Last updated: October 21, 2026
This privacy notice explains which personal data the AI Decision Matrix tool on ai-decision-matrix.org processes, for what purposes, on which legal basis and for how long. This version of the tool is used in executive education sessions at the MIT Center for Information Systems Research (MIT CISR). You can use it without an account, and we do not ask for your name or email address.
Prof. Dr. Jan vom Brocke
University of Münster, Department of Information Systems
Leonardo-Campus 3
48149 Münster
Germany
Email: jan.vom.brocke@uni-muenster.de
The tool was developed by the University of Münster in cooperation with MIT CISR, 245 First Street, Cambridge, MA 02142, USA. Further details on the provider: Legal notice.
Legal bases: your consent (Art. 6(1)(a) GDPR) for storage and AI analysis; our legitimate interests (Art. 6(1)(f) GDPR) in providing the site securely, protecting it against misuse and improving it. As far as the University of Münster acts as a public body, the North Rhine-Westphalia Data Protection Act (DSG NRW) also applies.
The site and its database are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on a server in a Hetzner data center in Germany. The database with the saved results is stored on this server, within the European Union. Hetzner processes the data on our behalf. When you open the site, your browser sends technical data such as your IP address, date and time, the page requested and your browser type. We need this data to deliver the site and keep it secure (Art. 6(1)(f) GDPR). Our web server does not keep access logs. Technical logs of our application contain error messages only, no request data, and are kept in size-limited log files that are overwritten automatically.
To prevent abuse and keep costs under control, the server counts requests to the tool’s interface per IP address. It stores only a shortened one-way hash of the IP address, not the address itself, and deletes these counters after 70 minutes at the latest. We also store the number of AI requests per day, without any reference to a person.
Taking part is voluntary. Before the first question, the tool asks for two separate consents: to the storage of your data (section 5) and, in addition, to AI analysis (section 6). AI analysis is only possible together with storage. If you do not agree, you can still answer the questionnaire: your result is calculated in your browser only. Nothing is sent to our server or to the AI provider, nothing is stored, and the bot protection of section 7 is not loaded.
One exception: if you open the link of a saved result (section 5), your browser fetches that result from our server, and the bot check of section 7 runs for this request. Nothing new is stored by this.
If you tick the box for data storage, and only then, the following is stored when you finish your report:
We do not ask for your name or email address and do not store your IP address with your result. Please do not enter personal data (such as names of people or customer data) in your description or the company name field.
Purposes: to provide the tool and your saved result, and, in anonymized or aggregated form, for research by researchers at the University of Münster and MIT to improve both the tool and the underlying research. Legal basis: your consent (Art. 6(1)(a) GDPR).
Shared link: each saved result gets a random link (the page address changes to it after saving). Anyone who has this link can open the result: the name of your decision, your answers, which of them were taken from your description, and the date, but never your description or the details about your organization. We do not publish these links.
Storage period: stored results are deleted automatically 24 months after they were saved. Because results are stored without your name or email address, we can only find and delete an individual result early if you send us its link.
Only if you tick the box for AI analysis (which requires the box for data storage): when you describe your decision, and when you finish your report, we send your description, your answers and the optional details about your organization to our AI provider Anthropic PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA. The AI model Claude suggests answers to the questionnaire and summarizes key facts for your report. Without AI analysis, the key facts of your report are written in your browser from your answers.
Anthropic processes the data on our behalf and does not use it to train its models. According to Anthropic, inputs and outputs of its API are deleted within 30 days. Legal basis: your consent (Art. 6(1)(a) GDPR).
Cache: to avoid processing identical requests twice, our server stores the AI’s result for a description (the suggested answers, short quotes from your text that support them, and the key facts). The cache key is a one-way hash of your text and the details about your organization. Cached results are deleted after 30 days.
Only after you agree to data storage, when you send feedback, or when you open the link of a saved result, an invisible check by Cloudflare Turnstile confirms that requests to our server come from a human and not a bot. For this, Cloudflare, Inc. processes technical data from your browser and device, including your IP address. Turnstile does not use cookies for tracking. Legal basis: our legitimate interest in protecting the tool and its AI budget against automated misuse (Art. 6(1)(f) GDPR). More: Cloudflare privacy policy and Turnstile Privacy Addendum.
After your report you can rate the tool from 1 to 5 and leave a comment, both optional. Feedback is only sent when you click “Send feedback”, also if you did not agree to data storage or AI analysis. We store the rating, the comment and the date, without any link to your result and without your IP address, and delete them automatically after 24 months. Legal basis: our legitimate interest in improving the tool (Art. 6(1)(f) GDPR). Please do not write personal data in the comment.
The “Dictate” button is only available after you agree to AI analysis. It uses the speech recognition built into your browser. Depending on the browser, your voice is processed by the browser vendor, for example Google (Chrome), Microsoft (Edge) or Apple (Safari), under that vendor’s privacy terms. We only receive the resulting text, never the audio. If you do not want this, type your description instead.
We do not set cookies and do not store anything in your browser’s local storage. We do not use analytics, tracking or advertising. All fonts and scripts are served from our own server, except the Cloudflare Turnstile script (section 7). Links to other websites, such as MIT CISR or the University of Münster, only lead there when you click them.
Recipients of your data are our service providers Hetzner Online GmbH (hosting, database), Cloudflare, Inc. (bot protection, section 7) and, only with your consent to AI analysis, Anthropic PBC (AI analysis). All of them process data on our behalf. Researchers at the University of Münster and MIT receive stored results for research in anonymized or aggregated form only.
The server and the database with the saved results are located in Germany. Cloudflare and Anthropic are based in the USA. Transfers to the USA are based on the adequacy decision of the European Commission for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), where the recipient is certified under it, and otherwise on the EU standard contractual clauses (Art. 46(2)(c) GDPR).
Under the GDPR you have the right to:
To exercise your rights, write to the email address in section 1.
You have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, ldi.nrw.de.
We update this notice when the tool or the processing changes. The current version is always available on this page.
