Privacy Policy

1.1 Account Information

• Email address and display name
• Profile picture (optional)
• Organization and role information (optional)
• Billing information (processed by Stripe; we do not store full card details)

1.2 Content You Provide

• Content submitted to any platform for analysis or processing
• Messages, notes, and communications within the Services
• Assessment data, survey responses, and form submissions
• Files, recordings, and documents uploaded to any Service

1.3 Usage Data

• Feature usage patterns and session duration
• Device type, browser, and operating system
• IP address and approximate geographic location
• Navigation paths and referring URLs
• Error logs and performance data

We use your information to:

• Provide, operate, and maintain the Services
• Process your requests and deliver platform features
• Track your progress and generate personalized insights
• Send transactional communications — account notices, password resets, receipts
• Provide customer support
• Improve and develop new features using anonymized, aggregated data only
• Ensure security, prevent fraud, and enforce our Terms of Service
• Comply with applicable legal obligations

Across all eight products, these protections apply without exception:

• We will never keep your content after you delete it or delete your account, except for the few things section 5.4 lists
• We will never use your content to train AI models, or allow the AI providers we use to do so
• We will never share your personal data with third parties for marketing purposes
• We will never sell your personal information
• We will never use your data for purposes beyond those described in this Policy without your explicit consent

5.1 Content Submissions. Content you submit for analysis is used to produce your result. Depending on the product, the content and the result (for example transcripts, recordings, practice sessions, drafts and scores) may be kept as part of your account until you delete them, you ask us to delete them, or the retention period for that product ends. In Mirror, apart from replies to the weekly coaching note (see 7.8), nothing is deleted on a timer: what is in your account stays until you delete it or delete your account. Analyses can be deleted one at a time from My Analyses; situations, practice conversations and rewrites you copied have no delete button of their own and go when you delete your account, or sooner if you ask us.

5.2 Analysis Results and Session Records. Scores, insights, and session records are retained to support your progress tracking across sessions. You may request deletion at any time.

5.3 Account Data. In Mirror, account information is kept for as long as your account exists, with or without a paid plan. Ending a subscription deletes nothing; deleting your account deletes it at once (see 5.4).

5.4 Account Deletion. In Mirror you can delete your account yourself, from Settings → Account → Delete account, or ask us to do it at support@theunfairai.com. Deleting your account removes your data immediately: your records, the files you uploaded and your sign-in are deleted, any paid plan is cancelled at the same moment (not at the end of the billing period, so the rest of that period is not refunded), and your connections to Zoom, Slack and Microsoft Teams are removed. A few things are kept. Billing records Stripe holds for us, such as invoices and payments, are kept for tax purposes as the law requires. Our service providers may keep copies for a limited time under their own terms (see section 7). Our database provider makes a backup copy each day and keeps each one for about a week before deleting it, so deleted data leaves the backups within about a week. We also keep anything else the law requires, such as a legal notice you sent us. If you own a team that still has other people in it, contact us first so we can hand the team over.

We implement industry-standard security measures across all platforms, including:

• AES-256 encryption at rest
• TLS encryption in transit
• Secure, compliant cloud infrastructure
• Role-based access controls and employee training
• Regular security reviews

In Mirror, other users cannot open your analyses. Mirror staff can open your analyses only to help you, for example when you ask for support. Each time they do through Mirror, Mirror records who opened them, what was opened and when. That record cannot be changed, and it is included in Download my data (without the staff member's name).

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security and encourage you to use strong, unique passwords.

We do not sell your personal information. We may share data only in these limited circumstances:

7.1 Service Providers. Third-party vendors that help us operate the Services — cloud hosting, analytics, payment processing, and email delivery. These providers are contractually required to protect your data and use it only for the purposes we specify. For Mirror, they are: Supabase (our database, sign-in, file storage and server functions, in the United States); Vercel (hosts the website, and measures visits only if you accept cookies); Stripe (payments); Resend (account and notification emails); and Sentry (error reports when something breaks, sent on every visit; and, only if you accept cookies, performance measurements and a short replay of the page where something broke, with all text and images hidden). If you choose to sign in with Google or Microsoft, they confirm who you are and share your name and email address with us; Mirror does not get access to your mailbox, calendar or files. If you connect Slack or Microsoft Teams, Slack or Microsoft receive the messages Mirror sends you there (see 7.7 and 7.8).

7.2 AI Processing Partners. Mirror uses three AI providers: Anthropic (writing, analysis, coaching and conversation), AssemblyAI (speech to text) and ElevenLabs (spoken voices). Each one processes content only to return a result to us. Anthropic's commercial terms do not allow it to train its models on what we send; it may keep that content for a limited period (for example, for security and abuse monitoring) before deleting it. AssemblyAI receives audio only when something you recorded has to be turned into text, and we instruct it to delete the audio and its transcript as soon as the text is returned. ElevenLabs receives only words Mirror wrote for you, such as a letter or a reply to a voice reflection, so they can be read aloud.

7.3 Legal Requirements. We may disclose your information when required by law, court order, or governmental authority, or when necessary to protect the rights, property, or safety of the Company, our users, or others.

