Pointed Privacy Policy

The customer commissioning an interview generally decides its purpose and use and acts as controller or equivalent business. Pointed processes that customer’s contact details and interview content on its behalf under our agreement. The customer’s privacy notice also applies. The participant notice identifies the organizing company and intended use.

Pointed is responsible for its own account administration, website operations, security, business inquiries, and Pointed-commissioned demos. A demo hosted for a customer may instead be controlled by that customer. The product being discussed is not automatically the organizer. We assist customers with rights requests for information held on their behalf and respond directly for our own processing.

Account and business information: names, work email, employer and role, authentication and organization identifiers, permissions, account preferences, plan/usage and commercial records, communications, and connected-tool authorization and activity. Our authentication provider handles sign-in credentials. For paid plans, Stripe processes information entered into its hosted payment flow; Pointed processes billing identifiers, subscription and invoice information, and payment status needed to administer the plan.

Customer-provided information: contact lists, job titles, company details, interview instructions, product/business context, workspace conversations, documents, images, brand assets, and tool requests/results. Customers may supply information about other people. Business context may also come from public websites or enrichment providers, which may receive relevant company or business-contact search identifiers.

Interview information: video/audio where captured, spoken or typed answers, transcript turns and timing, participation/completion state, summaries, themes, sentiment, quotes, clips, generated media, and other derived analysis. We process invitation/session identifiers, permission choices and evidence, device and connection diagnostics, and recording/upload status.

Phone information, where enabled: the requested number, appointment time/timezone, call and recording permission, connection/outcome details, audio, transcript and analysis. Results may be sent to the invitation email as explained before participation. A requested interview call is separate from marketing permission.

Demo and results information: a public browser demo may begin without a name/email form, but its recording can identify you. Recipient-specific invitations contain contact information. Optional results email or booking collects the information needed for that request. Demos are not anonymous merely because no login is needed.

Technical information: device/browser data, IP addresses, requests, sessions, service interactions, and diagnostics used for hosting, security and delivery. Some application abuse controls store keyed IP/email digests instead of raw addresses. This does not mean providers never process raw IP addresses. PostHog receives structured page and interaction events, technical status, and pseudonymous or session identifiers from dashboard and interview pages. We do not send names, email addresses, interview recordings, answers, transcripts, generated stories or prompts to PostHog, and we do not use session replay.

Do not submit passwords, payment-card details, government identifiers, protected health information, or unnecessary sensitive information in interviews or customer content. Enter payment details only through the designated payment flow. Avoid recording others or disclosing confidential material without authority. Interviews are for adults in a business context.

Interviews use an automated AI interviewer. Depending on the mode, providers process audio or text during the conversation to transcribe answers, generate questions, or produce speech. Browser video interviews record camera and microphone input; reading questions silently does not disable recording. Browser audio interviews record microphone audio without camera video. Phone mode, where enabled, records audio.

Before an interview begins, the participation notice identifies the organizer, capture mode, purposes, recipients, and choices. You can decline or stop. Stopping prevents new capture; it does not erase information already saved or undo processing already performed. A request to delete information is handled separately under Section 9.

AI transcripts, summaries and edited outputs may contain errors or omit context. Our Terms prohibit using interview content for employment, credit, insurance, housing or similarly significant decisions about participants, or inferring emotions from their face or voice.

Authorized personnel and providers may review interview content and technical traces to support delivery, investigate faults and evaluate interview quality. Configured evaluation can process identifiable transcripts and participant labels. Operational Slack notifications are limited to review metadata and access-controlled links; they do not include full transcripts. Customer-content evaluation must stay within documented instructions and agreed processing terms.

Neither Pointed nor its providers may use customer or participant data to train or fine-tune AI models. Running a model to conduct, transcribe, summarize or evaluate an interview is different from training and remains limited to the stated purposes. The required provider data-use restrictions must be established in the applicable agreements and settings before processing begins. Information about configured provider roles is at /subprocessors.

We use information to administer accounts, billing and permissions; send permitted customer interview invitations/reminders; run interviews and generate requested outputs; deliver requested results, calls or bookings; provide support and service/security communications; prevent abuse and diagnose failures; evaluate operational quality; understand dashboard and interview-page usage through the limited PostHog analytics described here; comply with law; and establish or defend legal claims.

