Privacy Policy

1. Data we collect and why

We collect only what the Service needs to work. In detail:

• Account data: your email address, the name you give us, and a password stored in hashed form by Firebase Authentication. Legal basis: performing our contract with you.
• Email verification: a one-time code sent when you sign up, plus the IP address the request came from. We use the IP address only to stop abuse of the code emails, and delete it shortly after. Legal basis: our legitimate interest in preventing fraud.
• Your voice: audio of what you say in drills, and the transcripts made from it. This is the core of the Service and is processed to transcribe you, generate the persona’s replies and grade your answers. We do not keep the audio files; transcripts, the grader’s verdicts and your scores are kept with your training progress. Legal basis: performing our contract with you.
• Training progress: which drills you have completed, your rep counts, medals, session drafts and settings such as your persona tier. Legal basis: performing our contract.
• Usage and billing: your plan, coin balance, coin usage per turn, and Stripe customer and subscription identifiers. We never receive your full card number. Legal basis: performing our contract and legal obligations (bookkeeping).
• Drill insights: pseudonymised, sampled records of drills (transcript, verdict, scenario) linked to a hashed learner id, used to see which drills and scenarios work and to improve grading. Legal basis: our legitimate interest in improving the Service.
• Analytics: pages viewed, drills started and finished, device and browser type, approximate location from your IP address, and session recordings with all typed input masked. Legal basis: your consent, given through your browser and cookie settings; see section 5.
• Support and correspondence: what you send us by email. Legal basis: our legitimate interest in answering you.

2. Who we share data with

We use these processors to run the Service. Each only receives what its job needs and is bound by a data processing agreement:

• Google Firebase (authentication, database, file storage) and Vercel (hosting). Your account, progress and billing state live here.
• OpenAI: receives your voice audio and transcripts to transcribe your speech and to run the live persona you talk to. OpenAI does not use API data to train its models.
• Google Gemini: receives transcripts and, for delivery drills, audio, to grade your answers.
• Stripe: handles payments, subscriptions and the billing portal. Stripe is an independent controller for your payment data; see Stripe’s privacy policy.
• Resend: sends our transactional emails, such as verification codes.
• Bunny.net: streams the coaching videos. It sees your IP address when a video loads.
• Google Analytics 4, PostHog and Hotjar/Contentsquare: analytics and session recordings, only with your consent.

Some of these providers process data in the United States. Where they do, transfers rely on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses.

We do not sell personal data and we do not share it with advertisers. We disclose data to authorities only when the law requires it.

3. How long we keep data

• Account, progress and transcripts: for as long as you have an account, then deleted within 30 days of you closing it.
• Verification codes and the IP addresses tied to them: minutes to hours, then deleted.
• Voice audio: not stored by us after the turn has been transcribed and graded. Our AI providers keep API inputs for a limited abuse-monitoring period under their own policies.
• Billing records: 7 years, as Swedish bookkeeping law requires.
• Pseudonymised drill insights: kept without a link to your account, so they are not deleted when your account is.
• Analytics: according to each tool’s retention setting, currently up to 14 months.

4. Your rights

Under the GDPR you can:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct or delete it, or to restrict how we use it.
• Object to processing based on our legitimate interests.
• Withdraw consent at any time, for example for analytics cookies, without affecting processing done before you withdrew it.
• Receive the data you gave us in a machine-readable format.

To use any of these rights, email info@socialinstinct.app from the address on your account. We answer within one month.

If you think we have handled your data wrongly you can complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, www.imy.se, or to the supervisory authority where you live.

5. Cookies and similar technologies

Strictly necessary storage keeps you logged in and remembers your progress and settings; it needs no consent.

Analytics cookies and session recording from Google Analytics, PostHog and Hotjar/Contentsquare are used to understand how the Service is used and to fix what does not work. Typed input in recordings is masked. These are set only with your consent and you can withdraw it at any time through your browser settings or by contacting us.

6. Children

The Service is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a minor has created an account, email us and we will delete it.

7. Security

Data is encrypted in transit, access to production systems is limited to the operator, database access is enforced by server-side rules, and paid features are only reachable with a verified login. No system is perfectly secure; if a breach affects your data we will inform you and IMY as the GDPR requires.

8. Changes to this policy

We may update this policy as the Service changes. The date at the top shows the latest version. For significant changes we will tell you by email or in the app.

9. Data controller and contact

The data controller for Social Instinct is Amandus Axelsson, a private individual based in Sweden. Postal address: Agnes Lagerstedts gata 25, 129 51 Hägersten, Sweden. Email: info@socialinstinct.app.