Privacy Policy
This Policy describes how SapiensQ collects, uses, stores and shares personal information across our websites and products, including Finance90, Refill and Cohorta. Where a product handles something differently, the difference is stated in the table for that product rather than left to inference.
Scope and Who We Are
SapiensQ Inc. (주식회사 사피엔스큐) (“SapiensQ”, “we”, “us”) is the company responsible for the personal information described in this Policy, except as stated in the next paragraph for Finance90. We are incorporated in the Republic of Korea and operate the Services from there.
Finance90 is supplied by SAPIENSQ, Inc., a Delaware corporation, which is responsible for the personal information collected through Finance90. SapiensQ Inc. develops and operates Finance90 and processes that information on SAPIENSQ, Inc.’s behalf. In relation to Finance90, “we” in this Policy means SAPIENSQ, Inc. acting with SapiensQ Inc. as its service provider.
This Policy applies to sapiensq.com, to the Finance90 Financial Simulator, to Refill, to Cohorta, and to any other SapiensQ website, application, research page, waitlist, demonstration or product that links to it (the “Services”).
Where you use a Service through an organisation that provisioned it, that organisation decides what is collected in its workspace and why. In that case we act on the organisation’s instructions for the material it puts into the Service, and the organisation’s own privacy notice governs its relationship with you. Business Customers and Processing Roles below sets out how the two notices fit together.
Where a separate written agreement, order form or product-specific notice applies, it controls to the extent it conflicts with this Policy.
The Services This Policy Covers
The Services differ in what they process, and the rest of this Policy refers back to these names.
| Service | What it does | Material a user puts into it |
|---|---|---|
| sapiensq.com | Public website, research pages, contact form, waitlist and demo requests | Contact details and the content of your message |
| Finance90 | Simulates FOMC deliberation and reports probability distributions and reports | Scenario premises, macroeconomic assumptions, research documents |
| Refill | Rehearsal of difficult conversations with an AI counterpart, coached against the organisation’s own documents | Practice dialogue, scenario and role descriptions, uploaded manuals and guidelines |
| Cohorta | Runs a questionnaire against a panel of synthetic respondents and reports the distribution | Questionnaires, audience definitions, experiment configurations |
Information We Collect
We collect information you provide directly, information generated when you use the Services, and limited information from our service providers. The following applies to every Service.
- Account and identity information: name, email address, organisation, role, authentication records, and the identifier returned by a sign-in provider where you sign in with one.
- Agreement records: which version of the terms and of this Policy you accepted, when, through which surface, and whether you agreed to marketing contact.
- Contact and lead information: company, role or industry, area of interest, use case, timeline and message content submitted through a form.
- Billing information: plan, billing contact, transaction records, country of residence for tax purposes, and a payment-method token. We do not receive or store complete payment-card numbers.
- Usage and activity records: features used, runs and sessions launched, credits consumed, timestamps and outcome status.
- Technical and security data: IP address, device and browser information, requested URLs, referrer, language or locale, and logs generated by our hosting, security and delivery providers.
- Support and correspondence: the messages you send us and our replies.
Each product additionally processes the material a user puts into it, and the records the product creates from that material.
| Service | Additional information processed |
|---|---|
| Finance90 | Experiment configurations, scenario premises, uploaded research documents, model outputs, deliberation records, report identifiers, run history and credit ledgers |
| Refill | Scenario and role descriptions, the dialogue exchanged with the simulated counterpart, coaching output and its citations, uploaded documents and the passages extracted from them, room and invitation records, participation and practice history |
| Cohorta | Questionnaires and their items, audience and quota definitions, panel and population frame selections, fieldwork records, response sets and segment results |
Material a user types into a simulation can contain personal information about that user or about someone else. We do not require it, the terms restrict it, and we ask you not to submit special categories of personal data, government identifiers, financial account numbers, health or case records, children’s data or third-party confidential information unless we have expressly agreed in writing to receive them.
The persona corpora used by Cohorta are generated. A synthetic respondent is not a real person and its demographic profile is drawn from published population statistics rather than from records about identifiable individuals.
How We Use Information
We use personal information to:
- provide the Services, create and operate workspaces, and run the simulations you launch;
- respond to inquiries, process demo requests and manage waitlists;
- authenticate users, enforce seat and plan limits, and record agreement to our terms;
- bill for paid plans, determine applicable tax, and keep the accounting records the law requires;
- operate, secure, debug, measure and improve the Services;
- prevent spam, abuse, fraud, security incidents and misuse of AI or simulation features;
- send service and administrative messages, and, where you have agreed or the law otherwise permits, product updates;
- comply with law, enforce our terms, and protect the rights, safety and integrity of SapiensQ, our users and the public.
