Privacy Policy

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and password (stored in hashed form). If you use our Request Access form, we also collect your company name.

Billing Information

When you subscribe to a paid plan, payment is processed by Stripe, Inc. We store your Stripe customer ID and subscription details. We do not store credit card numbers, bank account information, or other payment credentials—these are handled entirely by Stripe pursuant to their privacy policy.

Uploaded Data

You may upload CSV, JSON, or TXT files containing business data for persona generation. You must not upload files containing personally identifiable information (PII), including but not limited to: real customer names, email addresses, phone numbers, physical addresses, social security numbers, financial account numbers, or any data that could be used to identify a specific individual. See Section 4 for details.

AI-Generated Content

When you use the AI Research feature, the Service generates synthetic review data based on your company description. This generated content is stored in our database and associated with your account.

Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, timestamps, browser type, and device information. This data is collected through:

• Google Analytics — for website traffic analysis and user behavior insights
• Vercel Analytics — for performance monitoring and page view tracking

Bot Protection

We use Cloudflare Turnstile on certain public forms to verify that visitors are human. Cloudflare may collect IP address and browser signals during this process pursuant to their privacy policy.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process your uploaded data through AI to generate customer personas
• Process payments and manage subscriptions
• Send transactional emails (e.g., access request notifications)
• Monitor usage to enforce tier limits (Free, Pro)
• Analyze usage patterns to improve the Service
• Protect against fraud and abuse

3. Third-Party Data Processors

We share data with the following third-party services, solely for the purposes described:

Anthropic API Data Handling. Data sent to Anthropic's Claude API for processing is not used to train AI models. API logs are retained by Anthropic for 7 days before automatic deletion, per Anthropic's privacy practices.

4. Prohibited Data — No Personal Information in Uploads

You are strictly prohibited from uploading files or entering reviews containing personally identifiable information (PII). This includes but is not limited to:

• Full names of real individuals
• Email addresses or phone numbers
• Physical or mailing addresses
• Social security numbers, national ID numbers
• Financial account numbers or credit card numbers
• Health or medical information
• Any data regulated under GDPR, CCPA, HIPAA, or similar laws

Uploaded data is processed by third-party AI services (Anthropic Claude) and stored in our database. By uploading data, you represent and warrant that it does not contain PII and that you have the right to use the data for persona generation.

We reserve the right to suspend or terminate accounts that violate this policy.

5. Data Retention

• Account data is retained for as long as your account is active.
• Uploaded files are processed and the extracted content is stored; raw files are not retained long-term.
• Generated personas are retained until you delete them or your account is closed.
• AI Research content is retained until you delete the generated reviews or your account is closed.
• Usage analytics are retained per Google Analytics and Vercel's standard retention policies.

Upon account deletion, we will delete your account data, personas, reviews, and subscription records within 30 days.

6. Data Security

We implement reasonable security measures to protect your data, including:

• Passwords hashed using bcrypt
• HTTPS encryption for all data in transit
• Database access restricted to authorized application services
• Stripe webhook signature verification for payment events
• Environment-based secret management (API keys never exposed to the client)

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Delete your account and associated data
• Export your persona data (available to Pro subscribers via PDF/PPTX export)
• Object to processing based on legitimate interests

To exercise these rights, contact us at support@persona-builder.com.

8. Cookies and Tracking

The Service uses cookies and similar technologies for:

• Authentication — session cookies to keep you logged in
• Analytics — Google Analytics and Vercel Analytics cookies for usage tracking

You may disable cookies in your browser settings, though this may affect Service functionality.

9. Children's Privacy

The Service is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or in-app notice. Continued use of the Service after changes constitutes acceptance.

11. Contact Us

If you have questions about this Privacy Policy, contact us at hello@persona-builder.com.