The short version
The list we repeat everywhere on this site, in the same words:
-
No facial recognition. No emotion recognition.
LIVEAlice listens to what people say and do. She does not read faces or infer emotions, by design.
-
Raw audio deleted within 24 hours
LIVEAudio is processed during the session. Raw recordings are deleted within 24 hours unless the client opts in to keep them.
-
Encryption in transit and at rest
LIVESession data, transcripts and reports are encrypted in transit and at rest.
-
Role-based access
LIVEEach participant receives their own Gap Card. The sponsor sees the team report and, by the policy set at onboarding, individual cards or only aggregates.
-
Participants consent before the Room opens
LIVEEvery participant sees what Alice does with audio and agrees on the Room Check screen. Nothing is hidden from participants except the plot.
-
Decision support, not automated decisions
LIVEThe Alice Report is decision support for a human debrief, not an automated decision about anyone.
-
GDPR-ready processing
LIVEProcessing is designed for GDPR: lawful basis, minimization, retention limits, data subject rights.
-
Data residency EU/US
LIVEAvailable on Enterprise.
-
SOC 2 Type II in progress
IN PROGRESSSOC 2 Type II is in progress; we will say so until it is not.
01Who we are and how to reach us
The company responsible for alice.report is Discover IT LLC. For anything about your data, including requests under this policy, write to report@alice.report with “Privacy” in the subject line. A manager replies within one business day; a request under section 11 is answered in full within one month.
02Our roles: controller and processor
Who decides why data is processed depends on where you meet Alice.
| Situation | Controller | Our role |
|---|---|---|
| Visiting alice.report, lead forms, the Solo Probe, creating an account, billing | Discover IT LLC | Controller |
| A Team Session, Growth or Enterprise session, and everything inside it: audio, transcript, Signals, indicator scores, the Alice Report, Gap Cards, Pulse-Tests | The organization that booked the session (the customer) | Processor, under our Data Processing Agreement |
| A session run by a Partner for the Partner's client | The Partner's client | Subprocessor to the Partner, who is the client's processor |
If you are a participant in a session, your organization decides why the session runs and on what lawful basis, and it is your first point of contact for your rights. We process on its instructions. This policy tells you what that processing is, and section 11 tells you how we help with requests either way.
03What we collect, by situation
Visitors to alice.report. The technical data every browser sends with a request: IP address, browser and device type, the page requested and the referring page. We use it to deliver the site and keep it secure, and it may appear in service logs (section 6). The site sets no cookies and runs no third-party trackers; it counts visits without cookies (section 14), and what it keeps in your own browser is listed there too.
The Solo Probe. Your ten decisions and the time each one took; the one line of free text at decision 10; and, only if you switch the microphone on, your voice during the Probe, processed live and not kept. No account is needed. If you ask for First Glance by email after it is shown, we keep your work email, role and company size with it. If you do not, nothing that identifies you is kept, and your decisions join anonymous aggregates.
Account holders. Name, work email, organization, role, sign-in method (magic link, Google or Microsoft sign-in), Workspace settings including the access policy you set at onboarding, booking details, and invoicing details. Card numbers are held by our payment processor, never by us.
Session participants. The name and email the session owner used to invite you; your Room Check result (camera, microphone, headphones, connection) and your acknowledgment of the consent line; during the session, your audio, the transcript attributed to you by microphone channel, the Signals and indicator scores derived from it; after the session, your Gap Card and your part of the team report. Video is streamed to the other participants and never recorded. If the session owner enters salary bands for the People-Risk Map, those are the owner's entries and stay in the owner's report.
Lead forms. What you type into a form on this site: booking requests, partner applications, security overview requests, First Glance by email. Every form is stored on our server and read only by our team at report@alice.report.
Pulse-Tests. Anonymous answers at 30 and 90 days after a session, on Growth and above. We do not link an answer to a name.
04Why we process, and on what lawful basis
| Purpose | Data | Lawful basis (where we are controller) |
|---|---|---|
| Running the website and keeping it secure | Technical data your browser sends with each request | Legitimate interests |
| Counting visits to improve the site | Page, referring site, campaign tags, device type, region from the time zone, browser language, a visit code that changes daily | Legitimate interests |
| Running the Solo Probe and showing First Glance | Decisions, timing, optional voice, optional free text | Legitimate interests; consent for the microphone |
| Sending First Glance by email and following up | Work email, role, company size, First Glance | Consent, which you can withdraw at any time |
| Creating and operating your account and Workspace | Account data, settings, access policy | Performance of a contract |
| Booking, scheduling and invoicing sessions | Booking and invoicing data | Performance of a contract; legal obligation for invoices |
| Answering lead forms | What you typed | Legitimate interests; consent for later marketing |
| Improving Alice's pacing and the scenario library | The Director's Log and aggregated session timing, without names | Legitimate interests |
| Maintaining the Cohort benchmark | Indicator scores stripped of names, team, company and session | Legitimate interests; the data is no longer personal once aggregated |
Where we are processor, the lawful basis is the customer's. For employees in a session, that is usually the employer's legitimate interests or the employment relationship; the customer must tell participants about the session, and Alice repeats it on the Room Check screen before the Room opens. A participant who does not agree does not join the Room.
05What happens in the Room
Alice listens to the audio of a session and to nothing else. Speech becomes text; text is attributed to a speaker by that participant's own microphone channel, not by a voiceprint; and the Alice Assessor derives Signals from it: who spoke, when, for how long; turn-taking; interruptions; decision latency; card usage; captain handovers; mission outcomes. Signals become 92 indicators, 25 competencies and 7 team-dynamics dimensions, scored against the Cohort, and compiled into the Alice Report 15 minutes after the last decision.
