Privacy Policy

1. Who we are

BlakeABC is a sales-training tool used by employers to help their frontline staff practice customer conversations with an AI roleplay partner.

For the purposes of EU/UK GDPR and similar laws, BlakeABC operates as either the data controller (where we set the purpose and means of processing) or as a processor on behalf of your employer (where they decide). For the trainee roleplay product, we are the controller of your account and session data; your employer is the controller of your employment record. We will tell you which applies in any specific request.

BlakeABC is currently operated as a pre-incorporation venture. Once a legal entity is registered, we will update this policy with its name and registered address. Until then, the contact for all privacy matters is contact@blakeabc.com.

2. What data we process

• Voice audio recorded during AI roleplay sessions. The microphone is active only during a session and is muted between sessions.
• Transcripts of each session, generated automatically.
• AI-generated feedback on your performance (scores, written suggestions).
• Account profile: your name, the email or invite code used to register, your workspace, and your role.
• Session metadata: timestamps, scenario IDs, device and browser info, IP address (used for security and consent records).
• Consent records: the version of this policy you accepted, when, and from which session.

We only record your voice — never another person's. The "customer" in every roleplay is a synthetic AI voice, not a real person. We do not capture ambient audio.

Cookies and local storage

We use only essential cookies and your browser's local storage to keep you signed in and to remember low-stakes preferences (e.g., theme, last-used invite code, whether to remember your email). We do notuse analytics cookies, advertising cookies, or third-party tracking. Clearing your browser's local storage signs you out.

3. Why we process it (purposes)

• To deliver the training: the app cannot give feedback without recording.
• To help you and your manager review your progress over time (charts, session history, coaching).
• For hiring assessment, where applicable (the interview feature uses the same recording mechanism for candidate evaluation).
• To improve the BlakeABC product, using only anonymized aggregate data — we do not use identifiable recordings or transcripts for product improvement.
• To comply with legal obligations and resolve disputes.

4. Lawful basis (by region)

The legal grounds we rely on depend on where you are based.

• EU / UK / EEA: our primary basis for training-related recording is legitimate interest(GDPR Art. 6(1)(f)) — namely, training frontline staff in sales conversations. We have completed a written balancing test (Legitimate Interest Assessment) and you have the right to object at any time. For the hiring/interview feature, we rely on Art. 6(1)(b) ("steps prior to entering a contract") for the assessment itself, and on consent for any retention beyond the assessment period.
• United States: your explicit consent given at the start of each session, plus our business-purpose interest in providing training under CCPA / CPRA.
• Canada: your express consent under PIPEDA. If you reside in Quebec, additional rights under Law 25 apply (see §13).

We rely on legitimate interest rather than consent for most EU processing because the European Data Protection Board has held that employee consent is rarely freely given (the employer-employee power imbalance). The consent modal you see at the start of each session is therefore a transparency notice, not the legal basis.

Is providing this data mandatory? Providing your voice is necessary to use the training feature — without recording, we cannot give feedback. There is no statutory obligation to provide it. If you decline, you cannot use roleplay or interview features, but no other employment right is affected by your choice.

5. Who we share data with

We use a small number of named third-party providers to operate the service. Each is bound by a Data Processing Agreement.

• ElevenLabs (USA) — runs the AI voice partner you talk to during roleplay. They process your audio + transcript. Privacy, DPA, sub-processors.
• Anthropic (USA) — generates your written feedback from the transcript. Privacy, DPA.
• Vercel (USA) — hosts the web app and serves it to your browser. Privacy.
• Supabase / PostgreSQL host — stores your account, transcripts, and feedback. We will name the specific host once production database is provisioned.

We do notsell your personal data. We do not share your recordings or transcripts with anyone outside this list and your employer's authorized administrators.

Sub-processor disclosure: Google LLM

ElevenLabs uses Google as a sub-processor for some AI features. Under our current ElevenLabs plan (non-Enterprise), Google may use the data passing through that service for its own product improvement. Anthropic and ElevenLabs themselves do not use your data to train their models. We are actively working to either upgrade to ElevenLabs Enterprise (which contractually disables this) or obtain a contractual carve-out before we scale beyond pilot. We are telling you this rather than papering over it.

