Council advisors, lesson responses, and idea selections.
• Payment data: when you subscribe to a paid plan, your payment information is collected and processed by Stripe, Inc. We receive your name, email, subscription status, transaction history, and the last four digits of your payment card. We do not receive or store your full card number.
• Support communications: any messages or information you send to us at hello@consillium.app or support@consillium.app.

1.2. Data collected automatically

• Usage data: how you interact with the Service, including pages viewed, features used, ideas viewed and saved, lessons completed, credits consumed, session duration, and timestamps.
• Device and browser data: your IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Cookies and tracking technologies: we use cookies and similar technologies as described in Section 8 of this policy.
• Analytics data: aggregated and individual usage patterns collected through analytics tools (see Section 5).

1.3. Data generated by the Service

• AI-generated content: ideas, research reports, plans, advisor responses, and other content generated by the Service based on your inputs and profile. This content is associated with your account.
• Profile inferences: the Service may generate inferences about your business situation, preferences, and needs based on your inputs and usage patterns, used solely to personalize and improve the Service for you.

2. How We Use Your Data

We use your personal data for the following purposes:

• Providing the Service: processing your inputs, generating AI-powered ideas and advice, personalizing content to your situation, delivering daily lessons, managing your credits and subscription.
• Account management: creating and maintaining your account, authenticating your identity, processing payments, and communicating with you about your account.
• Improvement and development: analyzing usage patterns to improve the Service, fix issues, develop new features, and optimize the AI models’ performance within the Service.
• Communications: sending you transactional messages (payment confirmations, account notifications, security alerts), service-related notifications (new features, changes to the Service), and, where you have provided consent or where permitted by law, marketing communications about Consillium.
• Legal and safety: complying with legal obligations, enforcing our Terms and Conditions, preventing fraud and abuse, and protecting the rights and safety of Consillium and its users.

3. Legal Bases for Processing (GDPR)

If you are in the European Economic Area (EEA), the United Kingdom, or another jurisdiction where a legal basis for processing is required, we rely on the following:

• Performance of a contract: processing necessary to provide the Service to you under our Terms and Conditions (account management, delivering AI-generated content, processing payments, managing credits).
• Legitimate interests: processing necessary for our legitimate interests, where those interests are not overridden by your rights (improving the Service, analytics, preventing fraud, ensuring security). You have the right to object to processing based on legitimate interests (see Section 9).
• Consent: where required by law, we obtain your consent before processing (marketing communications in jurisdictions that require opt-in consent, non-essential cookies and tracking). You may withdraw consent at any time.
• Legal obligation: processing necessary to comply with legal requirements (tax records, responding to lawful government requests).

4. AI Data Processing

4.1. To provide the Service, your inputs and business profile data are sent to third-party AI model providers for processing. These providers generate the AI-powered responses, ideas, research, and plans you see in the Service.

4.2. The AI providers we use are:

• Anthropic (Claude models) — United States
• OpenAI (GPT models) — United States
• Google (Gemini models) — United States
• xAI (Grok models) — United States
• Moonshot AI (Kimi models) — China / Singapore

4.3. Each provider receives only the data necessary to generate a response to your specific query or session. This typically includes your business profile data, your input, and relevant conversation context.

4.4. We select providers based on quality and diversity of output. Different advisors in the Council run on models from different providers to ensure genuinely independent perspectives.

4.5. Each provider’s processing of your data is governed by their own data processing agreements and privacy policies. We have entered into data processing agreements with each provider where available. See Section 6 for more on international data transfers.

5. Third-Party Services

We use the following third-party services that may process your personal data:

We may also use additional analytics or A/B testing tools. Where we do, they are subject to this Privacy Policy and applicable law.

6. International Data Transfers

6.1. Consillium AI SRL is based in Romania, a member state of the European Union. Your data may be transferred to and processed in countries outside the EEA, including the United States and China/Singapore, by the third-party providers listed in Sections 4 and 5.

6.2. For transfers to the United States, we rely on the EU-US Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses (SCCs) approved by the European Commission, or on other lawful transfer mechanisms available under applicable law.

6.3. For transfers to other countries outside the EEA that do not have an adequacy decision from the European Commission, we rely on Standard Contractual Clauses or other appropriate safeguards under applicable data protection law.

6.4. Moonshot AI processes data in China and/or Singapore. We apply Standard Contractual Clauses and supplementary measures as required to safeguard this transfer. By using the Service, you acknowledge that some of your data may be processed in these jurisdictions. If you prefer your data not be processed by Moonshot AI, contact us at support@consillium.app and we will make reasonable efforts to accommodate your request.

6.5. You can request a copy of the safeguards we use for international transfers by contacting support@consillium.app.

7. Data Sharing

7.1. We do not sell your personal data to anyone.

7.2. We share your personal data only with the third-party service providers described in Sections 4 and 5, and only to the extent necessary for them to provide their services to us.

7.3. We may disclose your personal data if required by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

7.4. If Consillium AI SRL is involved in a merger, acquisition, or sale of all or a portion of its assets, your personal data may be transferred as part of that transaction. We will notify you by email or through the Service before your data is transferred and becomes subject to a different privacy policy.

