Effective Date: [17.08.2026] Last Updated: [28.10.2026]
1. About This Policy
This Privacy Policy explains how we handle personal data in connection with the AICI platform at aici.io and aici.io (the "Platform" or "Services").
Who we are
| Legal name | Craft Innovations R&D Inc |
| Address | 1001-45 Southport Str, Toronto, Ontario, Canada, M6S 3N5 |
| General contact | support@aici.io |
| Privacy contact | privacy@aici.io |
This is a notice, not a contract. It does not replace the [Terms of Use] or the [Data Processing Agreement], and it does not ask you to consent to processing that we carry out on another legal basis.
2. The Two Different Roles We Play — Please Read This First
AICI handles two very different categories of personal data, and your rights differ depending on which one is involved.
2.1 Data we control (this Policy applies in full)
When you register for an account, pay for a subscription, contact support, or simply use the Platform, we act as a controller of your personal data: we decide what we collect and why. Sections 3 to 15 describe that processing.
2.2 Research data our customers control (we act only as a processor)
Our customers are research teams. They upload interview recordings, usability-test sessions, transcripts and notes ("Research Data"). That material frequently contains personal data about research participants — the people who were interviewed.
For Research Data, we act only as a processor. The research organisation that uploaded the material is the controller: it decided to record the interview, chose the participants, determined the purpose, and controls how long the material is kept.
This means:
- we do not decide what happens to Research Data and cannot lawfully use it for our own purposes;
- we do not use Research Data to train AI models (see Section 8);
- if you are a research participant and want to access, correct or delete what was recorded about you, you need to contact the organisation that interviewed you, not us. We usually cannot identify which recording relates to you without their help;
- if you contact us anyway, we will forward your request to the relevant customer and tell you that we have done so.
Our obligations to customers for Research Data are set out in the [Data Processing Agreement].
2.3 If you were interviewed and do not know who holds your data
Contact us at privacy@aici.io with whatever details you have (the organisation that interviewed you, the approximate date, the project name). We will make reasonable efforts to identify the customer and pass your request on. We cannot decide the outcome of that request ourselves.
3. Personal Data We Collect as Controller
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Name, e-mail address, password (hashed), workspace name, role within the workspace, [job title, organisation, phone number] | You, or the workspace administrator who invited you |
| Authentication data | Login and logout events, multi-factor authentication status, password change events, session identifiers | Automatically |
| Billing data | Subscription plan, transaction history, billing contact, partial card details and payment status | You and our payment processor. We never receive or store your full card number |
| Usage data | IP address, browser and device type, operating system, pages visited, timestamps, feature usage, file durations and sizes, error and diagnostic events | Automatically |
| Security audit data | Role changes, sharing actions, project deletions, export and erasure actions, and every access by our personnel to customer data | Automatically |
| Support data | The content of your messages to us and our replies | You |
| Integration credentials | Access and refresh tokens for services you choose to connect (e.g. Zoom, Google Meet), stored encrypted, and the connected account identifier and e-mail address | You, at the point of connection |
| Marketing preferences | Whether you have subscribed to or unsubscribed from our communications | You |
We do not collect special category data (health, religion, political opinions, biometric data used for identification) about our users, and we ask you not to send it to us.
3.1 Google Calendar, Google Meet and Google Drive integration
Connecting Google Meet is optional and separate from signing in to AICI with Google. When you choose to connect it in Settings → Integrations, Google asks you to authorize access. The integration requests the following permissions; the permission descriptions on Google's consent screen explain the access they allow:
- openid, email and profile: identify the Google account you connect. AICI stores its account identifier and e-mail address and displays the connected e-mail in your integration settings.
- calendar.events: permits viewing and editing events on calendars you can access. AICI uses it to create interview events in your primary calendar, invite the participants you specify, add a Google Meet link, and delete the event when you cancel an interview in AICI. The integration does not import your unrelated calendar history.
- meetings.space.created and meetings.space.readonly: create and configure Meet spaces, read meeting information and locate conference records and recordings for interviews scheduled through AICI.
- drive.readonly: permits reading and downloading Google Drive files. AICI uses this access to download available Google Meet interview recordings associated with interviews scheduled through AICI; it does not import unrelated Drive files.
When you schedule an interview, AICI sends Google the interview title, start and end time, time zone, description, and the respondent's name and e-mail address if you provide them. We store the scheduled interview details, Google's event and meeting identifiers, and the meeting link so you can manage the interview in AICI. Google sends calendar invitations and cancellation updates to the specified attendees. AICI also sends an interview invitation through its transactional e-mail provider when a respondent e-mail address is provided.