6. Cross-border transfers

All of our providers are based in the United States. If you are in the EU/UK, your data is transferred to the US under the following safeguards:

• The EU-US Data Privacy Framework (and UK Extension), where the provider is certified.
• Standard Contractual Clauses(Module 2: controller-to- processor), incorporated into each provider's DPA, as a fallback.

For Canadian residents, transfers comply with PIPEDA's accountability principle: we contractually bind US sub-processors and disclose the transfer here. If you are in Quebec, see §13.

7. How long we keep your data

After these periods, data is hard-deleted. You can ask us to delete sooner — see §8.

Anthropic retains, on its side, content flagged by its trust-and-safety classifiers for up to 2 years (and classifier scores for up to 7 years). This is governed by Anthropic's own policy and is outside our control.

8. Your rights

Depending on where you live, you have some or all of the following rights:

• Access a copy of the data we hold about you.
• Correct data that is wrong.
• Delete your data (the "right to be forgotten").
• Receive your data in a portable format.
• Object to processing based on legitimate interest — including our training recording.
• Restrict processing while a request is being resolved.
• Withdraw consent where consent is the basis. Withdrawal does not affect processing that already happened lawfully.
• Lodge a complaint with your local data-protection authority (in the EU/UK, find yours at edpb.europa.eu/about-edpb/members; in the UK, ico.org.uk; in Canada, priv.gc.ca).

How to exercise: email contact@blakeabc.com from the address registered to your account, or ask your workspace admin to forward the request to us. We respond within 30 days (extendable by 60 days with notice for complex requests, per GDPR Art. 12(3); 45 days extendable by 45 under CCPA).

If you are not the account holder (for example, a lawyer acting on behalf of a former trainee), we will ask for proof of identity and authority before actioning the request, as we are required to do.

9. Automated decision-making

We use AI to generate feedback on your roleplay. The feedback is a starting point — your manager reviews coaching outcomes that affect performance evaluations. We do not make fully automated decisions that produce legal effects or similarly significant effects on you, within the meaning of GDPR Art. 22.

For our hiring/interview feature, scoring is also AI-assisted but final hiring decisions are taken by humans.

10. What we do not do

• We do not use your voice to identify you biometrically. We configure our AI agents to disable voice cloning.
• We do not sell your personal data.
• We do not use identifiable recordings or transcripts to train AI models. (See §5 for the Google sub-processor disclosure.)
• The microphone is only active during a roleplay session.
• We do not share your recordings outside the named providers in §5 and your employer's authorized administrators.

11. Security

Data is encrypted in transit (TLS) and at rest by our hosting providers. Access to recordings, transcripts, and feedback is role-based: trainees see only their own data; admins see only their workspace's data. We log administrative actions for audit.

Data breaches

If we discover a personal data breach affecting you, we will notify the relevant supervisory authority within 72 hours where required by GDPR Art. 33, and will notify you without undue delay where the breach is likely to result in a high risk to your rights and freedoms (Art. 34). Notification goes to the email address registered to your account; if your account is inactive, we use the most recent contact details we hold.

12. Children

BlakeABC is a workplace tool not directed at people under 18. We do not knowingly process the data of minors. If you believe we have collected such data, please contact us so we can delete it.

13. Region-specific addenda

California (CCPA / CPRA)

We collect the categories of personal information described in §2 for the purposes in §3. We do not sell or "share" personal information for cross-context behavioral advertising. California residents have the right to know, delete, correct, and limit the use of sensitive personal information. To exercise these rights, email contact@blakeabc.com. You will not be discriminated against for exercising them.

Voice recordings can qualify as "sensitive personal information" under CPRA. To limit our use of your voice data to what is strictly necessary to provide the training service, email the same address — we will restrict any secondary uses (such as anonymized aggregate product analytics) on request.

Quebec (Law 25)

If you are a Quebec resident, you have additional rights including the right to be informed of any cross-border transfer of your data and the right to be informed when an automated processing produces a decision based exclusively on it. We are designating a Privacy Officer; until that designation is published, the contact for Quebec privacy requests is contact@blakeabc.com.

United Kingdom

UK residents have rights under the UK GDPR equivalent to those in §8 and may complain to the Information Commissioner's Office (ico.org.uk).

14. Changes to this policy

We may update this policy. When we make a material change, we increment the policy version and ask you to review the in-app consent notice again before your next session. Older versions of this policy are kept on file and shown to you on request.

15. Contact

For privacy questions, requests, or complaints: contact@blakeabc.com.