Privacy Policy

1. Scope

This Privacy Policy explains how Albi collects and uses personal data about you as a user of the Albi application and website — account, billing, and usage information. It does not cover the customer, prospect, or pricing data you upload or sync into a project to analyze; Albi processes that on your behalf under the Data Processing Addendum, where you (or your client) are the controller. If you answered a survey run through Albi, see our Respondent Privacy Notice instead.

2. Personal data we collect

You provide it:

• Account data — name, work email, password (hashed), organization name.
• Billing data — company name, billing contact, and a record of each launch you pay for (amount, refunds, Stripe payment reference). Card details are handled by Stripe and are not stored by Albi.
• Communications — messages you send us (support, contact, request-access).

Collected automatically:

• Usage & device data — pages viewed, features used, actions taken, IP address, browser/device type, via our product-analytics and error-tracking tools (Mixpanel and PostHog) and server logs. Used for security, debugging, and product improvement. These tools may record session replays; inputs are masked so customer data is not captured.

We do not knowingly collect special-category data through the account layer.

3. How we use it (and legal bases)

We do not sell personal data. We do not use your account data to train AI models.

4. AI processing

Albi uses Anthropic's API to analyze pricing data, generate research and design outputs, and simulate synthetic respondents (AI-generated answers; no real person's data is used to create them). Prompts and the pricing data you submit for analysis are transmitted to Anthropic as a sub-processor. Anthropic does not train on data sent through its commercial API (Anthropic commercial terms). This is the analysis of your project data, governed by the DPA; your account personal data is not sent for AI processing.

Connected AI apps. When you connect an AI assistant such as Claude or ChatGPT to Albi, it acts as you, with your access. Albi keeps a log of what it changed: the action, when, which app, and a few short settings such as a name or a sample size. The log never holds answers, question text or contact details. The data Albi returns to the assistant is processed by that assistant's provider under its own terms. You can disconnect an app at any time in Albi under Settings, Connected apps, or from the assistant's settings.

5. Sharing & sub-processors

We share personal data only with vendors that process it on our behalf, under contract: Vercel (hosting), Supabase (database/auth), Anthropic (AI), Stripe (payments), Resend (email), Mixpanel (product analytics), and PostHog (analytics & error tracking). If you run a panel study, the panel receives your study's settings, not your account data: PureSpectrum or Cint as our sub-processors, or Prolific, which handles its participants as an independent controller under its own privacy policy. The current list, with locations, is in Annex III of the Data Processing Addendum. We may also disclose data where required by law or in a merger/acquisition.

6. International transfers

Personal data may be processed in the United States and other countries. Where required, transfers rely on Standard Contractual Clauses or an equivalent safeguard.

7. Retention

We keep account data for the life of your account and for 24 months after closure, unless a longer period is required by law (e.g. tax records). Analytics and logs are retained for up to 12 months. Project/client data deletion is governed by the DPA. Survey respondents' data follows the Respondent Privacy Notice: panel IDs are removed 120 days after the study closes, and answers are deleted 12 months after it closes, or sooner if the researcher deletes the study.

8. Your rights

Subject to applicable law, you may access, correct, delete, port, or object to processing of your personal data, and withdraw consent. Contact hello@albiagents.com. You may lodge a complaint with your supervisory authority. For California residents: rights to know, delete, correct, and opt out of "sale"/"sharing" under the CCPA/CPRA — Albi does not sell or share personal data as those terms are defined.

9. Security

Encryption in transit (TLS) and at rest; client API credentials encrypted per project (AES-256); access controls and audit logging. No method is perfectly secure; we will notify you of a breach as required by law.

11. Children

Albi is a business product, not directed to anyone under 18.

12. Changes

We will post changes here and update the effective date; material changes will be notified by email or in-app.

13. Contact

Albi Agents, Inc., 124 West 60th Street, Apt 41D, New York, NY 10023, USA — hello@albiagents.com.