LEGAL DOCUMENTS

1. Who We Are

The 360 Feedback AI platform ("the Service") is operated by Timshel France, a Société par actions simplifiée (SAS), based in Paris, France.

Data Protection Contact: contact@360-feedback.ai

2. Roles & Responsibilities Under Data Protection Law

The role each party plays under the GDPR depends on how the Service is being used.

2.1 — A Coach uses the Service on behalf of a Coachee (the most common case). The Coach decides which Coachee will be the subject of the round, who will be invited as Raters, and how the resulting Report will be used. The Coach is therefore the Data Controller for the Coachee's and Raters' personal data processed in connection with the round. Timshel France acts as a Data Processor under Article 28 of the GDPR, on the Coach's documented instructions. The Coach must ensure their own privacy notice covers their Coachee and Raters.

2.2 — A Coach uses the Service for self-evaluation. Where a Coach uses the Service to receive a Report about themselves, Timshel France is the Data Controller for the Coach's account data and Report. The Coach is the Data Controller for the Raters they invite.

2.3 — A coaching firm or organisation purchases multiple seats. The purchasing organisation is the Data Controller; Timshel France is the Data Processor.

In all scenarios, Timshel France acts as Data Controller for: account creation and authentication, billing and tax records, security and fraud prevention, error monitoring, and product analytics (where consent has been given).

3. The Three Types of People in Our System

• Coach: The professional who buys and operates the Service.
• Coachee: The individual who is the subject of the feedback round (the Coach's client).
• Rater: The individual who participates in a voice interview to provide feedback about the Coachee. Raters are typically the Coachee's colleagues, managers, direct reports, or external stakeholders.

4. Information We Collect

A. From the Coach

• Account Data: Coach name, email, phone number, and billing details.
• Configuration Data: round settings, Coachee identity, Rater list, and visibility preferences.

B. About the Coachee

• Identity Data: Name, email, and (where provided) role or context for the engagement.

C. From the Rater

• Voice Data: We record voice responses during the feedback interview.
• Transcript Data: Voice responses are converted into text.
• Identity Data: Name, email, and relationship to the Coachee (e.g., "Peer," "Manager," "Direct Report," "External — Client").

5. How We Process Voice Data

Voice interviews are conducted by an AI agent provided by our voice-AI sub-processor, ElevenLabs. The conversation is recorded, transcribed into text, and the resulting transcript is used to generate a feedback Report.

• Audio retention: raw audio recordings are retained by ElevenLabs in accordance with their default retention policy (30 days at the time of writing). We do not currently override this default. We do not download or store audio on our own servers — only the text transcript.
• Transcript retention: the text transcript is stored as part of your Report record on our database (operated by Supabase, US region) and is retained for the duration of the Coach's account, unless deletion is requested.
• No voiceprint extraction: we do not extract or store biometric voiceprints. Your voice is processed only to produce a text transcript and is not used to identify you in any other context.
• Withdraw consent: you may withdraw consent at any time by emailing contact@360-feedback.ai with the email address that received your interview invitation. Withdrawal does not affect any Report that has already been generated.

6. Confidentiality & The Report

This section describes our core commitment to Raters.

• No Transcript Access for the Coachee: Coaches receive the synthesized Report and may also access the underlying transcript on request. We require that Coaches do not share transcripts with the Coachee. The Coachee receives only the synthesized Report.
• Report Content: The Report contains themes, patterns, and quoted examples drawn from multiple interviews. Quotes are not attributed to specific Raters and are reviewed for identifying detail before inclusion.
• Aggregation Threshold: To protect anonymity, we will not generate a Report unless input has been received from at least 2 (two) Raters.
• Re-identification Disclaimer: While we use AI to sanitize feedback and remove obvious identifiers, we cannot guarantee total anonymity. If a Rater shares very specific anecdotes or details, the Coachee may be able to infer who provided that feedback. We advise Raters to keep this in mind.

7. Report Visibility

Reports are delivered to the Coach who set up the round:

• Coach Access (always on): The Coach receives the Report once it has been generated and may share it with the Coachee at their discretion.
• Coachee Access (when shared by Coach): The Coachee receives the Report only when the Coach chooses to share it. Raters are informed at the start of the interview that their feedback will be synthesized into a Report delivered to the Coach.
• Round Metrics: Completion rates and participation metrics are visible to the Coach in their dashboard. These metrics are never individually attributable to a single Rater.

8. Anonymized Data & Service Improvement

We use anonymized transcript data to improve our Service. Specifically:

• We strip all direct identifiers (names, emails, company names, specific contextual details) from transcripts to create Anonymized Data.
• Once anonymized, this data is no longer considered Personal Data under applicable law.
• We use Anonymized Data to improve the accuracy of our AI models, analyze usage trends, and develop new product features.
• Customers may opt out of AI model training by submitting a written request to contact@360-feedback.ai. See Terms of Service Section 8.4 for details.

9. How We Share Data (Sub-Processors)

We do not sell personal data. We share data only with the technical infrastructure required to operate the Service. Our current sub-processors are:

Where a sub-processor is based in the United States, we rely on Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework, to safeguard personal data in line with GDPR requirements. Coaches may request copies of the relevant Data Processing Agreements at contact@360-feedback.ai.

We will update this list if we add or change sub-processors. Coaches may subscribe to notifications of sub-processor changes by contacting us at contact@360-feedback.ai.

