Privacy Policy

Version 1.3

Last updated: 2026-05-06 Effective date: 2026-05-06 (contact-information update; no change to data-processing practices)

What changed in v1.3 (2026-05-06): Updated the company mailing address and added a contact phone number. No change to how we collect, use, share, or retain personal information.

What changed in v1.2 (2026-04-30): Added "Wallet ledger" to the categories of personal data we generate. Updated the purposes table and sub-processor list to reflect the prepaid-wallet billing model that replaces per-license / trial-budget. Added 7-year retention for wallet transactions and Stripe records (financial-records audit). Updated security section to describe per-org wallet isolation.

1. Who we are

This Privacy Policy describes how Reactiphi LLC, a Delaware limited liability company with mailing address 68 Harrison Ave Ste 605 PMB 527052, Boston, MA 02111-1929, USA (phone: (508) 474-9425) ("reactiphi," "we," "us") collects, uses, stores, shares, and protects personal information in connection with the reactiphi synthetic-audience pre-testing platform (the "Service").

For the purposes of the EU General Data Protection Regulation ("GDPR") and the United Kingdom GDPR ("UK GDPR"), the controller of the personal data described in this policy is Reactiphi LLC, contactable at privacy@reactiphi.com.

For the purposes of the California Consumer Privacy Act ("CCPA" / "CPRA"), Reactiphi LLC is the business processing the personal information described herein.

2. What personal information we collect

We collect personal information in the following categories. We do not collect any category of personal information not listed here.

2.1 Information you provide directly

When you create an Account or use the Service:

2.2 Information we generate about you

2.3 Information from third parties

We do not purchase personal information from data brokers, social-media platforms, or any other third-party source.

If your administrator invites you to an Organization, we receive your email address from that administrator's submission to the invitation form.

If your Organization signs up via our website, we may receive contact information from your representative as part of the sales process.

2.4 What we do NOT collect

We make a deliberate effort to minimize collection. We do not collect:

• Real-time location data
• Biometric data
• Sensitive categories of personal data under GDPR Article 9 (race, religion, political opinions, health data, sexual orientation, etc.) — Customer Inputs may contain such data if you submit it; we do not solicit it
• Behavioral or advertising tracking data
• Information from cookies other than the session cookie required to keep you logged in

The Service uses no third-party advertising trackers, analytics pixels, or marketing cookies of any kind.

3. How we use personal information

We process personal information for the following purposes only:

We do not use personal information for direct marketing, behavioral advertising, profiling decisions with legal effect, or training third-party AI models.

4. How we share personal information

We share personal information only as described below.

4.1 With service providers ("processors" under GDPR)

To operate the Service, we share certain data with the following categories of vendors. Each is bound by a written data-processing agreement and is permitted to process your data only on our documented instructions.

We will update this list when material changes occur. The current vendor list is also available on request to privacy@reactiphi.com.

4.2 With Anthropic (specific note)

Customer Inputs are transmitted to Anthropic's API for processing by the underlying language models. Anthropic operates under its own privacy policy and commercial terms (anthropic.com/legal/privacy, anthropic.com/legal/commercial-terms). Per Anthropic's commercial-API terms in effect at the time of this Policy, Customer Inputs and Outputs transmitted via the API are not used by Anthropic for training their models. We do not separately authorize the use of Customer Inputs for any training or fine-tuning purpose by any third party.

4.3 With other Customers

Each Organization's data is strictly isolated from every other Organization's data. The Service architecture enforces tenant separation at the database query layer: every read and write of campaign, run, script, persona, response, score, insight, brief, and usage data filters by organization_id. There is no scenario in which one Customer can view, list, or modify another Customer's data through the Service.

The single exception is share links: when you, as the Customer, explicitly generate a share link for a brief or report, anyone in possession of the share-link URL can view that specific brief/report. Share links use unguessable cryptographic tokens (24 bytes of entropy) and are only generated on your explicit action. You can revoke a share link at any time.

4.4 With law enforcement or under legal compulsion

We will disclose personal information when required by valid legal process (subpoena, court order, statutory production order). Where lawful, we will notify the affected Customer before disclosure. We do not voluntarily share personal data with law enforcement absent legal compulsion.

4.5 In the event of a corporate transaction

If Reactiphi LLC is involved in a merger, acquisition, financing transaction, or sale of substantially all of its assets, personal information may be transferred to the acquiring entity, subject to commercially standard confidentiality protections. We will provide notice via email and an in-app banner before the transfer takes effect, and the acquiring entity will be bound by terms no less protective than this Policy (or you will be given the option to delete your data).

4.6 We do NOT sell personal information

We do not sell personal information for monetary or other valuable consideration, as those terms are defined under CCPA, CPRA, or similar laws. We have not sold personal information in the past twelve months and have no intention to do so.

