Your360 AI Privacy Policy

Last Updated: October 13, 2026

1. INTRODUCTION

Your360 AI, Inc. ("Your360 AI," "we," "us," or "our") provides AI-powered 360-degree feedback services for Professional Development. This Privacy Policy explains how we collect, use, disclose, and protect information when you use our website (your360.ai), platform, and services (collectively, the "Services").

By using our Services, you acknowledge that you have read and understood this Privacy Policy and agree to our collection, use, and disclosure of your information as described herein.

Definition: Throughout this Privacy Policy, "Professional Development" or "Development" means improving your work-related skills and effectiveness through feedback and coaching provided by our Services.

2. INFORMATION WE COLLECT

2.1 Information You Provide Directly

Account Information

  • Name, email address, job title, role
  • Phone number (optional)
  • Company/organization affiliation
  • Password and account credentials

Development Information

  • Development goals and focus areas
  • Optional context documents (resume, performance reviews)
  • Selection of feedback providers
  • Coaching conversation content

Feedback Provider Information

  • Name and email address
  • Relationship to feedback recipient
  • Feedback content (via voice or text)
  • Voice recordings and transcripts

2.2 Information Collected Automatically

Usage Information

  • IP address and device information
  • Browser type and settings
  • Date, time, and duration of visits
  • Pages viewed and features used
  • Referring and exit pages

Cookies and Analytics

  • First-party cookies for session management
  • Analytics data (PostHog, Google Analytics)
  • Session recordings (with sensitive content obscured)

2.3 Information from Third Parties

We may receive information about you from:

  • Your employer (if they sponsor your account)
  • Feedback providers you select
  • Third-party authentication services
  • Business partners and service providers

3. HOW WE USE YOUR INFORMATION

3.1 Primary Uses

We use your information to:

  • Provide and operate the Services
  • Conduct AI-powered feedback interviews
  • Generate 360 feedback reports and Development insights
  • Facilitate communication between users and feedback providers
  • Process payments and maintain accounts

3.2 Service Improvement

We analyze aggregated, de-identified data to:

  • Improve our AI interview techniques
  • Enhance feedback synthesis quality
  • Develop new features and services
  • Conduct research on Professional Development

3.3 AI and Machine Learning

What We Do:

  • Use AI to conduct voice interviews
  • Analyze feedback patterns and themes
  • Generate personalized Development insights
  • Improve our interview questions and synthesis

What We Don’t Do:

  • Train or improve any third-party foundation models (OpenAI, Anthropic, voice infrastructure providers, or others) with your data
  • Use your personal feedback for other users
  • Create identifiable profiles for non-service purposes

3.4 Communications

We may use your information to:

  • Send service-related notifications
  • Respond to inquiries and support requests
  • Provide updates about new features (with consent)
  • Send marketing communications (with opt-out options)

4. HOW WE SHARE INFORMATION

4.1 With Organizations

If your employer or another organization sponsors your account, that organization owns the data its program generates, including the synthesized outputs of your assessment: your 360 report, your development plan and any team-level insights. The transcripts and recordings of your conversations, including your coaching debrief (the conversation in which the AI coach walks you through your report), are our confidential information rather than your organization’s, and we do not disclose them to your organization in any configuration.

Our default is that your 360 report and your development plan are visible only to you. No one at your organization sees either document unless your organization selects a different configuration.

An organization may instead choose a configuration in which someone else at your organization also receives your report, usually an administrator, a coach or your manager. Where it does, we say so. Everyone we ask for feedback about you is told who will have access to your report before they answer, so they can decide what to say and how to say it.

In every configuration, designated administrators can see:

  • Who was invited to provide feedback
  • Who has completed feedback sessions
  • Participation and completion rates
  • Aggregated, anonymized insights (minimum 5 participants)

Your organization may request an export of the synthesized outputs it owns: 360 reports, development plans and team-level insights. An export does not contain transcripts or coaching debriefs.

Deletion is separate. Your organization may direct us to delete the data it owns, and may direct a full wipe, which reaches the transcripts and the raw recordings as well, even though it never had access to either.

The transcripts of your conversations and your coaching debrief are not disclosed to anyone at your organization, in any configuration, and are not included in any export.

4.2 With Service Providers

We share information with third-party service providers who help us operate our Services:

  • Cloud infrastructure providers
  • Communication services (email, SMS)
  • Payment processors
  • Analytics providers
  • AI/ML services

All service providers are contractually bound to protect your information and use it only as directed by us. A current list of our subprocessors (the “Subprocessor List”), including their function and location, is maintained at https://your360.ai/subprocessors. Customers receiving notice of a new subprocessor have rights to object on reasonable data protection grounds, as described in our Data Processing Addendum.

