Privacy Policy

Last updated: July 6, 2026

Who we are

Emic is operated by Victor Gulchenko, Germany. Contact for anything in this policy, including data requests: victor.gulchenko@gmail.com.

What we collect

Account data. Your email address, a salted hash of your password (never the password itself), and your workspace name.
Feedback and session data you send us. Reports, survey answers, session records, and interview transcripts that your integration POSTs to our API. This is your workspace's data; it may contain text authored by AI agents. We run an automated PII scrub on ingest (emails, keys, and 20+ other categories are redacted by default) because agent-authored text can accidentally contain personal data.
Usage analytics. Page views on our website via Vercel Analytics (cookieless, aggregated). We do not run advertising trackers.

What we use it for

To provide the service (store and display your workspace's feedback, deliver surveys, generate session stories and interviews), to secure it (auth, rate limits, abuse prevention), and to contact you about your account. We do not sell data. We do not use your workspace data to train models.

Where it lives (subprocessors)

Vercel (hosting, serverless functions, analytics)
Neon (Postgres database)
AWS Bedrock and/or Anthropic (LLM inference for session stories and replay interviews; inputs are your session data, used only to produce the output shown in your workspace)
Stripe (payments, only if and when you subscribe to a paid plan)

Cookies

One essential cookie: your login session (httpOnly, signed). No third-party or advertising cookies, which is why there is no cookie banner.

Retention and deletion

Workspace data is kept while your account is active. Email victor.gulchenko@gmail.com to delete your account and workspace; we delete within 30 days, backups roll off after that.

Your rights (GDPR)

If you are in the EU/EEA you have the rights of access, rectification, erasure, restriction, portability, and objection (Art. 15-21 GDPR), and the right to complain to a supervisory authority. The legal bases we rely on are contract performance (Art. 6(1)(b)) for the service itself and legitimate interest (Art. 6(1)(f)) for security and minimal analytics. Exercise any right by email; we answer within 30 days.

Changes

If this policy changes materially, we note it here with a new date and, for significant changes, email account holders.