Privacy Policy

1. What we collect

• Account identity. When you sign in with Google, Apple or LinkedIn OAuth, we receive your name, email address and profile picture from that provider. With email sign-up we collect your name, email and a hashed password. We never receive your provider password.
• Simulation telemetry. The prompts you write, the model outputs returned, assertion results, token counts, attempt counts, timings and scores for each scenario.
• Payment data. Purchases are processed by Stripe. We store the Stripe customer and session identifiers, the product purchased and the payment status — never your full card number.
• Identity verification. If you choose Stripe Identity verification, Stripe processes your document and selfie; we only receive a verified / unverified result.
• Product analytics. Page views, referrers, device and browser data via Google Analytics and Google Ads tags, plus basic server logs (IP address, timestamps) for security.

2. Why we use it

• To create and secure your operator account and authenticate you.
• To run scenarios, score them with large language model providers, and save your progress.
• To issue and display your verified credential.
• To process payments, gift passes and refunds through Stripe.
• To send transactional email (welcome, receipts, mastery notifications, squad invites, profile-view alerts).
• To measure marketing performance and improve the product.

3. LLM processing of your prompts

Prompts you submit in the simulator are transmitted to our AI model providers for evaluation and are stored in our database as part of your run history so results are replayable and auditable. Do not paste confidential information, personal data about other people, or credentials into simulator inputs.

4. Public visibility of verified profiles

A verified profile is public by design: anyone with the link, including search engines, can view your name, avatar, verification badges, scenario scores and score summaries. You can switch your profile to private at any time from your dashboard, which removes it from public access. Draft prompts are never public.

5. Who we share data with

• Supabase — authentication, database and storage hosting.
• AI model providers — to evaluate your prompts.
• Stripe — payments and identity verification.
• Resend — transactional email delivery.
• Google Analytics / Google Ads — website measurement.
• Recruiters and the public — only the verified profile content you choose to publish.

We do not sell your personal information. Some providers process data outside Canada; where that happens the data is subject to the laws of those jurisdictions.

6. Retention

We keep account and telemetry data for as long as your account exists, and payment records for as long as required by Canadian tax and accounting law. On deletion we remove your profile, telemetry and public credential; anonymised aggregate statistics may be retained.

7. Your rights under PIPEDA

Under Canada’s Personal Information Protection and Electronic Documents Act you may request access to the personal information we hold about you, request correction of inaccuracies, withdraw consent, or request deletion of your account and data. Email admin@fluenci.ai and we will respond within 30 days. If you are unsatisfied with our response you may contact the Office of the Privacy Commissioner of Canada.

8. Security

Data is encrypted in transit, access is restricted with row-level security policies, and administrative access is limited to authorised personnel. No system is perfectly secure; if a breach affects you we will notify you as required by law.

9. Contact

Privacy questions: fluenci.ai Inc., Ontario, Canada — admin@fluenci.ai