Accountability for Onward Transfers. For personal data received in reliance on the DPF Frameworks (as defined in Section 10), Your360 AI is responsible for the processing of such personal data it receives and subsequently transfers to a third party acting as an agent on its behalf. Your360 AI remains liable under the DPF Principles if its agent processes such personal data in a manner inconsistent with the DPF Principles, unless Your360 AI proves that it is not responsible for the event giving rise to the damage.

4.3 With Feedback Recipients

Feedback providers should understand:

  • Their feedback contributes to synthesized insights
  • Select quotes may be included for authenticity
  • Manager feedback is attributed by default
  • Other feedback is presented anonymously (solely on a ‘best efforts’ basis; we cannot guarantee complete anonymity)

4.4 Legal Requirements

We may disclose information when required by law or to:

  • Comply with legal process
  • Protect rights, property, or safety
  • Enforce our Terms of Service
  • Respond to government requests

4.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

4.6 With Your Consent

We may share information for any other purpose with your explicit consent.

5. DATA RETENTION

Voice Recordings (raw audio): Deleted within 30 days of processing. We retain audio only as long as needed to generate transcripts and synthesized outputs and to operate the Service.

Transcripts: Retained while your account is active. Deleted on your or your organization’s request, subject to applicable law. Transcripts may persist after account termination unless deletion is requested. Deletion requests may be limited to specific content within a transcript.

Synthesized Outputs (your 360 reports, development plans, Team Insights reports, and other coaching artifacts): Retained while your account is active. Deleted on your or your organization’s request, subject to applicable law. Synthesized Outputs may persist after account termination unless deletion is requested. This retention default supports long-term Professional Development tracking.

Account Information: Retained until you request deletion. This retention enables long-term Development tracking and year-over-year progress comparison, and preserves your ability to return to the Service in the future.

Aggregated Data: May be retained indefinitely in de-identified form.

Post-Termination Deletion: Following termination of your account or your organization’s contract, Voice Recordings will already have been deleted within 30 days of processing under the schedule above. Synthesized Outputs remain available following termination, according to the program configuration and for as long as your account access continues, unless you or your organization requests deletion. Transcripts are retained. We do not make them available to your organization and they are not part of any export, and your rights of access under Section 7 continue to apply to them. Upon a deletion request, we will delete the requested data within a commercially reasonable period, except where retention is required by applicable law, regulatory obligations, or legitimate business purposes (such as resolving disputes, enforcing agreements, or maintaining security and audit records). Aggregated, de-identified data is excluded from this commitment.

6. DATA SECURITY

We implement administrative, technical, and physical safeguards designed to protect your information, including:

  • Encryption in transit and at rest
  • Access controls and authentication
  • Regular security assessments
  • Employee training and confidentiality agreements

However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your information.

Breach Notification: In the event of a data breach affecting your personal information, we will notify the organization that sponsors your account within 72 hours of discovering the breach. Where an organization sponsors your account, that organization is responsible as data controller for notifying affected individuals and any applicable regulators. For individual accounts not sponsored by an organization, we will notify you and any applicable regulators directly, to the extent required by applicable law.

7. YOUR RIGHTS AND CHOICES

7.1 Access and Portability

You may request:

  • Access to your personal information
  • A copy of your 360 reports and insights
  • Export of your Development data

Where an organization sponsors your account, that organization is the data controller for the data its program generates. We will notify it of your request and coordinate our response with it. Requests concerning the transcripts of your conversations are fulfilled by us directly to you; we do not route them through, or disclose the transcripts to, your organization.

7.2 Correction and Deletion

You may:

  • Update your account information
  • Request correction of inaccuracies
  • Request deletion of your account and data

Note: Some information may be retained for legal or legitimate business purposes.

