Privacy Policy

1. Who we are

Ahead Ai ("we", "us") is operated by the team behind hello@aheadai.pro. The service consists of a mobile application distributed on the Apple App Store and Google Play, and an API at api.aheadai.pro. For GDPR we are the data controller for the information described below.

2. Data we collect

Account data

• Email, display name, password hash. Required to sign you in.
• Sign-in-with-Apple identifier or Google ID. If you choose social sign-in.
• Optional profile fields: organisation, industry, role, preferred meeting formats.
• Preferences: app language, content language, and notification preferences.

Content you create

• Prep sessions and meeting briefs: the mode you choose (for example podcast, media interview, event, Q&A or executive meeting), topic, audience, duration, tone, the people and organisations you name, and any notes you add.
• Generated briefings and scripts: openers, questions, answers, talking points, closings and other briefing items, your edits to them, and the tokens each generation used.
• Sources you add: documents you upload (PDF, Word or text files) and web pages you link, with the excerpts we extract from them to ground your briefing.
• Practice sessions: the persona and scenario you pick, the questions asked, your typed answers, and feedback. Spoken answers are recorded and sent to the server to be transcribed and analysed.
  • Recordings are deleted after analysis. They are kept only when recording storage is offered in the app and you allow it.
  • Transcripts are stored only if you allow transcript storage.
  • Scores and measurements (such as words per minute, filler words and pauses) are kept with the session.
• Voice input (optional): if you choose to speak instead of typing when you start a prep, we record what you say (up to two minutes) and turn it into text to fill in the form for you.
  • The recording is never stored. It is held in memory only while it is transcribed, then deleted straight away.
  • The transcript is shown to you so you can check or correct it, and is not stored on its own. Only the prep details you then submit are saved, the same as if you had typed them.
  • We use your voice only to get the words you said. We do not create a voiceprint, identify you by your voice, or analyse your emotions.
• Favourites and folders: your saved lines.
• Support requests: what you write to us in the app, with your email so we can reply.

Consent records

• When you allow or decline recording (for voice practice and voice input), transcript storage, calendar access, web research or marketing, we keep a record of the choice and when you made it, so we can prove we honour it.

Calendar data (optional)

• If you connect Google or Outlook, we store an OAuth access and refresh token (AES-256-GCM encrypted at rest) and the event fields required to draft a briefing: title, description, location, start/end time, attendees' names and email addresses, organiser, meeting URL.
• Google Calendar access is read-only. We use it only to show your upcoming meetings and prepare briefings in the app. We never create, change or delete events, and we do not sell Google user data, use it for advertising, or use it to train AI models.
• You can disconnect at any time in Settings; tokens and calendar events are deleted within 24 hours.
• Ahead Ai's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Subscriptions

• Purchases are handled by Apple or Google; we receive only the transaction identifier, renewal date, plan, and status via RevenueCat. We never see your card.

Technical data

• Device type, OS version, app version, crash reports, and anonymised usage counts so we can fix what breaks and invest where people spend time.
• If you allow notifications, a push notification token for your device.
• IP address is used transiently for rate limiting and audit logs. It is not used for advertising.

What we don't collect

• We don't read your other emails, contacts or photos. We use the microphone only while you are actively recording, for voice practice or voice input, and never in the background.
• We don't collect biometric data: no voiceprints, face data or other identifiers derived from your body.
• We don't use third-party advertising SDKs.
• We don't sell data. Ever.

3. How we use it

Only the purposes below, and only the minimum required:

• Deliver the product: prepare briefings, fill in a prep from what you say when you use voice input, research the topics and people in your prep when you ask us to, sync calendars, run practice sessions and score voice takes, send the notifications you choose, run subscriptions.
• Improve the product: aggregate anonymised usage to decide what to build next.
• Support you: answer your questions when you write in.
• Meet legal obligations: audit logs for security investigations, responding to lawful requests.

Legal bases (GDPR and UK GDPR):

• Contract: to provide the service you signed up for: your account, briefings, practice sessions, subscriptions and support.
• Consent: for audio recording (voice practice and voice input), transcript storage, calendar access, web research and marketing. You can withdraw consent at any time in Settings → Privacy; typing always remains available instead of voice.
• Legitimate interests: to keep the service secure (rate limiting, audit logs, fraud and abuse prevention) and to improve it using anonymised usage counts.
• Legal obligation: to keep records the law requires and to respond to lawful requests.

