Privacy Policy

1. Information We Collect

When you register or use Rolplay Analytics, we collect the following types of information:

• Account information: your name, email address, and hashed password.
• Company domain: derived automatically from your email address to associate your account with your organization.
• Usage data: aggregated analytics interactions such as date range filters, page visits, and export actions — used solely to improve the platform.
• Session tokens: short-lived JWT tokens stored in httpOnly cookies for authentication purposes.

2. How We Use Your Information

We use the information we collect to:

• Authenticate you and provide access to your organization's analytics dashboard.
• Display metrics and reports scoped exclusively to your company's data.
• Send transactional emails (e.g., password reset) when requested.
• Improve platform performance and fix bugs.

We never sell your personal data to third parties, and we never use your information for advertising purposes.

3. Data Isolation & Security

All analytics data is strictly isolated by organization. Your account only has access to data associated with your company's customer_id. Cross-organization data access is technically prevented at the database query level.

We protect your data with industry-standard security measures including:

• bcrypt password hashing (no plain-text passwords stored).
• Short-lived JWT access tokens (15-minute TTL) with httpOnly cookies.
• Encrypted connections (HTTPS/TLS) for all data in transit.
• Server-side session invalidation on logout.

4. Data Retention

Analytics data (session records, scores, evaluations) is retained as long as your organization has an active account. You may request deletion of your account and associated personal information by contacting us at info@rolplay.ai.

Session tokens are automatically expired and cleaned from the database after 7 days.

5. Third-Party Services

Rolplay Analytics may interact with the following third-party services on your behalf:

• Second Brain API (second-brain-shz8.onrender.com) — provides live member and coaching session data for organizations using the Second Brain module.
• Anthropic Claude — used for AI-powered insights within the platform. No personally identifiable information is sent to Claude.

6. Your Rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate personal information.
• Delete your account and associated personal data.
• Export your organization's analytics data via the CSV export feature.
• Object to any processing of your data for purposes beyond the ones described here.

To exercise any of these rights, contact us at info@rolplay.ai.

7. Cookies

We use only strictly necessary cookies — specifically httpOnly authentication cookies for managing your login session. We do not use tracking, advertising, or analytics cookies.

8. Contact

If you have questions about this Privacy Policy or how we handle your data, please reach out: