LEGAL DOCUMENTS
Last Updated: February 2026
Part I: Terms of Service
Part II: Privacy Policy
PART I: TERMS OF SERVICE
1. Introduction
Welcome to 360 Feedback AI ("the Service"), a platform operated by Timshel France, a Société par actions simplifiée (SAS) ("we," "us," or "our") based in Paris, France, and subject to the rules of the European Union, notably its privacy law, the General Data Protection Regulation (GDPR).
These Terms govern the relationship between Timshel France and the organizations and individuals who use the Service. By accessing or using the Service, you agree to be bound by these Terms. If you do not agree, do not use the Service.
2. Definitions
- "Customer": The organization (company, firm, or other legal entity) that purchases access to the Service for its employees or team members. The Customer is represented by an authorized administrator ("Administrator").
- "Administrator": The individual(s) authorized by the Customer to manage the Service on behalf of the organization — including configuring 360 cycles, selecting participants, and managing billing and access settings.
- "User": An employee or team member of the Customer who is the subject of a 360 feedback report.
- "Input Provider": An individual invited to participate in a voice interview to provide feedback on a User. Input Providers may be internal (employees of the Customer) or external (individuals outside the Customer's organization, such as clients, board members, or advisors).
3. Account Registration & Customer Responsibilities
To use the Service, the Customer must register for an organizational account through an authorized Administrator. The Administrator agrees to provide accurate, current, and complete information about the organization and is responsible for safeguarding account credentials and for all activities that occur under the Customer's account.
The Customer is responsible for ensuring that its use of the Service complies with applicable employment, data protection, and privacy laws within its jurisdiction.
4. Evaluation Period
The Customer may request one or more evaluation reports prior to committing to a full deployment. Evaluation reports are provided at Timshel France's discretion and are subject to these Terms in full. The purpose of evaluation reports is to allow the Customer to assess the quality and suitability of the Service before purchasing access for additional team members.
5. Input Provider Consent & The "Invitation Warranty"
This section addresses the legal obligations surrounding the invitation of individuals to provide feedback.
5.1 Internal Input Providers
When the Customer invites employees of its own organization to participate as Input Providers, the Customer warrants that:
- Employees have been informed about the 360 feedback program and its purpose.
- Employees understand that an AI will conduct a voice interview and that their feedback will be anonymized and synthesized into a report.
- Participation expectations have been clearly communicated.
- The Customer has the organizational authority to initiate this process under applicable employment and data protection laws.
5.2 External Input Providers
The Service may allow Users or Administrators to invite individuals outside the Customer's organization to participate as Input Providers (e.g., clients, board members, advisors, investors, or mentors). The Administrator may enable or restrict this capability at their discretion.
When an external Input Provider is added, the person who adds them (whether the User or the Administrator) represents and warrants that:
- They have a genuine personal or professional relationship with the individual.
- They have personally notified the individual that they will receive an invitation from 360 Feedback AI to participate in an AI voice interview.
- The individual has given their prior consent to be contacted for this purpose.
5.3 Indemnification
The Customer agrees to indemnify and hold Timshel France harmless from any claims, damages, or fines arising from failure to obtain proper consent from internal Input Providers. For external Input Providers, the person who added the specific individual (whether the User or the Administrator) bears responsibility for the warranty in Section 5.2, and the Customer agrees to ensure compliance with this obligation across its account.
5.4 Conduct
The Customer, its Administrators, and its Users agree not to use the Service to harass, intimidate, retaliate against, or solicit feedback for malicious purposes against any individual.
6. Input Providers
If you are an Input Provider (someone invited to give feedback):
- Your participation is entirely voluntary. You may decline or stop the interview at any time.
- By participating, you grant Timshel France a license to process your voice data and feedback to generate a Report for the User, as described in our Privacy Policy.
- Voice data is deleted immediately following the call. It is used only to produce a text transcript of your conversation.
- We make best efforts to anonymize your feedback (requiring a minimum of 2 Input Providers before generating a Report), but we cannot guarantee that the User will not deduce your identity based on the specific content of your answers. We advise Input Providers to phrase feedback with this in mind.
7. Fees and Payment
Fees: The Service is priced on a per-report basis. The Customer pays upon enrolling Users in the Service. Current pricing is described on our website.
Invoicing: For company purchases, we offer invoicing with standard payment terms. The Administrator is responsible for providing accurate billing information, including purchase order numbers if required by the Customer's internal processes.
No Refunds: Once input collection has begun or a Report has been generated for a User, the service for that User is considered rendered and no refund will be issued. If input collection has not yet begun for a specific User, the Customer may request cancellation and a credit toward future use.