AI training: we do not train machine-learning models on your meeting content, uploaded documents, voice recordings, transcripts, or calendar data. Our AI providers process this data only to return results to us and are not permitted to use it to train their models under our agreements with them.

4. Who we share with

• Anthropic — to generate text: briefings, questions, answers and practice feedback, and, when you use voice input, to fill in your prep form from the transcript of what you said. Your prep details, selected source excerpts, practice answers and voice-input transcripts are sent; the response comes back and is stored with your account (voice-input transcripts are not stored). Anthropic does not train on this data.
• OpenAI — to transcribe voice practice and voice input recordings, and, where enabled, as a backup for text generation when our primary provider is unavailable. OpenAI's no-training agreement applies.
• Web search and reference providers — when you use research features: Wikipedia and Wikidata (Wikimedia Foundation) and, where enabled, Exa, Tavily, Brave Search and GNews. We send search queries built from your prep (such as the names, organisations and topics you enter), never your account details.
• Google and Microsoft — only if you connect Google Calendar or Outlook, to read the events described above.
• RevenueCat — to handle subscription logic across Apple and Google.
• Amazon Web Services — infrastructure hosting for the API, database and file storage, in the United States (us-east-1, N. Virginia).
• Sentry — crash and error monitoring. Stack traces may include IP and request paths, never your content.
• SendGrid (Twilio) or Resend (whichever we use for sending) — transactional email such as password resets, email verification and data-export links.
• Firebase Cloud Messaging (Google) — to deliver push notifications, if you allow them.

Each processor is bound by a Data Processing Agreement. We do not share with advertisers, data brokers, or affiliates, because we have none.

International transfers: our servers and our main providers (Amazon Web Services, Anthropic and OpenAI) are in the United States, so if you live in the UK, the EU or elsewhere your data is transferred there. These transfers are protected by the European Commission's Standard Contractual Clauses (with the UK Addendum for UK users) in our agreements with each provider, or by the EU-U.S. Data Privacy Framework and its UK extension where the provider is certified.

5. How long we keep it

• Account + generated content: until you delete your account.
• Uploaded documents and saved sources: until you remove them or delete the account.
• Voice audio files: deleted after analysis. Where recording storage is offered and you allow it, recordings are kept for up to 30 days and then deleted automatically; you can delete them sooner at any time. Transcripts (if you allowed them) and scores remain until you delete the session.
• Voice input: the recording is deleted immediately after transcription and never stored. The transcript is not kept; only the prep details you submit are stored, with your prep.
• Calendar tokens and events: until you disconnect or delete the account, then purged within 24 hours.
• Data export files: available to download for 72 hours, then deleted.
• Consent records: for as long as your account exists, so we can show which choices you made.
• Audit logs: 12 months for security, then deleted.
• Backups: encrypted snapshots retained for 7 days after a delete.

6. Your rights

Regardless of where you live, you can:

• Access and export all your data as JSON from Settings → Export, or by writing to us.
• Correct information by editing your profile.
• Delete your account in Settings → Delete Account. This is permanent and cascades to every row we hold, except audit logs, which we keep for 12 months for security.
• Withdraw consent for recording (voice practice and voice input), transcript storage, calendar access, web research or marketing at any time in Settings → Privacy. This does not affect processing that already took place.
• Port your data — the export is machine-readable JSON.
• Object / restrict processing — write to us and we will comply to the extent the law allows.
• Complain to your data protection authority (in the UK, the Information Commissioner's Office).

For CCPA residents: we do not "sell" or "share" personal information as those terms are defined under California law.

7. Security

• All traffic encrypted with TLS 1.2+.
• OAuth tokens encrypted at rest with AES-256-GCM.
• Passwords hashed with bcrypt (cost 12).
• In the current app, sign-in access tokens expire in 15 minutes and are renewed with rotating refresh tokens. Earlier app versions use longer-lived tokens until they are updated. A password reset revokes every previously-issued token.
• Administrator access requires two-factor authentication.
• Least-privilege IAM, daily encrypted snapshots, locked-down networking.

No system is perfectly secure. If you suspect a breach, write security@aheadai.pro.

8. Children

Ahead Ai is not designed for users under 16 and we don't knowingly collect their data. If you believe a child has signed up, write to us and we will remove the account.

9. Changes

When we update this policy, we bump the version date above and notify active users by email. Continued use after that date constitutes acceptance.

10. Contact

Write to privacy@aheadai.pro for any privacy matter. We acknowledge within 48 hours.