8. Cookies and Tracking Technologies

8.1. What we use

• Essential cookies: required for the Service to function (authentication, session management, security). These cannot be disabled.
• Analytics cookies: used by Microsoft Clarity and PostHog to understand how the Service is used (page views, clicks, session recordings). These help us improve the Service. On our public pages you can turn these off at any time from our Cookie Policy; in the EEA, the UK and Switzerland they are not set at all unless you accept them.
• Advertising/tracking cookies: used by Meta Pixel to measure the effectiveness of our advertising campaigns and track conversion events (such as sign-ups and subscriptions). These cookies may enable Meta to show you targeted advertising on its platforms. The same conversion events are also sent to Meta directly from our servers (Meta's Conversions API), which for a purchase or a sign-up includes your email address in hashed form, your IP address and your browser's user agent. Where your consent is required, none of this happens unless you have given it, and declining stops the server-side reports as well as the cookies.

8.2. Your choices

When you first visit consillium.app, you will be presented with a cookie consent banner that allows you to accept or reject non-essential cookies (analytics and advertising/tracking). You can change your cookie preferences at any time through the cookie settings link in the footer of the website.

Essential cookies are always active because the Service cannot function without them.

8.3. Browser settings

You can also control cookies through your browser settings. Note that blocking all cookies may affect the functionality of the Service.

9. Your Rights

9.1. Rights under GDPR (EEA and UK users)

If you are located in the EEA or the United Kingdom, you have the following rights under the General Data Protection Regulation:

• Access: you have the right to request a copy of the personal data we hold about you.
• Rectification: you have the right to request correction of inaccurate or incomplete personal data.
• Erasure (“right to be forgotten”): you have the right to request deletion of your personal data, subject to certain exceptions (e.g., legal obligations).
• Restriction of processing: you have the right to request that we restrict the processing of your personal data in certain circumstances.
• Data portability: you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Object: you have the right to object to processing based on our legitimate interests, including profiling. You also have the right to object to processing for direct marketing at any time.
• Withdraw consent: where processing is based on your consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint: you have the right to lodge a complaint with your local supervisory authority. In Romania, this is the Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP), available at https://www.dataprotection.ro.

9.2. Rights under US state privacy laws

If you are a resident of California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), or another US state with applicable privacy legislation, you may have similar rights to access, delete, correct, and opt out of certain processing of your personal data. We do not sell your personal data. We do not use your personal data for automated decision-making that produces legal or similarly significant effects.

To exercise any rights under US state privacy laws, contact support@consillium.app. We will not discriminate against you for exercising your privacy rights.

9.3. How to exercise your rights

For any privacy rights request, contact us at support@consillium.app. We will respond within 30 days (or sooner if required by applicable law). We may need to verify your identity before fulfilling a request. If your request is complex or you have made multiple requests, we may extend the response period by an additional 60 days, and we will notify you of the extension and the reason for it.

10. Marketing Communications

10.1. Transactional and service communications. We will send you emails related to your account, payments, security, and important changes to the Service. These are not marketing and cannot be opted out of while you maintain an active account.

10.2. Marketing communications. We may send you emails about new features, tips, promotions, and other Consillium-related content.

• If you are located in the EEA, the UK, or another jurisdiction that requires prior consent for marketing emails, we will only send you marketing communications if you have given your explicit consent (opt-in) during registration or at a later point. If you are an existing customer, we may send you marketing about similar services with an easy opt-out option, as permitted under applicable law (soft opt-in).
• If you are located in a jurisdiction that permits marketing emails without prior consent (such as the United States under CAN-SPAM), you may receive marketing communications and can opt out at any time.

10.3. Opting out. Every marketing email includes an unsubscribe link. You can also manage your communication preferences in your account settings or by contacting support@consillium.app. Opt-out requests are processed within 10 business days.

11. Data Retention

11.1. Active accounts. We retain your personal data for as long as your account is active and as needed to provide the Service to you.

11.2. Account deletion. When you delete your account (available as a self-service option in your account settings), we will delete or anonymize your personal data within 30 days, except where we are required by law to retain certain data (e.g., financial transaction records for tax and accounting purposes, which we retain for the period required by applicable law, typically up to 10 years in Romania).

11.3. Inactive accounts. We may delete accounts that have been inactive for an extended period (24 months or more) after sending you a notice and an opportunity to keep your account active.

11.4. Backups. Your data may persist in encrypted backups for a limited period after deletion (up to 90 days), after which it is permanently removed.

12. Data Security

12.1. We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encryption of data in transit (TLS) and at rest, access controls, regular security reviews, and secure authentication.

12.2. Despite our efforts, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security of your data.

12.3. If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority in accordance with applicable law.

13. Children’s Privacy

The Service is not directed at anyone under 18 years of age. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected personal data from a person under 18, we will delete that data and terminate the associated account. If you believe a child under 18 has provided us with personal data, please contact us at support@consillium.app.

14. Changes to This Privacy Policy

14.1. We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect.

14.2. Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the changes.

14.3. We encourage you to review this Privacy Policy periodically. The “Last updated” date at the top indicates when the most recent changes were made.

15. Contact

For any questions, concerns, or requests related to this Privacy Policy or your personal data, contact us at:

Consillium AI SRL
Intrarea Cooperativei 14-18, Building 2, Floor 4, Apartament 32
Bucharest, Romania

Email: support@consillium.app

For privacy-specific matters, you may also contact our data protection lead at the same address.

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority. In Romania, this is the Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (ANSPDCP) at https://www.dataprotection.ro.