7.3 Communication Preferences

You may:

  • Opt-out of marketing emails
  • Adjust notification settings
  • Unsubscribe from non-essential communications

7.4 Feedback Provider Rights

Feedback providers may:

  • Supplement feedback before report generation
  • Create an account to manage multiple feedback requests
  • Request recall or withdrawal of feedback only where (a) required by applicable law, or (b) a limited recall feature is made available by Your360 AI at its sole discretion (such features, if offered, may be subject to conditions such as recall before synthesis and may be modified or discontinued at any time)

7.5 Rights for Individuals in the EEA, the United Kingdom and Switzerland (Data Privacy Framework)

Where your personal data is transferred to us from the European Economic Area, the United Kingdom or Switzerland and the transfer is not made in reliance on the DPF Frameworks (as defined in Section 10), the transfer is made under Standard Contractual Clauses (and, for the United Kingdom, the International Data Transfer Addendum), as described in our Data Processing Addendum. In addition to the rights described in Sections 7.1 through 7.3, you may exercise the rights available to you under applicable data protection law, including, as applicable, rights of access, rectification, erasure, restriction of Processing, objection, data portability, and withdrawal of consent where Processing is based on consent, and under those Standard Contractual Clauses, including as a third-party beneficiary where the Standard Contractual Clauses so provide.

If your personal data is transferred to us in reliance on the DPF Frameworks, you have the following rights:

Choice (Opt-Out): You have the right to opt out of: (a) disclosure of your personal data to third parties not acting as agents on our behalf; and (b) use of your personal data for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by you. To opt out, contact us at privacy@your360.ai.

Access: You have the right to access personal data about you that we hold, and to correct, amend, or delete that information where it is inaccurate or processed in violation of the DPF Principles, except where the burden or expense of providing access would be disproportionate to the risks to your privacy, or where the rights of persons other than you would be violated. To exercise this right, contact us at privacy@your360.ai.

Recourse and Complaints: In compliance with the DPF Principles, Your360 AI commits to resolve complaints about our collection or use of your personal data transferred to the United States in reliance on the DPF Frameworks. EU, UK, and Swiss individuals with inquiries or complaints should first contact us at privacy@your360.ai. We will respond within 45 days.

Independent Recourse Mechanism: Your360 AI has further committed to refer unresolved complaints concerning our handling of personal data received in reliance on the DPF Frameworks to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Binding Arbitration: Under certain conditions, if your complaint is not resolved by any other means, you may invoke binding arbitration for complaints regarding DPF compliance, as described in Annex I of the DPF Principles: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.

Where an organization sponsors your account, that organization is the controller of your personal data; Section 7.1 describes how we handle your requests. You also have the right to lodge a complaint with the supervisory authority in your country of residence, place of work or where an alleged infringement occurred. To exercise any of these rights, contact us at privacy@your360.ai.

8. CALIFORNIA PRIVACY RIGHTS

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Right to Know: You may request information about the personal information we collect, use, and disclose, including the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the purposes for which it is used, and the categories of third parties to whom it is disclosed.

Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions.

Right to Opt-Out: You may opt-out of the "sale" or “sharing” of personal information. Note: We do not sell or share personal information as those terms are defined by the CCPA.

Right to Limit: Where applicable, you may direct us to limit certain uses or disclosures of sensitive personal information. We do not use or disclose sensitive personal information for purposes that require us to provide a right to limit under the CCPA.

Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

For CCPA purposes, during the preceding 12 months we may have collected the following categories of personal information described in Section 2: identifiers; customer-record information; commercial information; internet or other electronic network activity; professional or employment-related information; audio or other electronic information; inferences; and sensitive personal information where voluntarily provided. We obtain this information from the sources described in Section 2, use it for the purposes described in Section 3, and disclose it to the service providers described in Section 4.2.

To exercise these rights, contact privacy@your360.ai.

9. WASHINGTON PRIVACY RIGHTS

Washington residents have rights under the My Health My Data Act. Your360 AI is not a health-related service and does not seek health information. Our AI coach focuses on workplace behaviors and professional effectiveness, and we instruct participants to keep conversations focused on professional topics. Our AI coach is instructed to steer the conversation back to professional topics if health-related topics come up. We:

  • Do not sell or share health-related data
  • Will delete the relevant transcript upon request
  • If health-related information comes up incidentally in a conversation, process it only as part of that conversation’s transcript to provide the service you or your organization requested; we do not use it to draw conclusions about anyone’s health, and we take reasonable measures designed to keep it out of reports, development plans, analytics, benchmarking and de-identified datasets
  • Never give your organization access to transcripts

10. INTERNATIONAL DATA TRANSFERS

We are based in the United States and process personal data there and in the countries where our service providers operate (see Section 4.2 and our Subprocessor List).

EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. Data Privacy Framework

Your360 AI, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) (collectively, the “DPF Frameworks”) as set forth by the U.S. Department of Commerce. Your360 AI has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom (and Gibraltar) in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Your360 AI has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Annual Recertification: Your360 AI’s DPF certification is renewed annually. You may verify our current certification status at any time on the Data Privacy Framework List at https://www.dataprivacyframework.gov/list.

