Privacy Policy

1. Overview

Offboard.tech helps merchants understand why customers cancel by conducting anonymous AI exit interviews. This policy describes what we collect from merchants and from interview participants, and how we protect it.

2. Data We Collect

Merchant accounts: email address and name (via Google sign-in or magic link), workspace configuration, billing details processed by Polar, and webhook/redirect URLs you provide.

Interview participants: conversation content typed into an exit interview and arbitrary URL parameters on the interview link (e.g. plan, value) set by the merchant. Interviews are anonymous by design — participants are not asked for an account.

3. PII Scrubbing

Before any interview content is stored, it passes through a two-stage scrubbing pipeline: a regex pre-pass that strips emails, phone numbers, URLs, and common ID formats, followed by an AI pass that replaces remaining names and identifiers with [REDACTED]. Raw transcripts are never written to our database — only the redacted summary.

4. No Tracking

We do not use analytics cookies, advertising trackers, or fingerprinting on interview pages. The only cookies set are the session cookies required for merchant authentication.

5. Subprocessors

We use Supabase (database and authentication), OpenRouter (AI inference for interviews and summaries), Polar (payment processing), and Vercel (hosting). Interview content sent to AI providers is the scrubbed text described above.

6. Your Rights

Merchants can exercise GDPR rights directly from Dashboard → Account: download a full export of account data (Art. 20) or delete the account and all owned data (Art. 17). Account deletion permanently removes workspaces, interviews, billing records, and webhook history.

7. Data Sharing

We do not sell data. Interview summaries are shared with the merchant who owns the workspace and forwarded to webhook destinations they configure. Interview content is never shared between merchants.

8. Contact

Questions about this policy or data requests can be sent to the contact address listed on our website. We respond to verified requests within 30 days.