7.4 Business Transfers. In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change and your options.

7.5 Connected Third-Party Accounts. You may choose to connect third-party services such as Zoom, Slack, or Microsoft Teams. When you do, we access only the data needed for the feature you enabled — for Zoom, that is your basic profile and your own cloud recordings; for Slack and Microsoft Teams, see 7.7 and 7.8 — and only for accounts you personally authorize. We do not store your meeting audio or video. Recordings are read once, converted to text for analysis, and discarded. The full transcript is not retained; the coaching we save may quote a few short lines from the meeting to show which moment it refers to, and you can delete any analysis at any time. Where a recording has no transcript, the audio is sent to our transcription provider (AssemblyAI) solely to produce that text, and we instruct AssemblyAI to delete the audio and its transcript as soon as the text is returned. Access tokens are encrypted, and disconnecting the integration revokes our access immediately and stops all future processing. You are responsible for obtaining any consent required from other meeting participants.

7.6 Rehearsal Studio, at your request. Rehearsal Studio is another product operated by The Unfair AI LLC, with its own account and its own privacy policy. When you choose "Rehearse it out loud" and confirm, we send it the situation you described and what to work on, together with your current Mirror sign-in pass so it can file them under your verified email. Rehearsal Studio uses that pass only to read your email, does not keep it, and the pass stops working within the hour. Your emails, analyses and scores are not sent. Rehearsal Studio keeps the situation for 14 days for you to practise, and deletes it if you close your Rehearsal Studio account. If you use it to start a practice session, it becomes part of that session and is kept with the rest of your practice. Nothing is sent unless you confirm.

7.7 Slack and Microsoft Teams. Connecting Slack or Microsoft Teams is optional, and each person connects their own account. When you connect Slack, Slack tells us your workspace's name and ID and your own Slack user ID, and gives the Mirror app permission to post messages, answer its /mirror commands and read direct messages sent to it. When you connect Teams, Microsoft confirms who you are, and we keep your organization's name and ID and your Microsoft user ID; Mirror does not get access to your mailbox, calendar, other chats or files. The keys Slack and Microsoft give us are stored encrypted. Mirror looks at a message only when you send it to Mirror: with /mirror or a direct message in Slack, or in your one-to-one chat with Mirror in Teams (in a Teams group chat or channel Mirror only points you there). Messages other people write in those conversations are ignored and not stored. The messages Mirror looks at are sent to Anthropic (see 7.2). We keep the scores, and sometimes a one-line tip, rather than the message itself, with one exception: your replies to the weekly coaching note (see 7.8). Intentions you set with /mirror-goals in Slack or daily-goal in Teams are kept in your account. If someone who has not linked a Mirror account sends Mirror a message with /mirror or @Mirror, Mirror only tells them how to connect; nothing is sent to Anthropic or kept. Disconnecting deletes our keys and your settings for that connection. For Slack we also ask Slack to cancel the key; Microsoft has no way to do that for Teams, so we delete our copy. Mirror then stops looking at your messages and stops sending you coaching notes. Your past coaching notes, scores and intentions stay in your account until you delete it. Anything Mirror posts in Slack or Teams, and anything you write to it there, is a message in your organization's Slack or Teams, which Slack or Microsoft keep under your organization's settings.

7.8 Weekly coaching note in Slack or Teams. This is off until you turn it on in Settings → Integrations. Once a week, at the time you choose, Mirror sends Anthropic a summary of your own Mirror data: your scores and Mirror's insights on your own writing from the last 30 days, your development plan, your baseline focus areas, your latest experiment and your leadership patterns. From meeting analyses it uses only the scores, because their insights describe conversations with other people. Mirror posts the short note it gets back to you privately in Slack or Teams, and keeps a copy in your account. If you reply, Mirror sends Anthropic your reply, the same summary of your data, that week's note and your last few messages with Mirror, and posts its answer in the same thread, up to 10 times a day. Your replies and Mirror's answers are kept with that week's note so Mirror can follow the conversation, and cleared 30 days after the note was sent. For Teams we also keep the address Microsoft gives us the first time you message Mirror there, because Microsoft only lets Mirror message you at that address. Type "stop" in that chat to turn the note off; you can turn it back on in Settings. "Stop" does not disconnect Slack or Teams.

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Correct inaccurate or incomplete data
• Delete your data ("right to be forgotten")
• Export your data (data portability)
• Object to or restrict certain processing
• Withdraw consent where processing is consent-based

In Mirror you can do most of this yourself. Download my data and Delete account are in Settings, Account. Consent to AI processing can be withdrawn, and turned back on, in Settings, Security & Privacy; while it is off, Mirror sends nothing of yours to its AI services. Every reminder or update email has an unsubscribe link that works without signing in, and Settings, Notifications has a switch for each one. Emails about your sign-in and security are always sent.

To exercise any of these rights, contact us at support@theunfairai.comCopy. We will respond within 30 days.

We use cookies and similar tracking technologies for:

• Maintaining your login session and authentication state
• Remembering your preferences and settings
• Security and fraud prevention
• Understanding how the Services are used (analytics)

In Mirror, the cookie banner decides the optional ones. Keeping you signed in, remembering your choices and sending error reports (Sentry) are essential and always on. Visit measurement (Vercel Analytics), and Sentry's performance measurements and its short replay of a page where something broke (all text and images hidden), start only if you accept. Decline and Mirror works the same. You can change your answer at any time with Cookie settings at the bottom of every page.

You can disable cookies in your browser settings. Some features of the Services may not function properly without cookies.