5. Where personal information is stored

The Service is hosted in the United States, in the AWS us-east-2 (Ohio) region. All Customer data — including the PostgreSQL database (Aurora), application containers (ECS), and managed backups — resides in the United States.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, by using the Service you consent to the transfer of your personal data to the United States. Where required by law, such transfers are made under the European Commission's Standard Contractual Clauses (Module 1 or Module 2 as applicable), the UK International Data Transfer Addendum, or an equivalent valid transfer mechanism. A copy of our SCC documentation is available on request to privacy@reactiphi.com, or under our separate Data Processing Agreement on request.

6. How long we keep personal information

When the retention period expires, personal information is hard-deleted from our active systems and propagated to backups within the backup retention window above.

7. Your rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

We will respond to verifiable requests within thirty (30) days (or sixty (60) days for complex requests, with notice).

We do not discriminate against users who exercise their privacy rights.

Operator note (CCPA disclosure): in the past twelve months, the categories of personal information described in Section 2 have been collected, used, and disclosed for the purposes described in Sections 3 and 4. We have not sold or shared personal information for cross-context behavioral advertising in the past twelve months.

8. Security

We protect personal information using a combination of technical and organizational measures, including:

• Transport encryption. All connections to the Service are over TLS 1.2 or higher.
• At-rest encryption. Database and backup storage are encrypted using cloud-provider-managed keys.
• Password storage. User passwords are hashed using argon2id with a per-password salt; plaintext passwords are never stored or logged.
• Session tokens. Stored as cryptographic hashes at rest; cookies are marked HTTP-only, Secure (in production), and SameSite=Lax (or none for cross-origin production deployments).
• Tenant isolation. Every database query that touches Customer data filters by organization_id. No cross-org joins exist in the API surface.
• Per-organization wallet isolation. Each Organization's wallet balance and transaction ledger are scoped to that Organization only and cannot be accessed across tenants.
• Role-based access control. Three-tier role hierarchy (admin, editor, viewer) per Organization.
• Rate limiting. Brute-force-prone endpoints (login, password reset, invitation acceptance) are rate-limited per IP address.
• Redacted logging. Sensitive field names (passwords, tokens, API keys) are automatically redacted by the logging pipeline before any log line is emitted.
• Audit trail. Authentication events, administrative actions, and per-LLM-call usage are recorded for the retention windows above.
• Secret management. Production API keys and database credentials are stored in the cloud provider's encrypted secret store, never in source code or log output.
• Responsible disclosure. Security researchers may report vulnerabilities to security@reactiphi.com; we commit to a 90-day disclosure timeline.

No security measure is perfect. In the event of a breach involving your personal data, we will notify the relevant supervisory authority (where required by law) within 72 hours and notify affected users without undue delay.

9. Cookies and tracking

The Service uses only one cookie: a session cookie required to maintain your login state. This cookie is HTTP-only, Secure (in production), and SameSite-restricted. It is automatically deleted when your session expires (24 hours).

We do not use cookies for tracking, analytics, advertising, A/B testing, or behavioral profiling.

We do not use third-party tracking pixels, fingerprinting, or any similar technique.

We do not honor Do Not Track signals because we do not track in the first place.

10. Children

The Service is not intended for and is not directed at individuals under sixteen (16) years of age (or, where stricter, the minimum age required by your jurisdiction for processing personal data without parental consent). We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact privacy@reactiphi.com and we will take steps to delete the information.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" and "Version" fields at the top
• Provide notice through the Service (typically via the in-app blocking modal at next sign-in) for material changes
• Where required by law, obtain renewed consent before applying material changes

Continued use of the Service after the effective date of an updated policy constitutes acceptance of the updated policy. If you do not agree to a material change, you may discontinue use and request deletion of your data.

12. Contact

For any privacy-related question or to exercise your rights, contact us:

• Email (privacy / DSARs): privacy@reactiphi.com
• Email (security disclosure): security@reactiphi.com
• Email (legal notices): legal@reactiphi.com
• Email (general / support): operations@reactiphi.com
• Mailing address: Reactiphi LLC, 68 Harrison Ave Ste 605 PMB 527052, Boston, MA 02111-1929, USA
• Phone: (508) 474-9425
• Registered agent (Delaware): United States Corporation Agents, Inc. (LegalZoom), 131 Continental Drive, Newark, DE 19713, USA

If we are processing your personal data on behalf of an Organization (as a processor under GDPR or service provider under CCPA), please first contact that Organization's administrator. We will assist the Organization in responding to your request as required by our contract with them.

Document control

© 2026 Reactiphi LLC. All rights reserved.