03 — Blindless Privacy Policy
DRAFT — for attorney review. Not legal advice. Version: privacy v0.1 · Effective: [DATE] · Last updated: [DATE]
Summary (read this first)
- We collect account info, bot run data, and device/usage info.
- We use it to run your dashboard and keep Blindless secure.
- We sell de-identified bot run data to AI companies — but only if you opt in. You can opt out any time.
- Enterprise data is never sold.
- We never sell account info (your name, email, billing).
- You can see, fix, download, and delete your data. Email [privacy@blindless.ai].
1. Who we are
[LEGAL ENTITY NAME] ("Blindless"), [ADDRESS]. Contact: [privacy@blindless.ai]. [DECISION: EU/UK representative if we serve EU/UK — see §12.]
2. Who this policy covers
- Users — people who sign up for Blindless.
- People in runs — people whose information appears in a user's bot runs (for example, a user's employees, contractors, or customers). We usually get this information from the user's bots, not from you directly. See §9.
- Website visitors.
- Enterprise: for Enterprise customers' Run Data we act as a service provider / processor for the customer. The customer's privacy notice applies. This policy covers only our own uses (for example, the Enterprise admin's account info).
3. What we collect (CCPA categories)
| CCPA category | Examples | Source | Purpose | Sold or shared? |
|---|---|---|---|---|
| **Identifiers** | phone number, name, email, account ID, IP address | you; your device | account, security, support | **Not sold.** Not shared for ads. |
| **Customer records** (Cal. Civ. Code 1798.80) | billing name, address | you; payment processor | billing | Not sold |
| **Commercial info** | plan, payments | you | billing | Not sold |
| **Internet / electronic activity** | pages used, clicks, browser, device | your device; cookies | security, analytics, product improvement | Not sold. `[Check: no ad pixels. If any ad/analytics pixels exist, this becomes "sharing" — remove or disclose.]` |
| **Bot run data** (may include identifiers, professional info, communications content, and other info about you or people in your runs) | task goals, steps, tool calls & inputs, tool outputs, errors, timing, cost, screenshots, ratings, corrections | your connected bots and accounts | dashboard, scores, support, security | **Only if you opt in:** de-identified, then licensed (sold) to AI developers. Before de-identification it's never sold. |
| **Professional / employment info** | job role, team, employer (inside runs or team settings) | you; your bots | dashboard | Only in de-identified form, if opted in |
| **Inferences** | bot performance scores | we create them | dashboard | De-identified scores may be included, if opted in |
| **Sensitive PI** (e.g., account log-ins, contents of email/texts not addressed to us, financial account numbers) | can appear inside run data by accident | your bots | we **don't** use it to infer anything about you; we try to remove it | **Never sold.** Removed before any dataset. Runs we can't clean are excluded. |
We do not knowingly collect: biometric data, precise geolocation, health data, children's data, government ID numbers. If they show up in runs, we remove or exclude them.
4. How we use information
1. Provide the dashboard, run logs, scores, ratings. 2. Security, fraud prevention, debugging. 3. Customer support. 4. Improve Blindless (using aggregated or de-identified statistics). 5. If you opt in: de-identify, aggregate, and license run data to AI developers to train and evaluate AI agents (§6). 6. Legal compliance. We will not use your information for a materially different purpose without telling you, and — for any new sale/licensing or AI-training use — getting your opt-in first.
5. Who we disclose to
- Service providers / processors (hosting, email, payments, support tools, security). Bound by contract to use data only for us. List: [/subprocessors].
- AI developer licensees — only de-identified run data, only from users who opted in (§6).
- Legal / safety — if the law requires, or to protect rights and safety.
- Business transfer — in a merger or sale, with your choices and these limits staying attached to the data.
- We do not share personal information for cross-context behavioral advertising.
6. Data contribution: how selling de-identified run data works
- Opt-in only. Off by default. Separate from accepting our Terms.
- What's included: task goal, steps/tool calls, outcomes, errors, retries, timing, cost, human ratings and corrections. Screenshots and full raw tool outputs excluded by default.
- De-identification before anything leaves Blindless: automated and rule-based removal of names, emails, phones, street addresses, account numbers, card numbers, API keys, tokens, and other identifiers; replacement of user/business names with random codes; removal of free-text fields we can't clean; human spot-checks; runs that fail checks are excluded. See our public de-identification commitment below.
- Aggregation: runs are combined with many other users' runs into datasets.
- Who buys: AI labs and AI-agent developers (and their data partners) that train or evaluate AI models. Categories/names: [/buyers].
- Buyer rules (by contract): no re-identification; no linking to other data to identify anyone; no resale except as we allow; delete on our request; security controls; audits.
- Our public commitment (Cal. Civ. Code 1798.140(m)): Blindless keeps de-identified data in de-identified form. We will not try to re-identify it, except to test whether our de-identification works. We contractually require every recipient to do the same.
- Opt out any time: Settings → Privacy, the "Do Not Sell or Share" link, GPC signal, or email. Effect: no new runs contributed; undelivered runs pulled; buyers told to delete delivered runs and stop future training use. Models already trained can't be "un-trained."
- Note: we treat these licenses as a "sale" for transparency, even though de-identified data may not legally be personal information.
