Privacy Policy

1. Who We Are

EmpatiQ (empatiqapp.com, "the Service") is an AI simulation platform for training negotiation, crisis communication, and other high-stakes conversations. It is operated by S3P Solutions Inc., a Delaware corporation ("S3P Solutions", "we", "us", "our"). This Privacy Policy explains what personal data we collect, why, who we share it with, and the choices you have.

Individual accounts. If you sign up for yourself, S3P Solutions Inc. is the controller of your personal data.

Organization accounts. If your agency, university, or employer gives you access, that organization is the controller of the training content created in its workspace. We process it on the organization's behalf under our agreement with them. Instructors and administrators in your organization can see your sessions, transcripts, scores, and submissions. Requests about that content should go to your organization first; we will help them respond.

2. Data We Collect

• Account data: name, email address, password (stored as a hash by our authentication provider), organization, and role.
• Training sessions: the text you type, the audio of your voice during live voice sessions, transcripts, AI counterpart responses, scores, debriefs, and instructor feedback.
• Uploaded documents: standard operating procedures, playbooks, course materials, slides, and other files you or your organization upload to build scenarios, courses, or reference libraries.
• Uploaded recordings: audio of real conversations and their transcripts that you upload for review (see Section 3).
• Messages: messages you send to instructors or to us through the Service.
• Payment data: handled by Stripe or Paddle. We store only a customer ID and subscription status, never full card details.
• Technical data: IP address, browser type, device information, and logs collected automatically when you use the Service.
• Cookies: described in Section 10.

3. Real Recordings and Sensitive Material

Uploaded recordings and documents often contain information about people other than you, such as callers, subjects, or counterparts. If you upload them, you are responsible for making sure:

• you have the legal right to record, retain, and share the material, including any consent that wiretap or all-party consent laws require;
• the upload is permitted by your agency's or employer's policies;
• names, phone numbers, addresses, and other identifiers of third parties are removed or redacted where possible.

Do not upload classified information, Criminal Justice Information (CJI) as defined by the FBI CJIS Security Policy, protected health information, or payment card data. The Service is not designed or certified to hold these categories of data.

We use uploaded recordings and documents only to provide the feature you used them for, such as transcription, review, or scenario generation. For uploaded recordings you can choose to have the source audio deleted automatically once the transcript is created.

4. How We Use Your Data

We use personal data to:

• provide the Service: run sessions, generate AI counterparts, transcribe audio, produce debriefs, and build scenarios and courses from your materials (performance of a contract);
• manage your account, subscription, and organization membership (performance of a contract);
• send transactional emails, such as account confirmation, password resets, instructor messages, and receipts (performance of a contract);
• keep the Service secure, debug problems, and prevent fraud or misuse (legitimate interests);
• understand how the Service is used, through consent-based analytics (consent);
• comply with legal obligations (legal obligation).

We do not sell your personal data, and we do not share it for cross-context behavioral advertising.

5. AI Processing and Model Training

To run the Service, we send session content, uploaded documents, and recordings to the AI providers listed in Section 6. They process it on our behalf to return a response, transcript, or voice output.

We do not use your training sessions, uploaded documents, or recordings to train AI models, whether ours or anyone else's. Under their commercial API terms, our AI providers do not use this data to train their models. They may keep it briefly, usually no more than 30 days, to monitor for abuse, and then delete it.

We do use aggregated, de-identified usage metrics, such as how often a feature is used or how long sessions run, to improve the Service. These metrics do not contain the content of your conversations or files.

6. Sub-processors

We share personal data only with the service providers below, each bound by a data processing agreement or equivalent terms, and only as needed for the stated purpose.

We may also disclose data when the law requires it, to protect the rights or safety of people, or as part of a merger or acquisition, subject to this Policy.

7. Where Your Data Is Stored

Your account data, sessions, uploaded files, and recordings are stored in Germany, in the European Union. Live speech-to-text is also processed in the EU. Our application servers and most of our AI and voice providers are in the United States, so data is transferred to the US while it is being processed. Where the law requires it, we protect these transfers with the European Commission's Standard Contractual Clauses (and the UK Addendum) or an equivalent mechanism.

8. Data Retention

• Account data, sessions, and uploads are kept while your account is active, so your history, debriefs, and libraries remain available.
• You can delete individual uploaded files and recordings in the Service. Uploaded audio can be deleted automatically once it has been transcribed.
• When you close your account or ask us to delete your data, we delete it from production systems within 30 days. Backups roll off within a further 30 days.
• For organization accounts, retention follows the organization's instructions and our agreement with them.
• We keep billing records for as long as tax and accounting law requires.

9. Your Rights

Depending on where you live (for example under the GDPR, UK GDPR, or US state privacy laws such as the CCPA), you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data;
• object to or restrict certain processing;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent.

To exercise these rights, email [email protected]. We respond within 30 days and will not treat you differently for exercising them. If you are in the EEA or UK, you may also complain to your local data protection authority.

10. Cookies

• Strictly necessary: required for sign-in and core functionality. These cannot be disabled.
• Analytics: PostHog and Google Analytics load only after you accept them in the cookie banner.

We store your choice in your browser. To change it, clear this site's stored data in your browser and choose again.

11. Security

Data is encrypted in transit (TLS) and at rest. Database access is limited by row-level security, so each account can see only its own data and the data its organization shares with it. Staff access to production data is limited to what is needed to operate and support the Service.

EmpatiQ does not currently hold a SOC 2 or ISO 27001 certification and is not a CJIS-compliant system. Agencies that need a security review or a data processing agreement can contact us at [email protected].

If you believe your account has been compromised, contact us immediately.

12. Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal data from minors. If you believe a minor has given us personal data, contact us and we will delete it.

13. Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes by email or in-app notice before they take effect. The date at the top shows when it last changed.

14. Contact

S3P Solutions Inc. is the operator of EmpatiQ. For privacy questions or requests, email [email protected].