8. AI Disclaimers & Limitations
The Service uses advanced Artificial Intelligence to conduct interviews and generate reports. By using the Service, the Customer and its Users acknowledge the following:
8.1 AI Accuracy
AI is not perfect. Reports are generated by machine learning models based on interview transcripts. We do not guarantee that any Report will be 100% accurate, error-free, or fully representative of the input provided.
8.2 No Professional Advice
Reports are for professional development purposes only. They do not constitute psychological, medical, legal, or binding HR advice. Reports should not be used as the sole basis for employment decisions, including hiring, firing, promotion, or compensation changes.
8.3 Feedback Outcomes Disclaimer
360-degree feedback, by its nature, can surface difficult truths. The Customer acknowledges that it has a responsibility to support its employees through the feedback process — including providing context, coaching, and a constructive environment in which to receive and act on feedback.
Timshel France is not liable for any emotional distress, professional conflicts, interpersonal issues, or adverse employment outcomes that arise from the content of a Report or from how feedback is received, interpreted, or acted upon within the Customer's organization.
8.4 Use of Anonymized Data
The Customer agrees that Timshel France may use the text transcripts and feedback data generated through the Service to create Anonymized Data. "Anonymized Data" means data that has been stripped of all direct identifiers (including names, emails, company names, and any information that could reasonably be used to identify an individual or organization) and aggregated such that it cannot be traced back to any specific person.
Timshel France shall own all rights, title, and interest in Anonymized Data and may use it for any lawful purpose, including but not limited to:
- Training and improving AI models;
- Benchmarking and statistical analysis;
- Developing new products and features.
Once data has been anonymized, it is no longer considered Personal Data and cannot be deleted, returned, or attributed.
Enterprise Opt-Out: Upon written request, Customers may opt out of having their organization's data used for AI model training. In such cases, data will still be anonymized per the retention schedule but will be excluded from training datasets. This opt-out does not affect data that has already been anonymized and incorporated into training sets prior to the request.
9. Data Access Hierarchy
This section defines who can access what data generated through the Service. This is a core element of our trust architecture and is designed to protect the candor that makes 360 feedback effective.
- Transcripts: Raw interview transcripts are never accessible to the Customer, the Administrator, or the User. Transcripts are an intermediate processing artifact used solely to generate Reports. They are retained per the schedule in our Privacy Policy for quality assurance purposes and are accessible only to authorized Timshel France technical personnel under strict confidentiality obligations.
- Reports: Each Report is delivered to the User. The Administrator may also receive access to individual Reports if the Customer has configured this visibility setting. The specific visibility configuration must be communicated to all participants (Users and Input Providers) before the 360 process begins.
- Aggregate Data: The Administrator may access aggregate and anonymized data about the 360 program, such as completion rates, participation metrics, and (where available) team-level theme summaries. Aggregate data never contains individually attributable feedback.
10. Report Ownership & Employee Data Portability
Report License: Users are granted a non-exclusive, perpetual license to use their Reports for personal and professional development purposes.
Employee Portability: If a User leaves the Customer's organization, they retain the right to access their own Reports. Users may create a personal account to maintain access to their development history independently of the Customer's organizational account. The Customer retains access to any Reports or aggregate data that were available to it during the User's employment.
Customer Access on Departure: When a User departs the organization, the Customer's access to that User's individual Reports (if such access was configured) is not automatically revoked for reports generated during the period of employment. The Customer acknowledges that these Reports contain feedback from third parties and agrees to use retained Reports only for legitimate internal purposes (such as succession planning or institutional knowledge), not for any purpose adverse to the departed employee.
11. Intellectual Property
Our IP: The 360 Feedback AI platform, AI agents, algorithms, code, and branding are owned by Timshel France.
Reports: Reports are generated by Timshel France's AI systems using input from third-party Input Providers. The User receives a license to use the Report as described in Section 10. Neither the Customer nor the User acquires ownership of the underlying AI systems, models, or methodologies used to generate Reports.
12. Term & Termination
Term: These Terms remain in effect for as long as the Customer maintains an active account.
Termination by Customer: The Customer may terminate its account at any time by notifying us at contact@360-feedback.ai.
Termination by Timshel France: We may suspend or terminate the Customer's access to the Service if we reasonably believe the Customer has violated these Terms, after providing notice and a reasonable opportunity to cure the violation (except in cases of egregious misuse, where immediate suspension may be necessary).
Effect of Termination:
- Upon termination, the Customer will have 30 days to export or download all Reports and aggregate data available to it.
- After the 30-day export period, the Customer's organizational data will be deleted from our active systems.
- Individual Users retain the right to access their own Reports by creating or transitioning to a personal account, as described in Section 10.
- Underlying transcripts and personal data will be handled according to the retention schedule in our Privacy Policy.