For supported Google Workspace accounts, AICI attempts to enable recording and transcription for the Meet interview and automatically imports an available recording into the associated AICI project. Availability depends on your Google plan, permissions and meeting settings. The imported recording becomes Research Data under Section 2.2 and can be transcribed and analysed through the AI services described in Sections 6 and 8. Calendar events and integration credentials are not inputs to those research AI workflows. Researchers are responsible for informing participants and obtaining any consent or other legal basis required for recording and research processing.
Storage, disconnection and deletion. Google access and refresh tokens are encrypted before storage and used by server-side functions to operate the integration, including refreshing access without asking you to reconnect for each interview. You can disconnect Google Meet in Settings → Integrations; this removes the stored integration credentials and connected account details from AICI's active database. You can also revoke Google's authorization in your Google Account connections. Disconnecting does not itself revoke that authorization, cancel existing calendar events, or delete interviews, recordings or transcripts already saved in AICI. Cancel an interview in AICI to remove its Google Calendar event while the integration is connected, or manage the event directly in Google Calendar. Saved interview records and imported Research Data remain subject to the applicable retention and deletion rules in Section 9; backup copies follow the backup deletion window described there. For deletion requests, contact privacy@aici.io; research participants should contact the research organisation as explained in Section 2.2.
Google API Limited Use. AICI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide or improve the user-facing integration and research features described above. We do not sell it, use it for advertising or creditworthiness assessments, or use it to develop, improve or train generalized or non-personalized AI or machine-learning models. Transfers are limited to what is necessary for these features (including our infrastructure, transactional e-mail and research-processing providers), security purposes, applicable legal requirements, or a business transfer with the user's explicit prior consent. Human access to Google user data is limited to cases where you explicitly agree to access to specific data, where necessary for security, where required by law, or where the data is aggregated and anonymized and used for internal operations as permitted by that policy.
4. Why We Process It, and on What Legal Basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and administering your account; providing the Platform | Performance of a contract, Art. 6(1)(b) |
| Operating integrations you choose to connect, scheduling interviews, generating meeting links and sending participant invitations | Performance of a contract, Art. 6(1)(b). Google API access additionally requires your OAuth authorization; the research organisation determines the legal basis for participant data |
| Processing payments and maintaining accounting records | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Responding to support requests | Contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f) |
| Keeping the Platform secure, detecting abuse, maintaining audit logs, investigating incidents | Legitimate interests in the security of our service and our customers' data, Art. 6(1)(f); legal obligation, Art. 6(1)(c) |
| Diagnosing errors and maintaining reliability | Legitimate interests, Art. 6(1)(f) |
| Understanding aggregate feature usage in order to improve the Platform | Legitimate interests, Art. 6(1)(f) |
| Sending service and security notifications you cannot opt out of while you hold an account | Contract, Art. 6(1)(b) |
| Sending product and marketing e-mail | Consent, Art. 6(1)(a), or legitimate interests for existing customers where permitted by local law — with an unsubscribe link in every message |
| Complying with legal obligations and responding to lawful requests from authorities | Legal obligation, Art. 6(1)(c) |
| Establishing, exercising or defending legal claims | Legitimate interests, Art. 6(1)(f) |
| Evaluating or completing a merger, financing or sale of the business | Legitimate interests, Art. 6(1)(f) |
Where we rely on legitimate interests, we have assessed that our interest does not override your rights, and you may object at any time (Section 12).
What we do not do. We do not sell personal data. We do not share it with third parties for their own marketing. We do not use behavioural advertising, and we do not build profiles about you for advertising purposes.
5. Cookies and Similar Technologies
We use a deliberately small set of cookies and local storage:
| Type | Purpose | Consent required |
|---|---|---|
| Strictly necessary | Keeping you logged in, maintaining your session, security and abuse prevention, remembering your workspace | No — these are essential to provide the Service you requested |
| Preferences | Remembering interface settings such as language or layout | No, where limited to settings you have chosen |
We do not use advertising cookies, third-party tracking pixels, or third-party analytics services such as Google Analytics, Sentry or PostHog. Application errors are recorded in our own database in the European Union.
Because we do not set non-essential cookies, we do not display a consent banner for them. You can clear cookies through your browser, though this will log you out.
