Effective Date: September 30, 2025
Last Updated: August 18, 2026

1. INTRODUCTION

Your360 AI, Inc. ("Your360 AI," "we," "us," or "our") provides AI-powered 360-degree feedback services for Professional Development. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our website (your360.ai), platform, and services (collectively, the "Services").

By using our Services, you acknowledge that you have read and understood this Privacy Policy and agree to our collection, use, and disclosure of your information as described herein.

Definition: Throughout this Privacy Policy, "Professional Development" or "Development" means improving your work-related skills and effectiveness through feedback and coaching provided by our Services.

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

Account Information

• Name, email address, job title, role
• Phone number (optional)
• Company/organization affiliation
• Password and account credentials

Development Information

• Development goals and focus areas
• Optional context documents (resume, performance reviews)
• Selection of feedback providers
• Coaching conversation content

Feedback Provider Information

• Name and email address
• Relationship to feedback recipient
• Feedback content (via voice or text)
• Voice recordings and transcripts

2.2 Information Collected Automatically

Usage Information

• IP address and device information
• Browser type and settings
• Date, time, and duration of visits
• Pages viewed and features used
• Referring and exit pages

Cookies and Analytics

• First-party cookies for session management
• Analytics data (PostHog, Google Analytics)
• Session recordings (with sensitive content obscured)

2.3 Information from Third Parties

We may receive information about you from:

• Your employer (if they sponsor your account)
• Feedback providers you select
• Third-party authentication services
• Business partners and service providers

3. HOW WE USE YOUR INFORMATION

3.1 Primary Uses

We use your information to:

• Provide and operate the Services
• Conduct AI-powered feedback interviews
• Generate 360 feedback reports and Development insights
• Facilitate communication between users and feedback providers
• Process payments and maintain accounts

3.2 Service Improvement

We analyze aggregated, de-identified data to:

• Improve our AI interview techniques
• Enhance feedback synthesis quality
• Develop new features and services
• Conduct research on Professional Development

3.3 AI and Machine Learning

What We Do:

• Use AI to conduct voice interviews
• Analyze feedback patterns and themes
• Generate personalized Development insights
• Improve our interview questions and synthesis

What We Don't Do:

• Train or improve any third-party foundation models (OpenAI, Anthropic, voice infrastructure providers, or others) with your data
• Use your personal feedback for other users
• Create identifiable profiles for non-service purposes

3.4 Communications

We may use your information to:

• Send service-related notifications
• Respond to inquiries and support requests
• Provide updates about new features (with consent)
• Send marketing communications (with opt-out options)

4. HOW WE SHARE INFORMATION

4.1 With Organizations

If your employer or another organization sponsors your account, that organization owns the data its program generates, including the synthesized outputs of your assessment — your 360 report, development plan and any team-level insights.

What any particular person at that organization can see inside the product is set by the program configuration your organization selects. We show you which configuration applies before you begin. Depending on it, administrators, facilitators or your manager may be able to see some or all of:

• Who was invited to provide feedback
• Who has completed feedback sessions
• Participation and completion rates
• Aggregated, anonymized insights (minimum 5 participants)
• Your individual 360 report and development plan

Independent of configuration, the organization may request a full export of the data it owns, and may direct that it be deleted.

The transcripts of your conversations and your coaching debrief are not disclosed to anyone at your organization, in any configuration, and are not included in any export.

4.2 With Service Providers

We share information with third-party service providers who help us operate our Services:

• Cloud infrastructure providers
• Communication services (email, SMS)
• Payment processors
• Analytics providers
• AI/ML services

All service providers are contractually bound to protect your information and use it only as directed by us. A current list of our sub-processors, including their function and location, is maintained at https://your360.ai/subprocessors. Customers receiving notice of a new sub-processor have rights to object on reasonable data protection grounds, as described in our Data Processing Addendum.

Accountability for Onward Transfers (DPF)

When we transfer personal data received under the DPF Frameworks to third-party service providers acting as agents on our behalf, we do so pursuant to written contracts that require the agent to provide at least the same level of privacy protection as required by the DPF Principles. We take reasonable and appropriate steps to ensure that our agents process such personal data in a manner consistent with our obligations under the DPF Principles, and we take reasonable and appropriate steps to stop and remediate unauthorized processing by an agent upon becoming aware of it. Your360 AI remains liable under the DPF Principles if an agent processes personal data received under the DPF Frameworks in a manner inconsistent with the DPF Principles, unless we prove we are not responsible for the event giving rise to the damage.

4.3 With Feedback Recipients

Feedback providers should understand:

• Their feedback contributes to synthesized insights
• Select quotes may be included for authenticity
• Manager feedback is attributed by default
• Other feedback is presented anonymously (solely on a ‘best efforts’ basis; we cannot guarantee complete anonymity)

4.4 Legal Requirements

We may disclose information when required by law or to:

• Comply with legal process
• Protect rights, property, or safety
• Enforce our Terms of Service
• Respond to government requests

4.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

4.6 With Your Consent

We may share information for any other purpose with your explicit consent.