13. Limitation of Liability
To the fullest extent permitted by law, Timshel France shall not be liable for any indirect, incidental, special, or consequential damages arising out of or in connection with the Service, including but not limited to loss of profits, data, or business opportunity. Our total aggregate liability for any claim arising out of these Terms or the Service is limited to the total amount the Customer paid to Timshel France in the twelve (12) months preceding the claim.
14. Governing Law & Dispute Resolution
These Terms are governed by the laws of France.
Amicable Resolution: In the event of a dispute, we encourage the Customer to contact us at contact@360-feedback.ai to seek an amicable resolution first.
Jurisdiction: Any disputes not resolved amicably shall be submitted to the competent courts of Paris, France.
PART II: PRIVACY POLICY
1. Who We Are
The 360 Feedback AI platform ("the Service") is operated by Timshel France, a Société par actions simplifiée (SAS), based in Paris, France.
Data Protection Contact: contact@360-feedback.ai
2. Roles & Responsibilities Under Data Protection Law
When the Service is used by a Customer organization:
- The Customer is the Data Controller. The Customer determines the purposes and means of processing personal data — including which employees participate, who provides feedback, and how reports are used.
- Timshel France is the Data Processor. We process personal data strictly on behalf of and in accordance with the instructions of the Customer, as defined in these Terms and the Data Processing provisions below.
- Users (employees receiving feedback) and Input Providers (individuals giving feedback) are Data Subjects.
3. The Three Types of People in Our System
- Administrator: The person managing the Service on behalf of the Customer. They configure settings, manage participants, and may access Reports and aggregate data depending on configuration.
- User: The employee who is the subject of the feedback. They always receive their own Report.
- Input Provider: The individual who participates in a voice interview to provide feedback. Input Providers may be internal (employees of the Customer) or external (individuals outside the organization).
4. Information We Collect
A. From the Customer / Administrator
- Organization Data: Company name, billing information, and administrator contact details.
- Configuration Data: 360 cycle settings, participant lists, reviewer assignments, and visibility preferences.
B. From the User
- Account Data: Name, email, and role within the organization.
C. From the Input Provider
- Voice Data: We record voice responses during the feedback interview.
- Transcript Data: Voice responses are converted into text.
- Identity Data: Name, email, and relationship to the User (e.g., "Peer," "Manager," "Direct Report," "External — Client").
5. How We Process Voice Data
We use Artificial Intelligence to conduct interviews and transcribe responses. To protect privacy:
- Immediate Deletion: Raw audio recordings are permanently deleted from our servers and our sub-processors' servers immediately after the interview is transcribed into text. We do not retain audio.
- Real-Time Processing: We use third-party AI providers (currently ElevenLabs and Google Gemini) strictly to process the conversation in real time. Audio is not stored by these providers beyond the processing session.
6. Confidentiality & The Report
This section describes our core commitment to Input Providers.
- No Transcript Access: No one other than authorized Timshel France technical personnel ever sees raw transcripts — not the User, not the Administrator, not the Customer. Transcripts are used solely as an intermediate step to generate Reports.
- Report Content: The User receives a synthesized, anonymized Report. The Report contains themes, patterns, and anonymized examples drawn from multiple interviews. It does not contain raw quotes attributed to specific individuals.
- Aggregation Threshold: To protect anonymity, we will not generate a Report unless input has been received from at least 2 (two) Input Providers.
- Re-identification Disclaimer: While we use AI to sanitize feedback and remove obvious identifiers, we cannot guarantee total anonymity. If an Input Provider shares very specific anecdotes or details, the User may be able to infer who provided that feedback. We advise Input Providers to keep this in mind.
7. Report Visibility
Report visibility is configured by the Administrator before the 360 process begins:
- User Access (always on): The User always receives and retains access to their own Report.
- Administrator Access (configurable): The Administrator may configure whether they also receive access to individual User Reports. If this setting is enabled, it must be communicated to all participants (Users and Input Providers) before the process begins, so that Input Providers can make an informed decision about participation.
- Aggregate Data (always available to Administrator): Completion rates, participation metrics, and team-level summaries (where available) are accessible to the Administrator. Aggregate data is never individually attributable.
8. Anonymized Data & Service Improvement
We use anonymized transcript data to improve our Service. Specifically:
- We strip all direct identifiers (names, emails, company names, specific contextual details) from transcripts to create Anonymized Data.
- Once anonymized, this data is no longer considered Personal Data under applicable law.
- We use Anonymized Data to improve the accuracy of our AI models, analyze usage trends, and develop new product features.
- Customers may opt out of AI model training by submitting a written request to contact@360-feedback.ai. See Terms of Service Section 8.4 for details.