6. How Personal Data Is Shared
We share personal data only with the categories of recipient below. Each service provider processes data on our instructions under a written data processing agreement, and none of them is permitted to use it for their own purposes. Google and other services you choose to connect also process data under their own privacy policies. For Google API user data, the more specific Limited Use restrictions in Section 3.1 apply to all disclosures, including any corporate transaction described below.
| Recipient category | Who | What they receive |
|---|---|---|
| Infrastructure | Lovable AB (Sweden) and Supabase Inc. — hosting, database, storage, authentication, hosted in the European Union (Frankfurt) | All Platform data |
| AI processing | AI gateway operated by our infrastructure provider; ElevenLabs (speech recognition, processed in the EEA); Google Gemini and OpenAI (text analysis) | Research Data submitted for processing — see Section 8 |
| Video rendering | Shotstack Pty Ltd, Australia - only if you use the video showcase feature | Video clips selected for rendering |
| Payments | Stripe, Inc. | Billing data. Card details go directly to the processor |
| Transactional e-mail | Resend, Inc. | Account and participant e-mail addresses and message content, including interview invitations and meeting links |
| Integrations you connect | Zoom, Google Calendar, Google Meet and Google Drive | Interview details and participant contact details needed to schedule meetings and send invitations; meeting identifiers and recording access needed for import. See Section 3.1 for Google permissions and use |
| Professional advisers | Lawyers, accountants, auditors | Only as necessary and under confidentiality |
| Authorities | Courts, regulators, law enforcement | Only where legally required — see Section 6.1 |
| Acquirers | A buyer or investor in a corporate transaction | Under confidentiality; we will notify you before your data becomes subject to a different policy |
A current list of our service providers, with locations and transfer mechanisms, is maintained at aici.io/subprocessors.
6.1 Requests from authorities
We disclose personal data to public authorities only where we are legally required to do so. Where lawful, we notify the affected customer, we challenge requests that appear unlawful or overbroad, and we disclose the minimum amount of data required.
6.2 Workspace visibility
If you join a customer's workspace, be aware that the workspace administrator can see your account details, your activity within the workspace, and any content you create there, and can remove your access or delete that content. If your employer administers the workspace, its own privacy notice also applies to you.
7. International Transfers
Personal data is stored in the European Union (Frankfurt, Germany), and audio and video recordings are transcribed within the European Economic Area.
Some processing takes place outside the EEA:
- Canada — we are established in Canada and our personnel access the Platform from there. The European Commission has recognised Canada as providing an adequate level of protection for data transferred to organisations subject to PIPEDA (Decision 2002/2/EC), and we are subject to PIPEDA.
- United States — text-based AI analysis, transactional e-mail, payments, integrations you connect, and administrative or support access by our providers' US parent entities. These transfers rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) or, where the provider is certified, the EU–US Data Privacy Framework.
- Australia — video rendering, if you use the video showcase feature, under Standard Contractual Clauses.
We do not rely on your consent as the basis for these transfers, and using our Services is not treated as consent to them. You may request a copy of the relevant safeguards by writing to privacy@aici.io.
8. Artificial Intelligence
The Platform uses AI to transcribe recordings, identify speakers, translate, summarise, code material thematically, apply sentiment labels and draft research deliverables. All AI requests are routed through an AI gateway operated by our infrastructure provider to the model providers listed in Section 6.
8.1 We do not train models on your data. We do not use your content to train models. AI requests are carried out via the providers’ APIs (Google Gemini paid tier, OpenAI API, ElevenLabs), the terms of which prohibit the use of customer data for model training. OpenAI retains data for up to 30 days for the purpose of monitoring abuse.
8.2 Retention by AI providers. No-training and no-retention are separate things, so to be precise:
- the AI gateway does not store request or response content;
- ElevenLabs processes audio in the EEA and does not use it for training.
- Google (Gemini) does not use content sent through the paid API for training;
- OpenAI does not use API content for training but may retain it for up to 30 days for abuse monitoring, after which it is deleted.
8.3 Sentiment analysis. Sentiment labels are derived from the text of transcripts only — from the words spoken. We do not analyse voice tone, facial expression or any other biometric characteristic, we do not operate an emotion recognition system within the meaning of the EU AI Act, and we do not permit our Services to be used to infer the emotions of people at work or in education.
8.4 No synthetic voice. We do not generate synthetic speech, clone voices, or identify anyone by their voice.
8.5 AI output is not reliable on its own. Transcripts, translations, summaries, thematic codes and sentiment labels are produced by statistical models and are often wrong — particularly with irony, accents, overlapping speech, specialist vocabulary and translated material. They must be reviewed by a human and must never be used as evidence about an individual.