Where the law that applies to you requires a legal basis for processing, we rely on the following.
| Purpose | Typical data | Typical legal basis |
|---|---|---|
| Providing a workspace and running simulations | Account, workspace content, usage records | Performance of a contract; legitimate interests for business users |
| Responding to inquiries, demo requests and waitlists | Contact, company, role, use case, message content | Pre-contract steps; legitimate interests; consent where required |
| Billing, tax and accounting | Billing contact, transaction records, country of residence | Performance of a contract; legal obligation |
| Operating, securing and debugging the Services | Technical logs, device data, request metadata | Legitimate interests; legal obligation |
| Improving the Services and validating methods | Aggregated, de-identified or limited product-use data | Legitimate interests; consent or separate agreement where required |
| Product updates and marketing | Email address, preferences, engagement metadata | Consent, or legitimate interests where permitted, with opt-out |
| Legal, compliance, safety and disputes | Relevant records, communications, logs, account data | Legal obligation; legitimate interests; establishment or defence of claims |
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before the withdrawal, and declining marketing contact never affects your access to a Service.
AI Processing, Model Training and Research
The Services send the material you submit, and the context needed to act on it, to the artificial-intelligence providers listed under Sharing and Sub-processors. Those providers process it to return the output and under contractual terms that restrict other use.
We do not use identifiable workspace content, practice dialogue, questionnaires, scenario material, contact-form submissions or enterprise confidential submissions to train or fine-tune models for the benefit of other customers, unless you expressly opt in or a separate written agreement provides for it.
We use aggregated or de-identified information to measure quality, validate methods, size capacity and improve the Services. Information used this way no longer identifies a person or a customer, and we do not attempt to re-identify it.
Where a product feature does use prompts, outputs or interaction records for model improvement, we will say so in a product-specific notice or control at or before the point of collection.
Output is generated by an AI system and is identified as such in the interface or in report metadata. Simulated participants, counterparts, personas and respondents are models rather than descriptions of real individuals.
International Transfers
We operate from the Republic of Korea and use providers located in the United States and other countries. Using the Services therefore involves transferring personal information across borders, to the recipients, for the purposes and to the locations set out in the table above.
Finance90 is hosted in the United States. SapiensQ Inc. accesses Finance90 personal information from the Republic of Korea to develop, operate and support the Service on behalf of SAPIENSQ, Inc.
Transfers are made only on a basis permitted by the law that applies to them. Depending on the transfer, that basis may include contractual protections such as standard contractual clauses, the consent or notice required by Korean law for overseas transfer, vendor due diligence, transfer risk assessment, or another mechanism recognised by applicable law.
Countries receiving the information may have data protection laws different from those where you live. You may contact us for further information about the safeguards applied to a particular transfer.
Retention
We keep personal information only for as long as reasonably necessary for the purpose it was collected for. The periods below apply unless a longer period is required by law or by an order form.
| Information | Retention |
|---|---|
| Contact, demo and waitlist submissions | Up to 24 months after the last meaningful interaction |
| Account and workspace records | For the life of the account, then deleted or anonymised after closure |
| Agreement and consent records | For the life of the account and for the period a claim about the agreement can be brought |
| Finance90 experiment configurations, run history and reports | For the life of the workspace, exportable for up to 30 days after closure |
| Refill practice runs, transcripts and coaching | The period configured for the workspace or stated in the order form, then deleted or anonymised |
| Refill uploaded documents and extracted passages | Until deleted by the organisation, or on workspace closure |
| Cohorta studies, response sets and results | For the life of the workspace, exportable for up to 30 days after closure |
| Billing and tax records | For the period required by tax and commercial law |
| Security, access and technical logs | For as long as needed for security, debugging, reliability and legal purposes |
| Aggregated or de-identified information | May be retained indefinitely, as it no longer identifies a person |
We may retain information longer where reasonably necessary for legal, security, accounting, audit, dispute-resolution or business-continuity purposes. When a retention period ends, we delete the information or place it beyond use.
Security
We use administrative, technical and organisational measures designed to protect personal information, including encryption in transit, access control and role-based permissions, tenant separation enforced in the database, restricted internal access, logging, and reputable infrastructure providers.
No website, email system or online service can be guaranteed to be completely secure. You are responsible for keeping your credentials, room codes and API keys confidential.
If a security incident affects personal information and applicable law requires notice, we will notify affected individuals, customers, regulators or other parties within the period that law requires.