7. Notice of Financial Incentive (California)
- Summary: the Free (Contributing) plan is offered in exchange for your opt-in to license de-identified run data.
- Material terms: see doc 04 (Data Contribution License). Plan features: [list]. If you don't opt in, you can use [Free Private / paid plans].
- Categories of PI involved: bot run data (which may include identifiers, professional info, internet activity, communications content), in de-identified form when licensed.
- How to opt in: signup Step B or Settings → Privacy.
- Right to withdraw: any time, same places, same effort.
- Value of the data and how we calculated it: we estimate [$X] per user per month, based on [method]. (Must be completed before launch — 11 CCR 7016.)
- Why reasonably related: the free plan costs about [$Y] per user per month to provide. [Lawyer to review.]
8. How long we keep data
| Data | Kept for |
|---|---|
| Account info | while account is open + [12] months (or longer if law requires, e.g., tax records [7] years) |
| Run data (identifiable) | while account is open, or until you delete the run; deleted within [30] days after; backups within [90] days |
| Raw/unscrubbed staging copies | [30] days max |
| De-identified contributed datasets | until the license ends or you opt out (then removed from future datasets) — max [5] years |
| Consent records | life of account + [5] years (to prove consent) |
| Security logs | [12] months |
| Rights-request records | [24] months (CCPA reg minimum) |
9. People whose info appears in someone else's bot runs
If you work for, or are a customer of, a business that uses Blindless, your information may appear in their bot runs. That business decides which bots to connect. We:
- require them to give you notice (we provide an employee notice template);
- remove names, emails, phones, addresses, and other identifiers before any dataset is created;
- let you opt out of any data sale and request access or deletion even if you are not a user — use [/privacy-choices] or [privacy@blindless.ai].
10. Your rights (US)
Depending on your state, you can:
- Know / access what we collect, use, disclose, and sell.
- Delete your personal information.
- Correct inaccurate information.
- Portability — get a copy in a usable format.
- Opt out of sale / sharing (California: "Do Not Sell or Share"; other states: opt out of sale and targeted ads). We honor Global Privacy Control.
- Limit use of sensitive PI (California) — we don't use sensitive PI beyond what's allowed, so this right doesn't change much, but you can still ask.
- Withdraw consent any time.
- Appeal a denied request (Colorado, Virginia, Texas, and others): reply to our decision with "Appeal." We answer within [45/60] days. If we deny, you may contact your state Attorney General.
- No discrimination for exercising rights (except the financial incentive described in §7, which is permitted with notice).
How to ask: Settings → Privacy, [privacy@blindless.ai], or [toll-free number / web form — lawyer: CCPA requires 2 methods; online-only business with direct relationship may use email only]. We verify your identity by [matching your account email / asking for info we already have]. Authorized agents may ask on your behalf with signed permission. We respond within 45 days (we may extend once by 45 days with notice).
11. State-specific notices
- California: this policy is our CCPA notice. Categories in §3; sources, purposes, disclosures in §§3–6; retention in §8; financial incentive in §7. In the past 12 months we have [sold de-identified run data to: AI developers / not sold any data]. We don't knowingly sell or share PI of consumers under 16. Metrics on requests (if required): [/privacy-metrics].
- Texas:
[Only if sensitive data is ever sold — our design says no:]NOTICE: We may sell your sensitive personal data. - Colorado, Virginia, Connecticut, Oregon, and others: the rights in §10 apply. We get opt-in consent before processing sensitive data.
- Nevada: you can opt out of sale at [privacy@blindless.ai].
12. EU / UK / Switzerland
[DECISION — pick one:] Option A (recommended at launch): We do not offer Blindless in the EU/EEA, UK, or Switzerland. We block signups from those regions, and our run data pipeline excludes runs flagged as involving them where we can tell. Option B: If we serve them, this section applies:
- Controller: Blindless (for account data and for contributed data). For Enterprise run data we are a processor.
- Lawful bases: contract (to run your account and dashboard); legitimate interests (security, product statistics); explicit, separate consent (Art. 6(1)(a)) for de-identifying and licensing run data — you can refuse without losing basic service, and withdraw any time as easily as you gave it.
- People in runs: we rely on the user to give notice; we anonymize before any dataset; we honor objections and erasure requests.
- International transfers: EU–US Data Privacy Framework [if certified] or Standard Contractual Clauses.
- Your rights: access, rectification, erasure, restriction, portability, objection, withdraw consent, complain to your data protection authority.
- Representative: EU [NAME/ADDRESS], UK [NAME/ADDRESS] (Art. 27).
- DPIA: we have done a Data Protection Impact Assessment for data contribution.
13. Security
Encryption in transit and at rest, access controls, least-privilege access, logging, and [SOC 2 program in progress]. No system is perfect. We'll notify you of breaches as the law requires.
14. Children
Blindless is for people 18+. We don't knowingly collect data from children under 13 (COPPA) or anyone under 18. Contact us and we'll delete it.
15. Changes
We'll post updates here. For material changes we'll email or show an in-app notice at least [30] days ahead. We will never start selling, or expand how we sell or use contributed data, through a policy update alone — we'll ask for your opt-in. Changes don't apply backward without your consent.
16. Contact
[privacy@blindless.ai] · [LEGAL ENTITY NAME], [ADDRESS] · Data protection contact: Sebastian [LAST NAME], [title].