Privacy Policy

1. Who controls your data

Where a Store enrolls its team, the Store is the controller of its Users’ data and Laureax acts as a processor on the Store’s behalf. For account administration, billing, security, and product improvement, Laureax acts as a controller. If your employer enrolled you, please also review your employer’s internal policies.

2. Information we collect

We collect only what the Service needs to function:

• Account information — name, role (manager or salesperson), Store association, and a username. Managers provide an email address; salespeople may use a phone number with country code instead of an email.
• Authentication data — a securely hashed password and session tokens, managed through Google Firebase Authentication. We never store passwords in plain text.
• Training activity — practice conversation transcripts, voice recordings you choose to record, AI-generated scores and coaching feedback, selected brand/maison focus, and usage timestamps.
• Technical data — IP address, device and browser type, and basic logs used for security, rate limiting, and reliability.

We do not intentionally collect special-category data. Please do not enter customer personal data, payment details, or sensitive personal information into practice sessions.

3. How we use information

• Provide the Service: run practice sessions, generate scores and coaching.
• Show managers aggregated team performance, trends, and coaching recommendations.
• Authenticate Users, secure accounts, and prevent abuse.
• Operate, maintain, debug, and improve the Service.
• Communicate about your account, including password-reset and service notices.

We do not sell personal data, and we do not use your practice content to train third-party foundation models.

4. AI processing and subprocessors

The Service uses third-party AI providers to power the practice client, transcription, and evaluation. When you use these features, the relevant content (for example, your messages, a voice recording, or a session transcript) is transmitted to these providers solely to return a result to you:

• Anthropic and OpenAI — conversation, transcription, and evaluation.
• Google Firebase — authentication and database hosting.
• Resend — transactional email (e.g., password-reset links).
• Meta (WhatsApp Business Platform)— delivering opted-in managers’ notifications (weekly team reports, idle-rep alerts, onboarding and password-reset links) to their WhatsApp number. Only a manager who has explicitly opted in receives WhatsApp messages, and we send the minimum data needed (e.g., a team total and a secure link rather than individual names).
• Vercel — application hosting and delivery.

These providers process data under their own terms and act as our subprocessors. We seek providers that offer zero- or limited-retention handling of submitted content.

5. How we share information

We share information only with: (a) the subprocessors above; (b) your Store and its managers, who can see your training activity and performance; (c) authorities when required by law; and (d) a successor in the event of a merger or acquisition, subject to this Policy. We never sell your data.

6. Data retention

We keep account data for as long as your account is active. Practice transcripts and scores are retained to power your history and team analytics, and are deleted within a reasonable period after account closure or upon a valid deletion request, unless we must retain them to comply with legal obligations. In-progress sessions that are never completed expire automatically.

7. Security

We protect data with encryption in transit, hashed credentials, httpOnly session cookies, role-based access controls, server-side authorization on protected endpoints, and rate limiting. No method of transmission or storage is perfectly secure, but we work to protect your information and review our safeguards over time.

8. Your rights

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at privacy@laureax.ai or ask your Store manager. If your account was created by your employer, some requests may be directed to them as the controller.

9. International transfers

Your data may be processed in countries other than your own, including the United States, where our providers operate. Where required, we rely on appropriate safeguards for such transfers.

10. Children

The Service is intended for business use by adults and is not directed to children.

11. Changes to this Policy

We may update this Policy from time to time. We will revise the “Last updated” date above and, for material changes, take reasonable steps to notify you.

12. Contact

Questions or requests: privacy@laureax.ai.