5. DATA RETENTION

Voice Recordings (raw audio): Deleted within 30 days of processing. We retain audio only as long as needed to generate transcripts and synthesized outputs and to operate the Service.

Transcripts: Retained while your account is active. Deleted on your or your organization's request, subject to applicable law. Transcripts may persist after account termination unless deletion is requested.

Synthesized Outputs (your 360 reports, development plans, Team Insights reports, and other coaching artifacts): Retained while your account is active. Deleted on your or your organization's request, subject to applicable law. Synthesized Outputs may persist after account termination unless deletion is requested. This retention default supports long-term Professional Development tracking and continuity across roles or employers.

Account Information: Retained until you request deletion. This retention enables long-term Development tracking and year-over-year progress comparison, and preserves your ability to return to the Service in the future.

Aggregated Data: May be retained indefinitely in de-identified form.

Post-Termination Deletion: Following termination of your account or your organization's contract, Voice Recordings will already have been deleted within 30 days of processing under the schedule above. Synthesized Outputs remain accessible to you (and, where applicable, your organization, according to the program configuration) following termination unless you or your organization requests deletion. Transcripts are retained but are not accessible to you or your organization. Upon a deletion request, we will delete the requested data within a commercially reasonable period, except where retention is required by applicable law, regulatory obligations, or legitimate business purposes (such as resolving disputes, enforcing agreements, or maintaining security and audit records). Aggregated, de-identified data is excluded from this commitment.

6. DATA SECURITY

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption in transit and at rest
• Access controls and authentication
• Regular security assessments
• Employee training and confidentiality agreements

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your information.

Breach Notification: In the event of a data breach affecting your personal information, we will notify the organization that sponsors your account within 72 hours of discovering the breach. Where an organization sponsors your account, that organization is responsible as data controller for notifying affected individuals and any applicable regulators. For individual accounts not sponsored by an organization, we will notify you and any applicable regulators directly, to the extent required by applicable law.

7. YOUR RIGHTS AND CHOICES

7.1 Access and Portability

You may request:

• Access to your personal information
• A copy of your 360 reports and insights
• Export of your Development data

7.2 Correction and Deletion

You may:

• Update your account information
• Request correction of inaccuracies
• Request deletion of your account and data

Note: Some information may be retained for legal or legitimate business purposes.

7.3 Communication Preferences

You may:

• Opt-out of marketing emails
• Adjust notification settings
• Unsubscribe from non-essential communications

7.4 Feedback Provider Rights

Feedback providers may:

• Supplement feedback before report generation
• Create an account to manage multiple feedback requests
• Request recall or withdrawal of feedback only where (a) required by applicable law, or (b) a limited recall feature is made available by Your360 AI at its sole discretion (such features, if offered, may be subject to conditions such as recall before synthesis and may be modified or discontinued at any time)

7.5 Rights Under the EU-U.S. Data Privacy Framework

The rights described in this Section 7.5 apply once our DPF certification is finalized and we appear on the Data Privacy Framework List. Until then, transfers from the European Economic Area, the United Kingdom and Switzerland rely on Standard Contractual Clauses, and you may exercise the rights described in Sections 7.1 through 7.3 and any rights available to you under those Clauses. Once our certification is finalized, if your personal data is transferred to us in reliance on the DPF Frameworks, you will have the following additional rights:

Choice (Opt-Out): You have the right to opt out of: (a) disclosure of your personal data to third parties not acting as agents on our behalf; and (b) use of your personal data for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by you. To opt out, contact us at privacy@your360.ai.

Access: You have the right to access personal data about you that we hold, and to correct, amend, or delete that information where it is inaccurate or processed in violation of the DPF Principles, except where the burden or expense of providing access would be disproportionate to the risks to your privacy, or where the rights of persons other than you would be violated. To exercise this right, contact us at privacy@your360.ai.

Recourse and Complaints: You have the right to raise a complaint regarding our DPF compliance. We commit to resolving complaints about your privacy and our collection or use of your personal data transferred to the United States. EEA, UK, and Swiss individuals with inquiries or complaints should first contact us at privacy@your360.ai.

Upon certification, we will refer unresolved privacy complaints under the DPF Frameworks to JAMS, an alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information and to file a complaint free of charge.

Under certain conditions, you may be able to invoke binding arbitration for complaints regarding DPF compliance not resolved by any other means. For more information, see Annex I of the EU-U.S. DPF Principles: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.

‍

8. CALIFORNIA PRIVACY RIGHTS

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: You may request information about the personal information we collect, use, and disclose.

Right to Delete: You may request deletion of your personal information, subject to certain exceptions.

Right to Opt-Out: You may opt-out of the "sale" of personal information. Note: We do not sell personal information.

Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To exercise these rights, contact privacy@your360.ai.