8.6 No automated decisions about you. We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you (Art. 22 GDPR).
9. How Long We Keep Data
| Data | Retention period |
|---|---|
| Account data | For as long as your account is active, then deleted within 30 days |
| Google integration credentials and connected account details | While the integration remains connected; removed from the active database when you disconnect. Backup copies follow the 7-day rolling backup window. Disconnecting does not delete previously saved interviews or imported Research Data |
| Scheduled interview records, including Google event identifiers and meeting links | Kept with the associated project under its applicable retention and deletion rules. Cancelling a meeting retains its AICI record with a cancelled status; disconnecting Google does not remove it |
| Research Data | As configured by the customer (a retention term per team or per project, 1–3650 days, with advance notices before an expired project is moved to Trash; Trash is purged after 30 days). On termination, a 30-day retrieval window, then deletion from production within 30 days and from backups within 7 days (rolling point-in-time-recovery window) |
| Security audit log | 24 months, then purged automatically |
| Usage and error data | 12 months |
| Billing and accounting records | 6 years, as required by Canadian tax law and up to 10 years where required by an EU member state |
| Support correspondence | 12 months after the matter is closed |
| Marketing preferences | Until you unsubscribe, plus a record of the unsubscribe so we do not contact you again |
| Data retained for legal claims | Until the relevant limitation period expires |
10. Security
We protect personal data with measures including: TLS 1.2+ for all connections; AES-256 encryption at rest; additional application-layer encryption of integration tokens; role-based access control with database-level tenant isolation; least-privilege architecture where privileged credentials are confined to server-side functions; multi-factor authentication, mandatory for administrative access and optionally required by a team for all its members; SAML single sign-on for teams; session revocation; rate limiting of authentication and API endpoints; an immutable audit log retained for 24 months; hourly automated anomaly detection; encrypted backups with 7-day point-in-time recovery; peer code review; and automated dependency and secret scanning in our development pipeline.
A fuller description is in Annex B of our [Data Processing Agreement]. No system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal data and is likely to result in a high risk to your rights, we will notify you and the competent authority as required by law.
11. Children
The Services are for business use by people aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, contact privacy@aici.io and we will delete it.
Customers must not upload research material involving children without an appropriate legal basis, as set out in the [Data Processing Agreement].
12. Your Rights
12.1 If the GDPR or UK GDPR applies to you
You have the right to: access your data and receive a copy; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; object to processing based on legitimate interests, and to direct marketing at any time and without justification; data portability for data you provided, where processing is based on consent or contract; and withdraw consent at any time, without affecting processing already carried out.
You may exercise these rights at privacy@aici.io. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. We may ask you to verify your identity. Exercising your rights is free unless a request is manifestly unfounded or excessive.
You also have the right to lodge a complaint with a supervisory authority — in the EU, the authority in your country of residence or work; in the UK, the Information Commissioner's Office. Our EU representative under Art. 27 GDPR is listed in Section 1.
Note the limits of what we can do. For Research Data, we act as processor. If your request concerns an interview you took part in, please read Section 2.2.
12.2 If you are in Canada
Under PIPEDA you may request access to your personal information and challenge its accuracy, and you may complain to the Office of the Privacy Commissioner of Canada. Where we rely on consent, you may withdraw it, subject to legal and contractual restrictions.
12.3 If you are in Ukraine
Under the Law of Ukraine "On Personal Data Protection" you have rights of access, rectification and erasure, and you may complain to the Ukrainian Parliament Commissioner for Human Rights.
12.4 If you are in a US state with a comprehensive privacy law
[If you serve US consumers, add rights of access, deletion, correction, portability, and opt-out of sale/sharing/targeted advertising, plus a statement that you do not sell or share personal information and do not engage in targeted advertising, and an appeals process. Confirm whether any US state law applies to you before publishing this section — see Annex A.]
12.5 Marketing
Every marketing e-mail contains an unsubscribe link. You can also write to [privacy@aici.io]. Service and security messages continue while you hold an account, because we need them to operate the Platform.
13. Links to Other Sites
The Platform may link to sites we do not operate. We are not responsible for their content or privacy practices, and we recommend reading their policies.
14. Changes to This Policy
We may update this Policy. If a change materially affects how we handle your personal data, we will notify you by e-mail or in-product notice at least [30] days before it takes effect, and update the "Last Updated" date.
15. Contact
Privacy questions and rights requests: [privacy@aici.io] General enquiries: support@aici.io Post: Craft Innovations R&D Inc, 1001-45 Southport Str, Toronto, Ontario, Canada, M6S 3N5