Taking an interview, requesting results or a call, or submitting a contact form does not subscribe you to marketing. Any separately offered marketing program must identify its purpose and unsubscribe method. The narrower contact-form limits in Section 13 control those request details.

The organizing customer receives recordings, answers, transcripts, results and participation information. Under our standard Terms, use and sharing are limited to inside that customer’s organization unless you grant broader permission in an independent agreement with that customer. This does not automatically permit sharing with your employer or other outside recipients. Public testimonials, advertising, case studies, social media and other publication require a separate written agreement between you and the customer. Recording consent is never automatic publication clearance. Any separately requested delivery of your own results is explained for that purpose and does not grant general external-sharing rights.

Authorized Pointed personnel and providers receive information needed for hosting/storage, authentication, payments, live communication, media, transcription, AI, quality review, limited behavior analytics, email, scheduling, enrichment and managed execution. The providers that can be involved in each feature are described at /subprocessors. Provider use varies with configuration; not every provider receives every interview.

Customers can export materials or send them to authorized connected tools. Those recipient-controlled copies have their own handling. Some demo results are accessed through a secret, time-limited link: anyone holding a valid link may be able to see them. Protect the link and share it only with intended recipients.

We may disclose information when reasonably necessary to comply with law, protect rights and safety, establish or defend claims, or at your direction. Information may be transferred in a merger, financing, reorganization or sale, subject to applicable privacy and confidentiality obligations.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising.

We use cookies and similar technologies for sign-in, security, preferences, service operation and the limited PostHog behavior analytics described in Section 2. Analytics runs on dashboard and interview pages using structured events and pseudonymous or session identifiers, without interview content or session replay. This processing is disclosed in the customer Terms and participant notices. Participants do not become parties to the customer business agreement. Your applicable privacy rights remain available as described in Section 9. We do not use advertising cookies.

Browser interviews can temporarily store media and transcripts on your device to recover interrupted uploads. Failed or incomplete uploads may leave recovery copies. Cleanup runs when the application can run and must protect active uploads; closing the tab does not guarantee deletion. Browser site-data controls can remove local copies, including uploads that have not finished, but do not delete server or recipient copies. Blocking essential storage may prevent sign-in or recovery.

Saved interviews, recordings, transcripts, stories and other saved customer outputs are retained until authorized deletion, including deletion through an agreed account-closure process, subject to applicable legal requirements. Saved demo interviews and product content generated by Pointed administrators also have no automatic expiry. They remain subject to deliberate authorized deletion and applicable rights requests. Subscription cancellation, allowance expiry or closing a browser tab does not itself delete saved content.

Temporary operational traces and quality-review copies are scheduled for removal 30 days after interview completion, without deleting the saved source interview, recording, transcript, story or other customer output. Active processing and justified legal holds can delay cleanup. Provider failures are retried; eligibility is not a promise that every provider copy vanishes at that instant. Temporary failed or unsaved processing artifacts are kept only as needed to complete or recover the requested work, investigate a failure or satisfy a legal obligation; saved partial interviews follow the saved-content rule above.

Demo results links expire seven days after the link is issued when the demo run starts, and can be revoked earlier. Viewing a link does not extend its lifetime. A link’s expiry does not delete the saved content it accesses; deletion invalidates access. Browser recovery data is removed after verified upload or appropriate cleanup when that browser runs; offline devices cannot be remotely purged on a fixed elapsed-time deadline.

Contact-request information is retained as needed to review and respond to the request, honor contact preferences, prevent abuse and meet applicable legal requirements. Becoming a customer creates separate account records; it does not change the original request’s limited purpose.

Account and commercial records, permission and withdrawal evidence, security/audit records, privacy-request records and temporary editing workspaces are retained for the period reasonably necessary for their respective purposes. We consider the account relationship, outstanding work or requests, the need to establish permissions or resolve disputes, the sensitivity of the information, and applicable legal or accounting requirements. When no longer needed for those purposes, information is deleted or de-identified where appropriate. Retention required by law takes precedence.

