Privacy

From you (the operator): email address, password hash, account-level activity (sims you run, audiences you create, consents you accepted with timestamps).

From your uploaded data: when you upload a LinkedIn export or another audience file you control, we parse it on the server. We extract text fields needed to derive anonymized persona archetypes. Role text is run through a strip step that removes the company name and any parenthetical identifiers before storage.

From third parties represented in your upload: we may read fields like role, title, employer, location, and other text columns needed to synthesize personas from the uploaded file. We do not persist names, email addresses, or company identifiers on derived personas. We do notstore the message content from messages third parties sent you. If your upload includes a profile URL we hash it with a per-application secret salt, store only the hash, and use it to deduplicate the same person across multiple users’ uploads. The original URL is discarded.

• We never message your connections.
• We never sell identifiable personal data.
• We never store the bodies of messages your connections sent. (Your own outgoing messages may be analyzed to infer your voice; this is opt-in and clearly labeled when offered.)
• We never attempt to re-identify a connection inside the simulator. All agents in your simulator are referred to by archetype, never by real name.

For your account:to power your simulations, your dashboard, and to send you product/transactional emails (e.g. “your audience finished processing”).

For aggregate insights:de-identified, aggregated patterns across all users’ data may be used to improve the shared model and may be licensed to research partners. Aggregates are subject to a minimum group size threshold so individual users cannot be back-derived.

We never use your data to train external general-purpose AI models without an additional explicit, separately-checked consent.

• Supabase — auth, application database, file storage.
• Vercel — application hosting, function execution.
• OpenRouter / model providers— used to run the agent generation models. Inputs sent to providers are anonymized persona prompts; we never include your connections’ raw names, emails, or message content in any model call.

Your account, audiences, and personas persist for as long as your account is active. If you request deletion (below), we delete your account, your audiences, your personas, and your simulations within 30 days, and propagate the deletion to backups within the next rolling backup cycle.

Aggregated statistics derived prior to your deletion request may persist — they are not traceable to you individually.

You have the right to access the data we hold about you, correct it, export it, and delete it. In the EU/UK you also have the right to object to certain processing and to lodge a complaint with your local data protection authority.

For any of these requests email luke@atharias.dev and we will action it within 30 days.

You can request deletion at any time. This will mark your account for deletion, immediately revoke access, and delete your audiences, personas, and simulations within 30 days.

Privacy questions: luke@atharias.dev.