We do not perform facial recognition, emotion recognition or any biometric identification. We do not analyze video. We do not train models on your transcripts or your reports. Raw audio is deleted within 24 hours of the session's end unless the customer opted in at booking to keep it.
06Retention
| Data | Kept for |
|---|---|
| Raw session audio | Deleted within 24 hours unless the customer opts in; opted-in audio is kept for the period in the order form and deleted on request |
| Video | Never kept |
| Transcript (text) | With the session record, as the source of Moments; deleted with the session |
| Signals and indicator scores, named | With the report |
| The Alice Report, Gap Cards, the Director's Log | While the account is active; deleted on request, and within 30 days of account closure |
| Cohort contribution | Indefinitely, as aggregated indicator scores that cannot be re-identified |
| Solo Probe decisions | Not kept in identifiable form unless you ask for First Glance by email; then until you unsubscribe or ask |
| Account and invoicing data | While the account is active, then for the period the law requires for invoices |
| Lead forms | Until the inquiry is resolved and, with your agreement, for follow-up |
| Service logs | A limited period for security and debugging; no session content |
07Who receives data
Subprocessors. Six categories of provider process data on our instructions and under contract: cloud hosting and storage; real-time media infrastructure for the Room; speech-to-text and AI inference; transactional email; payment processing; error and performance telemetry. None may use your data for anything but the service, and none trains on it. The current list with names is attached to the Data Processing Agreement and sent on request.
Your organization. In a session, the session owner receives the team report and, by the access policy set at onboarding, individual Gap Cards or aggregates only. During the session the owner sees progress, never the live transcript.
A success manager on Growth and Enterprise, who may lead the debrief with the session owner's permission.
A Partner, if your session was run under a Partner's brand, under the Partner's own agreement with your organization.
Authorities, where the law requires it, and only to the extent it requires.
A successor, if Discover IT LLC is acquired or merged; this policy continues to apply and you will be told.
We do not sell personal data.
08International transfers
On Enterprise, the customer chooses data residency in the EU or the US, and session records, transcripts, reports and the Assessor's processing stay there. Otherwise data is held in our standard region, and any transfer out of the region where it was collected is covered by standard contractual clauses or an equivalent recognized mechanism. The Data Processing Agreement states the residency and the mechanism in contract language.
09Security
Session data, transcripts and reports are encrypted in transit and at rest. Media in the Room is encrypted in transit. Access is role-based for customers and by named role, least privilege, multi-factor and logged for our staff. Backups are encrypted. The platform is tested by independent penetration testers. SOC 2 Type II is in progress. If an incident affects your data, we tell the controller without undue delay and in time for its own notification obligations. The security page describes the controls in full.
10Automated decision-making
Alice scores observed behavior at timestamps and compiles it into a report. She does not make decisions about anyone. The Alice Report is decision support for a human debrief; no decision with legal or similarly significant effect on a person is made by Alice, and customers agree in the terms of service not to use the report as the sole basis for such a decision. Every score in the report links to a Moment, the transcript excerpt that evidences it, so a human can check the number against what was said.
11Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable format, to withdraw a consent you gave, and to complain to your data protection authority. People in jurisdictions with comparable privacy laws have comparable rights, and we honor them in the same way.
To exercise a right, write to report@alice.report with “Privacy” in the subject line. We answer within one month. Where we are processor, we will pass your request to your organization as controller and help it respond; where we are controller, we respond ourselves. Each participant may request their own Gap Card at any time, independently of the organization's access policy.
12The Cohort
Every session adds indicator scores to the Cohort, the benchmark set that every team is scored against. Contributions are stripped of names, team, company, session and any free text, and are aggregated. Once aggregated they cannot be re-identified and are no longer personal data. Enterprise contracts can set the terms of contribution.
13Children
Alice is for working teams. The service is not directed at anyone under 18, and we do not knowingly process their data.
14Cookies and browser storage
alice.report sets no cookies. It runs no advertising and no third-party trackers, and its pages load nothing from other sites: fonts, images, video and scripts are served from alice.report itself.
Visit counting. To see which pages work, alice.report counts visits itself, without cookies and without storing anything on your device. For each page view it records the page, the site you came from, campaign tags in the link, the device type (phone, tablet or desktop), a region taken from your browser's time zone and your browser language. Unique visits within one day are counted with a code derived from your IP address and browser that changes every day and is not linked to you across days; the IP address itself is not stored. If your browser sends Global Privacy Control or Do Not Track, nothing is recorded. The records are kept for 13 months, on the basis of our legitimate interests.
A few features keep their state in your browser's own storage, because they cannot work without it. This data stays on your device; our servers never read it. What a form sends to us is described in section 3.
| Name | Kept in | What it is for |
|---|---|---|
| alice_session | Local storage | The demo sign-in: the name and work email you entered, so the workspace knows who is signed in |
| alice_booking | Local storage | The session you booked on this site, so the confirmation and the workspace can show it |
| alice_onboarding | Local storage | Your onboarding answers and the teammates you added, so you can finish later |
| alice_cookie_choice | Local storage | That you closed the privacy notice, so it is not shown again |
| alice.probe.v1 | Session storage | Your progress in the Solo Probe, so a reload resumes the same decision; cleared when you close the tab |
| alice_auth_sent_signin, alice_auth_sent_signup, alice_partner_applied, alice_security_request | Session storage | Keeps a form’s “sent” message on screen after a reload; cleared when you close the tab |
Session storage is cleared when you close the tab. To remove the rest, clear this site's data in your browser settings. If we ever add a cookie or a third-party tracker, this section and the notice on the site change first.
15Changes
When this policy changes, the date at the top changes and the change is described in one line beneath it. A change that reduces your rights is announced to account holders by email before it takes effect.
16Contact
Discover IT LLC · report@alice.report · subject line “Privacy”.