Business Privacy Policy

This Business Privacy Policy explains how InnerFrame LLC("InnerFrame," "we," "us") handles personal data in connection with the InnerFrame business platform (the "Service"). It is written for our business customers and for the individuals those customers assess.

1. Our roles: controller and processor

Privacy law assigns responsibilities based on who decides how data is used.

• Customer (employee) data — we are a processor. When an organization ("Customer") uses the Service to assess and manage its people, the Customer is the controller of that personal data and decides how it is used. InnerFrame acts as a processor, handling that data on the Customer's documented instructions under our Data Processing Agreement ("DPA").
• Account, billing, and website data — we are the controller. For the information we use to run our business — administrator and billing contacts, support requests, and general website/visitor data — InnerFrame is the controller, and this policy describes those practices.

2. What we process

Customer (employee) data — processed on the Customer's behalf

• Participant name and email (as provided by the Customer or entered during the assessment)
• Assessment answers, selected words, tie-breakers, the computed 7-letter frame code, flexibility score, and axis calculations
• Profile content, IMPACT goals, one-on-one records, direct-report relationships, department and position
• Frame Bot conversations and AI-generated insights, including AI call metadata (model, token counts) used for cost and abuse monitoring
• Account login data for people the Customer activates (password hash managed by Supabase Auth; account creation and last sign-in time)

Account, billing, and technical data — we control

• Administrator and billing contact details, and your plan and subscription status
• Payment identifiers from Stripe (we never see or store card details — those go directly to Stripe)
• IP address for rate limiting (retained briefly), plus standard server logs from our hosting provider
• An essential session cookie (Supabase Auth) to keep signed-in users authenticated

We do not use advertising cookies, tracking pixels, or cross-site behavioral profiling.

3. How we use data

• To provide the Service to the Customer — computing profiles, running Frame Bot, generating insights, and enabling manager/team views — on the Customer's instructions.
• To manage billing and the account via Stripe.
• To send transactional messages — invitations, password resets, and account notifications. We don't send marketing email without consent.
• To secure the Service and prevent abuse — rate limiting, fraud and abuse detection, debugging, and error monitoring.
• To improve the Service using aggregated, de-identified data only. We do not use Customer employee data to train third-party AI models.
• To comply with law and respond to lawful requests.

4. Subprocessors

We share data with vetted service providers ("subprocessors"), each contractually required to protect it and use it only to provide services to us:

• Supabase — database, authentication, and storage (United States)
• Vercel — web hosting and serverless functions (global edge)
• OpenAI — AI insights and Frame Bot replies; receives relevant assessment data and chat messages as prompt context (United States). Does not train on data sent via its API.
• Resend — transactional email delivery (United States)
• Stripe — payment processing and subscription management (United States)

We maintain a current subprocessor list in the DPA and will notify Customers of new subprocessors as described there. We do not sell personal data or share it with advertisers.

5. Where data is stored and international transfers

Data is stored primarily in the United States. If you or your people are located outside the US, data may be transferred to and processed in the US. For personal data subject to EU/UK law, we rely on Standard Contractual Clauses, incorporated through the DPA.

6. Retention

• While active: we retain Customer Data for as long as the Customer's account is active and the Service is being provided.
• After termination: we delete or return Customer Data per the DPA after the post-termination export window, subject to legally required retention (e.g., financial records kept for up to 7 years).
• Operational logs: IP-based rate-limit rows are pruned within 24 hours; AI usage metadata is retained while the account is active for cost and abuse monitoring.

7. Rights of individuals

Because the Customer (employer) is the controller of employee data, individuals should direct requests to access, correct, delete, export, or object to the processing of their assessment data to their employer. When a Customer asks us to, we assist them in responding to those requests as required by the DPA. If you contact us directly at innerframetests@gmail.com, we will route your request to the relevant Customer and help where we can.

For data we control (administrator/billing contacts), you may contact us at the address above to exercise your rights. EU/UK individuals may complain to their local data-protection authority; California residents may contact the California Privacy Protection Agency.

8. AI processing of people data

9. Security

We protect data with industry-standard measures, including:

• HTTPS encryption in transit for every connection
• Row Level Security in the database — tables enforce access at the database layer, and service-side routes scope access to the caller's own company
• Secret keys (Stripe, OpenAI, Resend, service credentials) stored server-side only, never shipped to the client
• Rate limiting and abuse detection on sensitive endpoints
• Regular dependency audits and code review

No system is perfectly secure, but we work to protect your data and to respond quickly if something goes wrong (see next section).

10. Breach notification

If we become aware of a personal-data breach affecting Customer Data, we will notify the affected Customer (controller) without undue delay so the Customer can meet its own notification obligations, and we will assist as described in the DPA. For data we control, we will notify affected individuals and regulators as required by law.

11. Changes

We may update this policy as the Service or the law evolves. For material changes we'll update the "Last updated" date and notify account administrators by email or in-app notice.

12. Contact

Privacy questions and requests: innerframetests@gmail.com. Security reports: innerframetests@gmail.com. InnerFrame LLC.