10. Data Retention

• Raw audio: held by ElevenLabs per their default retention policy (currently 30 days). We do not download or store audio ourselves.
• Transcripts: stored as part of the Report record for the duration of the Coach's account. Deletion available on request.
• Reports (PDF + JSON): stored for the duration of the Coach's account. Deletion available on request.
• Coach account: retained until deletion is requested by the Coach. Deletion is currently handled manually via contact@360-feedback.ai.
• Billing & invoice records: 10 years (French Code de Commerce L.123-22).
• Email logs: retained for the duration of the Coach's account, for deliverability tracking.
• Audit logs (admin actions): retained for security forensics during operations.
• Phone verification codes: cleared shortly after expiry.
• Anonymized Data: retained indefinitely. By definition, Anonymized Data cannot be traced to any individual and is not subject to deletion requests. See Section 8.

Coaches and Raters may request deletion of personal data at any time by emailing contact@360-feedback.ai. We will action requests within 30 days of receipt.

11. Your Rights as a Data Subject

Regardless of your location, Coaches, Coachees, and Raters have the following rights under the GDPR:

• Right to Access: You may request a copy of the personal data we hold about you.
  • Important Limitation: To protect the confidentiality of Raters, we will not disclose raw transcripts or un-anonymized feedback in response to any Access Request from any party. Coachees may access their Reports. Raters may access their own transcript data upon request.
• Right to Deletion: You may request that we delete your personal data.
  • Note for Raters: If you request deletion after a Report has already been generated and delivered, we cannot retract the Report, but we will delete your underlying transcript from our systems.
  • Note for Coaches: Deleting your account will remove your personal data from our active systems. Reports that have already been delivered to Coachees cannot be retroactively withdrawn.
• Right to Rectification: You may request correction of inaccurate personal information.
• Right to Data Portability: You may request a machine-readable copy of personal data you have provided to us.
• Right to Object: You may object to processing based on legitimate interests, including marketing emails (use the unsubscribe link in any marketing email).
• Right to Restriction: You may request that we suspend processing of your personal data while a dispute is being investigated.
• Right to Withdraw Consent: Where processing is based on consent (voice interview, marketing analytics, ad cookies), you may withdraw consent at any time. Withdrawal does not affect processing that has already occurred.
• Right to Lodge a Complaint: You may lodge a complaint with your local data protection supervisory authority. In France, this is the CNIL ( cnil.fr). In the UK, the ICO ( ico.org.uk).
• Automated Decision-Making (Art. 22): Reports are generated by AI and are intended as input to a human-led coaching engagement. The Service does not make automated decisions producing legal effects about any individual.

To exercise any of these rights, contact us at contact@360-feedback.ai.

12. Data Processing Provisions

Where the Coach acts as Data Controller (per Section 2 above), this section constitutes the data processing terms between the Coach (Data Controller) and Timshel France (Data Processor) as required under GDPR Article 28. A standalone Data Processing Agreement is available on request.

12.1 Scope of Processing

Timshel France processes personal data solely for the purpose of providing the Service as described in these Terms — namely, conducting AI voice interviews with Raters, generating transcripts, and producing Reports for the Coach.

12.2 Categories of Data Subjects

• The Coachee (the subject of the feedback round)
• Raters (individuals invited by the Coach to provide feedback about the Coachee)

12.3 Types of Personal Data Processed

• Contact information (name, email)
• Voice recordings (held by ElevenLabs per their default retention policy; see Section 5)
• Text transcripts of voice interviews
• Relationship metadata (role, relationship to Coachee)
• Feedback content and synthesized Reports

12.4 Processor Obligations

Timshel France shall:

• Process personal data only on documented instructions from the Coach, unless required by applicable law;
• Ensure that persons authorized to process personal data have committed to confidentiality;
• Implement appropriate technical and organizational security measures, including encryption of data in transit and at rest;
• Not engage another processor without prior written authorization from the Coach (the sub-processor list in Section 9 constitutes such authorization; changes will be communicated to allow objection);
• Assist the Coach in fulfilling its obligations to respond to Data Subject rights requests;
• Notify the Coach without undue delay (and in any event within 72 hours) upon becoming aware of a personal data breach;
• At the Coach's choice, delete or return all personal data upon termination of the Service, subject to the retention periods described in Section 10;
• Make available to the Coach all information necessary to demonstrate compliance with these processing obligations, upon reasonable notice.

12.5 International Transfers

Where personal data is transferred outside the European Economic Area (EEA), Timshel France ensures that adequate safeguards are in place, including Standard Contractual Clauses (SCCs) with all relevant sub-processors.

13. Cookies & Tracking

We use cookies and similar technologies in three categories:

• Strictly necessary (no consent required): authentication session, security, and your cookie-consent preference. We also run Sentry error monitoring on the basis of legitimate interest.
• Analytics (consent required for EU/EEA/UK visitors): we use PostHog to understand how visitors use the site so we can improve it.
• Marketing (consent required for EU/EEA/UK visitors): we use Meta Pixel and Meta Conversions API to measure the effectiveness of our advertising. Data is shared with Meta Platforms Ireland Ltd.

EU/EEA/UK visitors are shown a consent banner on first visit. You can change your preferences at any time via the Cookie settings link in the footer. Non-EU visitors see no banner; we treat consent as implied per the applicable jurisdiction's rules.