Your Rights and Choices
Depending on where you live, you may have the right to request access to your personal information, correction, deletion, a copy in a portable form, restriction of or objection to processing, withdrawal of consent, information about how we disclose personal information, and to complain to a competent supervisory authority.
To make a request, contact a.sapiens@sapiensq.com. We may need to verify your identity before acting, and we will respond within the period applicable law requires. Where permitted, you may use an authorised agent, and where we decline a request we will tell you why and how to appeal.
You can opt out of marketing email at any time using the link in the message or by contacting us. We will still send the service and administrative messages needed to operate your account.
Where an organisation provisioned your workspace, we will refer a request about that workspace’s content to the organisation and assist it in responding. We will not delete an organisation’s records at the request of one of its users without its instruction, unless applicable law requires us to.
We will not discriminate against you for exercising a privacy right.
Business Customers and Processing Roles
For material an organisation puts into its own workspace, the organisation is the controller, or in Korean terms the personal information controller, and we act as processor or entrusted party on its instructions. This covers uploaded documents, practice dialogue, questionnaires, scenario material and the records produced from them.
For information we need to run our own business, including account registration, authentication, billing, security, support and service improvement, we are the controller and this Policy describes that processing.
A data processing addendum, including the terms applicable to sub-processing and international transfer, is available to eligible business customers on request. Where an addendum is executed, it governs the processing it covers.
Where an organisation instructs us to process material, that organisation is responsible for having a lawful basis, for giving the notices its own users are owed, and for the accuracy and lawfulness of what it uploads.
Automated Decision-Making
We do not use website submissions, account records or product-usage records to make solely automated decisions producing legal or similarly significant effects about a person.
Simulation output is not a decision about a person. A coaching score, a validation grade or a risk flag describes a rehearsal, a method or a question, and our terms prohibit using it as the sole basis for an employment, academic, credit or entitlement decision.
Where an organisation nonetheless builds our output into a decision process about individuals, that organisation is responsible for the notice, human review and safeguards applicable law requires of it.
We use automated signals to detect abuse, fraud, credential sharing and plan misuse. Those signals can lead to a review, a request for evidence or a suspension, and a person reviews the case before an account is closed for misuse.
Children
The Services are not directed to children, and account holders must be at least 18 years old. We do not knowingly collect personal information from a child, and we do not process the personal information of children under 14 within the meaning of the Korean Personal Information Protection Act.
If you believe a minor has provided us personal information, contact us so we can review it and delete it where appropriate.
Regional Notices
The following apply only where the corresponding law applies to SapiensQ or to your use of the Services.
Republic of Korea. This Policy is our personal information processing policy. It states the purposes of processing, the items processed, retention and destruction, provision to third parties, entrustment of processing, overseas transfer, the rights of data subjects and how to exercise them, and our safety measures. Consents to the terms, to the processing of personal information and to marketing contact are collected separately at sign-up, and marketing consent is never a condition of using a Service. You may also raise a dispute with the Personal Information Dispute Mediation Committee, the Korea Internet and Security Agency privacy call centre, or the Personal Information Protection Commission.
European Economic Area, United Kingdom and Switzerland. The legal bases we rely on are in the table under How We Use Information. You have the rights described under Your Rights and Choices, including the right to object to processing based on legitimate interests and the right to complain to your local supervisory authority. Where required, we apply an approved transfer mechanism to transfers out of your region.
United States. We describe the categories of personal information we collect, the sources, the purposes, the categories of recipient and our retention practice above. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes that require the right to limit. California residents and residents of other states with comparable laws may exercise the rights those laws provide by contacting us.
Other regions. Where local law grants rights relating to notice, consent, access, correction, deletion, withdrawal of consent, overseas transfer or complaint handling, we will honour them as that law requires.
Changes to This Policy
We may update this Policy to reflect changes in the Services, our providers or applicable law. The version and effective date are stated at the top.
Where a change materially affects how we process personal information, we will give notice by email, through the Services or by another method that applicable law accepts, and where consent is required we will obtain it before the change applies to you.
Contact
Privacy questions and requests may be sent to the address below. We treat this address as the contact point for the person responsible for personal information protection at SapiensQ.
- Legal name: SapiensQ Inc. (주식회사 사피엔스큐)
- Country: Republic of Korea
- Email: a.sapiens@sapiensq.com
For Finance90:
- Legal name: SAPIENSQ, Inc.
- Place of incorporation: Delaware, United States
- Email: finance90@sapiensq.com