We coordinate authorized deletion across the application and relevant providers and distinguish removal of access from completed cleanup. Backup copies may remain until replaced or removed through the applicable backup process; access is restricted to recovery, security and legal purposes. Where a backup is restored, applicable deletion and access restrictions must be reapplied before ordinary use. We do not promise a fixed provider or backup erasure deadline. We cannot erase customer downloads, recipient inboxes or other copies outside our control. Contact info@usepointed.ai for request and retention details.

We use administrative and technical safeguards designed to protect information, including access controls and encryption in transit. No system is completely secure. Protect credentials and secret interview/results links. Report suspected unauthorized access to info@usepointed.ai.

You may decline or stop an interview. Browser camera/microphone permission is separate from recording and use permission. Where processing relies on consent, you may withdraw it for future processing. Withdrawal does not change the lawfulness of earlier processing and does not necessarily delete all previous information.

For access, correction, deletion, or a copy of interview information, contact the organizing customer or info@usepointed.ai. Identify the organizer and interview date if possible; do not send unnecessary sensitive information. We verify requests proportionately. We route and assist with requests where a customer controls the information and respond directly for our own processing, acting directly where legally required.

Ask the inviting customer or us to stop invitations/reminders or contact-request follow-up. Separately authorized marketing can be unsubscribed from without affecting necessary account or requested service messages.

Depending on applicable law, you may have rights to know about, access, correct, delete or obtain a portable copy of information; restrict or object to processing; withdraw consent; and opt out of sale, sharing, targeted advertising or certain profiling. Authorized agents may act where permitted. We do not unlawfully discriminate for exercising rights. Appeal a denied request by replying to our response or contacting info@usepointed.ai. Responses, extensions and appeal/complaint options follow applicable law.

For California residents where applicable, information categories include identifiers, account/commercial and professional information, electronic activity, audio/visual information and interview-derived inferences. Sources, purposes, recipients and retention criteria are described above. We ask you not to supply unnecessary sensitive information and do not use it for purposes requiring a separate limitation right without the required notice and controls.

Pointed is based in the United States. Information may be processed in the United States and in other countries used by configured providers. Those countries may have different data-protection laws. Required customer processing agreements and transfer safeguards must be in place before processing that requires them. Recording agreement alone is not an international transfer mechanism.

Where EEA/UK law applies to Pointed’s own activities, the relevant basis may be a contract with the individual or requested pre-contract steps; legitimate interests in business inquiries, administration and service security balanced against individual rights; legal obligations; or consent where required. A contract with an employer is not a contract with the employee. The organizing customer determines the basis for information it controls. You may complain to your local data-protection authority. Contact info@usepointed.ai for the safeguards and rights applicable to your information.

The service is initially offered to business customers in the United States for people 18 or older. We do not knowingly collect children’s information. If you believe someone under 18 has supplied information, contact info@usepointed.ai so we can investigate and take appropriate removal steps.

We may update this policy with a new version and date. We provide appropriate notice of material changes and obtain new consent where required before a new use requiring it. Continuing to use the service does not replace legally required consent.

Privacy requests: info@usepointed.ai. Security reports: info@usepointed.ai. Pointed AI Inc., 4047 Louisiana Street, San Diego, CA 92104.

This section applies when you request a demo, enterprise discussion, or access to our Claude, Codex or CLI tools through the website form. It governs that request specifically, not a separately requested recorded interview.

We collect first/last name, work email, phone, company, job title and request type. Application abuse controls use keyed IP/email digests. Provider processing of technical data is described in Section 2.

We use request details only to review and respond, subject to necessary security, abuse prevention and legal obligations. A team member reviews the request and may email a booking link or call personally about it. We do not make automated or prerecorded calls or send texts based on this form. We do not add you to a marketing list or use these details for other purposes without separate agreement. If we decline to follow up, we do not contact you about it. Ask us to stop contact and we will record and honor that request.

Our team and the providers for this process receive relevant information: Convex for records, Vercel for hosting, Slack for a request-type/company notification, Resend for email, and Cal.com for a booking you choose. This notification is distinct from interview quality processing. We do not sell request information or share it for advertising.

The contact-request retention criteria in Section 7 apply. Request deletion of associated internal notifications at info@usepointed.ai. Separate booking/email records follow their applicable purposes and retention processes. Rights and international requirements in Sections 9 and 10 apply where relevant.