9. WASHINGTON PRIVACY RIGHTS

Washington residents have rights under the My Health My Data Act. Your360 AI is not a health service and does not seek health information. Our AI coach focuses on workplace behaviors and professional effectiveness, and we instruct participants to keep conversations focused on professional topics. We:

• Do not sell health-related data
• Will delete such information upon request

10. INTERNATIONAL DATA TRANSFERS

EU-U.S. Data Privacy Framework

Your360 AI, Inc. has applied to certify with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF (collectively, the "DPF Frameworks") as set forth by the U.S. Department of Commerce. Your360 AI is in the process of certifying with the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles with regard to the processing of personal data received from the European Union, the United Kingdom (and Gibraltar), and Switzerland in reliance on the respective DPF Framework.

Until our certification is finalized and we appear on the Data Privacy Framework List, we do not rely on the DPF Frameworks as a transfer mechanism. Transfers of personal data from the EEA, the United Kingdom and Switzerland are made under Standard Contractual Clauses, as described in our Data Processing Addendum. Once our certification is finalized, if there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles, the Principles shall govern.

To learn more about the Data Privacy Framework program and to verify our current status, visit https://www.dataprivacyframework.gov.

Other International Transfers

For transfers not covered by the DPF Frameworks, we rely on appropriate safeguards including Standard Contractual Clauses where required by applicable law.

11. CHILDREN'S PRIVACY

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn we have collected information from a child under 18, we will delete it promptly.

12. SPECIAL INFORMATION REGARDING SENSITIVE DATA

Our AI coach focuses on workplace behaviors and performance. While personal characteristics may naturally arise in conversation, our system is designed to synthesize feedback around professional capabilities and growth areas. We do not intentionally collect special categories of personal information (race or ethnic origin, sex life or sexual orientation, criminal records, religion, political opinions, trade union membership, genetic/biometric data used for identification purposes, health conditions, etc.), and instruct users to focus on professional contexts. We do not infer or surface the emotional state of any natural person in any output to participants, customers, managers, or third parties.

13. DATA OWNERSHIP AND PORTABILITY

Sponsoring organizations. Where an organization sponsors your account, that organization owns the data its program generates. It may request a full export of synthesized outputs and may direct their deletion, including a full wipe. It cannot access transcripts or coaching debriefs in any configuration.

Your access. You keep access to your reports and insights regardless of employment status, for as long as that data exists. Because the sponsoring organization owns the program data, it can direct deletion — see Section 5.

Individual accounts. Where you hold an individual account not sponsored by an organization, the above does not apply and your data is retained and deleted only on your own instruction.

Data portability. You may export your development reports and insights at any time while they exist.

14. AUTOMATED DECISION-MAKING

We use AI to analyze feedback and generate insights. These are recommendations for Professional Development, not automated decisions about you. All AI-generated content should be reviewed with human judgment and is not intended as the sole basis for employment decisions.

15. SESSION RECORDING DISCLOSURE

We use session recording tools (currently PostHog) to improve our Services and debug technical issues. Session recordings may capture interactions with the platform interface, including navigation and clicks. All form input fields are masked and audio is not captured. Recordings are retained while the account is active and are accessible only to our technical team for internal purposes.

16. PRIVACY PROTECTION THRESHOLDS

To protect individual privacy:

• Minimum 3 feedback providers required to generate a report
• Minimum 3 responses per category for category-specific insights
• Minimum 5 participants for organizational aggregated insights

17. HOW TO CONTACT US

For privacy-related questions or to exercise your rights:

Email: privacy@your360.ai
Support: support@your360.ai

Response time: We will acknowledge requests within 30 days and respond substantively within 45 days, with possible extension if needed.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website
• Sending notice to your registered email
• Displaying a notice in the platform

Your continued use after changes constitutes acceptance of the updated policy.

19. LEGAL BASIS FOR PROCESSING AND INTERNATIONAL TRANSFER MECHANISMS

Legal Basis (EEA Users)

We process personal data based on:

• Consent: For marketing and optional features
• Contract: To provide Services you have requested
• Legitimate Interests: For service improvement and security
• Legal Obligations: When required by law

Data Privacy Framework

For personal data transferred from the EEA, UK, or Switzerland, Your360 AI currently relies on Standard Contractual Clauses as described in our Data Processing Addendum. Your360 AI intends to rely on the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF as the legal mechanism for such transfers once its certification is finalized, as described in Section 10.

FTC Jurisdiction and Enforcement

Your360 AI is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC). Upon completion of our DPF certification, the FTC will have jurisdiction over our compliance with the DPF Frameworks, and our DPF commitments will be enforceable under U.S. law.

20. DATA PRIVACY FRAMEWORK — REGULATORY DISCLOSURES

Government Authority Disclosure

Notwithstanding anything to the contrary in this Privacy Policy, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Annual Recertification

Once certified, Your360 AI's DPF certification will be renewed annually. You may verify our current certification status at any time at https://www.dataprivacyframework.gov.

‍

This Privacy Policy is effective as of August 18, 2026 and supersedes all previous versions.

‍