Privacy policy

The information we collect depends on how you use Aloud. It may include:

We use information to provide and authenticate the service; run, analyze, and deliver studies; store and display evidence and reports; administer workspaces; process billing; provide support; protect Aloud and its users; diagnose failures; improve product reliability and usability; and comply with legal obligations.

Depending on the context and where you live, our legal basis may be performance of a contract, our legitimate interests in operating and securing Aloud, consent where required, or compliance with law. We do not use customer study data for third-party advertising, and we do not sell personal information for money.

Aloud uses AI models to simulate participants, interpret screenshots, judge outcomes, and synthesize findings. The current model providers are Google (Gemini) and OpenAI. Screenshots and the study or session context needed for a model task may be sent to one or both providers. Provider API credentials and runner access tokens are not included in model prompts.

Do not place real payment details, production credentials, health information, government identifiers, or other unnecessary sensitive information in a tested flow. Prefer staging data and scoped test accounts. Our providers process submitted data under their own service terms and our agreements with them; Aloud does not promise that a provider will handle data under terms different from those agreements.

When product analytics is enabled, Aloud uses PostHog to understand a small set of reviewed funnel events. Aloud identifies events using internal user and workspace identifiers. Event properties may include device type, participant count, environment type, plan option, and whether a workflow was blocked or started.

Aloud disables PostHog autocapture, session recording, heatmaps, performance capture, automatic exception capture, and automatic pageview capture. It does not send DOM text, form values, screenshots, email addresses, workspace names, full object URLs, or referrers as product analytics event properties. PostHog may still receive ordinary connection metadata such as an IP address and user agent when an event is delivered.

Aloud also uses the Google tag to measure visits and completed Stripe Checkouts attributable to Google Ads. A conversion includes the Checkout Session identifier for deduplication, the amount and currency for a completed payment, or a nominal one-dollar value when a card-backed free trial starts. For a verified Checkout with a United States billing country, Aloud may also send Google a normalized, one-way SHA-256 hash of the Checkout email address for enhanced conversion matching. Google uses that hash to match the conversion to a signed-in Google account that interacted with an ad. Aloud does not send the plain email address through this tag, does not enable advertising personalization, and does not use this data to build advertising audiences.

Aloud uses cookies or similar browser storage for authentication, security, preferences, and, when enabled, product analytics. Blocking essential storage may prevent sign-in or other parts of the service from working.

You can turn non-essential product analytics and advertising measurement off or back on for this browser using the control below. Aloud stores that preference in this browser and also treats an active Global Privacy Control or Do Not Track signal as an analytics opt-out. This control does not disable storage needed for authentication, security, or core application features.

We disclose information only as needed to operate Aloud, follow customer instructions, complete a transaction, protect people and the service, or comply with law. Current service providers include:

People in a workspace may access customer data according to their role. Customers may also create tokenized report links for people outside the workspace. Anyone who receives an active share link may be able to view its report, so customers should share it carefully and revoke it when it is no longer needed. Share links can expire or be revoked and are excluded from search indexing.

Study evidence is governed by the workspace retention setting, which defaults to 90 days. A workspace owner can also delete a run or study; Aloud revokes related share access and removes associated evidence through its deletion workflow. Deletion from active systems may take time to complete.

We may retain account, billing, security, audit, and support records for longer when needed to operate the service, resolve disputes, prevent abuse, meet accounting requirements, or comply with law. We keep information only for as long as reasonably necessary for those purposes.

We use technical and organizational safeguards intended to protect customer data. No online service can guarantee absolute security. More detail is available on the Security page.

Aloud and its providers may process information in the United States and other countries. Those countries may have data-protection rules different from the rules where you live. Where required, we use contractual or other approved safeguards for transfers.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information; object to or restrict certain processing; withdraw consent; or appeal a decision about a request. You may also have the right to complain to a local data-protection authority.

To make a request, email us from the address connected to your account. We may need to verify your identity and authority. If your information was submitted by an Aloud customer as part of a study, we may direct your request to that customer.

Aloud is a business service and is not directed to children under 13. Do not use Aloud to intentionally collect children's personal information without all required permission and safeguards.

We may update this policy as Aloud changes. We will update the effective date on this page and provide additional notice when a change is material and the law requires it.

Contact Off Script Foundry with privacy questions, data requests, or requests for a data-processing agreement using the email shown on this page.