Transfers from the EEA, the United Kingdom and Switzerland Not Made in Reliance on the DPF Frameworks

Transfers of personal data from the European Economic Area, the United Kingdom and Switzerland to the United States that are not made in reliance on the DPF Frameworks are made under the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss adaptations of the Standard Contractual Clauses, as set out in our Data Processing Addendum, supplemented by the technical and organizational measures described in Section 6.

Other International Transfers

For transfers from other jurisdictions, we rely on appropriate safeguards, including Standard Contractual Clauses or other lawful transfer mechanisms, where required by applicable law.

11. CHILDREN’S PRIVACY

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we learn we have collected information from a child under 18, we will delete it promptly.

12. SPECIAL INFORMATION REGARDING SENSITIVE DATA

Our AI coach focuses on workplace behaviors and performance. While personal characteristics may naturally arise in conversation, our system is designed to synthesize feedback around professional capabilities and growth areas. We do not intentionally collect special categories of personal information (race or ethnic origin, sex life or sexual orientation, criminal records, religion, political opinions, trade union membership, genetic/biometric data used for identification purposes, health conditions, etc.), and instruct users to focus on professional contexts. We do not infer or surface the emotional state of any natural person in any output to participants, customers, managers, or third parties. Health-related information that arises incidentally in a conversation is handled as described in Section 9.

13. DATA OWNERSHIP AND PORTABILITY

Sponsoring organizations: Where an organization sponsors your account, that organization owns the synthesized outputs its program generates. It may request a full export of them and may direct their deletion, including a full wipe. It does not own, and cannot access, the transcripts of your conversations or your coaching debrief in any configuration. Those are our confidential information.

Individual accounts: Where you hold an individual account not sponsored by an organization, the above does not apply and your data is retained and deleted only on your own instruction.

Data portability: You may export your development reports and insights at any time while they exist and while you have access to your account.

14. AUTOMATED DECISION-MAKING

We use AI to analyze feedback and generate insights. These are recommendations for Professional Development, not automated decisions about you. All AI-generated content should be reviewed with human judgment and is not intended as the sole basis for employment decisions.

15. SESSION RECORDING DISCLOSURE

We use session recording tools (currently PostHog) to improve our Services and debug technical issues. Session recordings may capture interactions with the platform interface, including navigation and clicks. All form input fields are masked and audio is not captured. Recordings are retained while the account is active and are accessible only to our technical team for internal purposes.

16. PRIVACY PROTECTION THRESHOLDS

To protect individual privacy:

  • Minimum 3 feedback providers required to generate a report
  • Minimum 3 responses per category for category-specific insights
  • Minimum 5 participants for organizational aggregated insights

17. HOW TO CONTACT US

For privacy-related questions or to exercise your rights:

Email: privacy@your360.ai

Support: support@your360.ai

Response time: We will respond to privacy requests within the time required by applicable law, subject to any extensions permitted by applicable law.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes by:

  • Posting the updated policy on our website
  • Sending notice to your registered email
  • Displaying a notice in the platform

Your continued use after changes constitutes acceptance of the updated policy.

19. LEGAL BASIS FOR PROCESSING AND INTERNATIONAL TRANSFER MECHANISMS

Legal Basis (EEA Users)

Where Your360 acts as a controller, including with respect to individual accounts and account administration, we process personal data based on:

  • Consent: For marketing and optional features
  • Contract: To provide Services you have requested
  • Legitimate Interests: For service improvement and security
  • Legal Obligations: When required by law

Where we process personal data on behalf of a sponsoring organization, we act as a processor on behalf of that organization (or the controller on whose behalf it acts), and process such data in accordance with its instructions and our Data Processing Addendum.

International Transfer Mechanisms: For personal data received from the EEA, the United Kingdom or Switzerland in reliance on the DPF Frameworks, Your360 AI adheres to the DPF Principles as described in Section 10. For transfers not made in reliance on the DPF Frameworks, Your360 AI relies on Standard Contractual Clauses (and the UK International Data Transfer Addendum) as described in our Data Processing Addendum and in Section 10.

FTC Jurisdiction and Enforcement: Your360 AI is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC) with respect to its compliance with the DPF Frameworks, and our commitments under the DPF Principles are enforceable under U.S. law.

20. GOVERNMENT AND LAW ENFORCEMENT REQUESTS

Government Authority Disclosure: We may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. Where permitted by law, we will notify the sponsoring organization of such a request and limit the disclosure to what is required.

This Privacy Policy was last updated on October 13, 2026 and supersedes all previous versions.