9. How We Share Data (Sub-Processors)
We do not sell personal data. We share data only with the technical infrastructure required to operate the Service. Our current sub-processors are:
| Provider | Purpose | Location |
|---|---|---|
| ElevenLabs | Voice Synthesis & Processing | US/EU |
| AI Reasoning & Transcription; OAuth Authentication | US | |
| OpenRouter | AI Reasoning & Model Access | US |
| Stripe | Payment Processing | US |
| Resend | Transactional Email Delivery | US |
| Twilio | SMS/Phone Verification | US |
| Sentry | Error Monitoring & Debugging | US |
| Vercel | Application Hosting & Serverless Functions | US (AWS infrastructure) |
| Supabase | Database & Backend Services | US |
Since some of these providers are based in the United States, we rely on Standard Contractual Clauses (SCCs) and, where applicable, additional safeguards to ensure personal data is protected to GDPR standards during international transfers.
We will update this list if we add or change sub-processors. Customers may subscribe to notifications of sub-processor changes by contacting us at contact@360-feedback.ai.
10. Data Retention
- Raw Audio: Permanently deleted immediately after transcription. Never retained.
- Transcripts: Retained for up to 12 months for quality assurance and report generation purposes, then permanently deleted or anonymized.
- Reports: Retained as long as the User maintains an active account (whether organizational or personal).
- Account & Billing Data: Retained for the duration of the Customer relationship plus any legally required retention period.
- Anonymized Data: Retained indefinitely. By definition, Anonymized Data cannot be traced to any individual and is not subject to deletion requests.
11. Your Rights as a Data Subject
Regardless of your location, Users and Input Providers have the following rights:
- Right to Access: You may request a copy of the personal data we hold about you.
- Important Limitation: To protect the confidentiality of Input Providers, we will not disclose raw transcripts or un-anonymized feedback in response to any Access Request from any party. Users may access their Reports. Input Providers may access their own transcript data upon request.
- Right to Deletion: You may request that we delete your personal data.
- Note for Input Providers: If you request deletion after a Report has already been generated and delivered, we cannot retract the Report, but we will delete your underlying transcript from our systems.
- Note for Users: Deleting your account will remove your personal data from our active systems. Reports that have already been shared with Administrators under the configured visibility settings cannot be retroactively withdrawn.
- Right to Rectification: You may request correction of inaccurate personal information.
- Right to Data Portability: Users may request an export of their Reports in a commonly used, machine-readable format.
To exercise any of these rights, contact us at contact@360-feedback.ai.
12. Data Processing Provisions
This section constitutes the data processing terms between the Customer (Data Controller) and Timshel France (Data Processor) as required under GDPR Article 28.
12.1 Scope of Processing
Timshel France processes personal data solely for the purpose of providing the Service as described in these Terms — namely, conducting AI voice interviews with Input Providers, generating transcripts, producing Reports for Users, and providing aggregate data to Administrators.
12.2 Categories of Data Subjects
- Employees of the Customer (as Users and/or Internal Input Providers)
- External individuals invited by the Customer's Users or Administrators (as External Input Providers)
12.3 Types of Personal Data Processed
- Contact information (name, email)
- Voice recordings (processed in real time, not retained)
- Text transcripts of voice interviews
- Relationship metadata (role, relationship to User)
- Feedback content and synthesized Reports
12.4 Processor Obligations
Timshel France shall:
- Process personal data only on documented instructions from the Customer, unless required by applicable law;
- Ensure that persons authorized to process personal data have committed to confidentiality;
- Implement appropriate technical and organizational security measures, including encryption of data in transit and at rest;
- Not engage another processor without prior written authorization from the Customer (the sub-processor list in Section 9 constitutes such authorization; changes will be communicated to allow objection);
- Assist the Customer in fulfilling its obligations to respond to Data Subject rights requests;
- Notify the Customer without undue delay (and in any event within 72 hours) upon becoming aware of a personal data breach;
- At the Customer's choice, delete or return all personal data upon termination of the Service, subject to the retention periods described in Section 10 and the User's right to data portability;
- Make available to the Customer all information necessary to demonstrate compliance with these processing obligations, and allow for and contribute to audits conducted by the Customer or an auditor mandated by the Customer, upon reasonable notice.
12.5 International Transfers
Where personal data is transferred outside the European Economic Area (EEA), Timshel France ensures that adequate safeguards are in place, including Standard Contractual Clauses (SCCs) with all relevant sub-processors.
13. Cookies & Tracking
We use minimal cookies strictly necessary for the Service to function (e.g., authentication and session management). We do not use third-party advertising cookies or tracking pixels for ad targeting.
14. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify Customers via email or through the Service. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.