Awesome Ted Privacy Notice

1. Who we are

Awesome Ted is a team feedback platform. Ted, a friendly AI agent, talks each person through a short reflection built on their organisation's own framework, and turns peer feedback into fair results that can be explained.

Versions for higher education, workplace and healthcare training

Awesome Ted ("we", "us", "our") is an extension of Business Case Logic, based in the United States and powered by Janna AI. Ted's agent technology is built by Janna AI Research Labs.

• Privacy contact: support@awesometed.com

2. Our two roles: website and platform

This notice covers two situations, and our legal role differs between them.

2.1 Our website (awesometed.com)

When you use our "Book a demo" or "Contact us" forms, we decide why and how your details are used. We are the controller (in US terms, the business) for that information.

2.2 The Awesome Ted platform (app.awesometed.com)

When a university, company or other organisation ("your organisation") uses Awesome Ted with its people, your organisation decides why the platform is used, who uses it and what happens to the results. Your organisation is the controller (in US terms, the business, or for US schools the educational institution), and we act as its processor (service provider, or "school official" under FERPA). We process platform data only on your organisation's documented instructions, under a data processing agreement.

If you use Awesome Ted through your organisation:

• your organisation's own privacy notice also applies;
• you should send requests about your data to your organisation first;
• if you contact us, we will pass your request to your organisation and help it respond.

We act as a controller for platform data only for our own limited purposes: securing the service, preventing abuse, billing your organisation, and meeting our legal obligations.

3. Information we collect on our website

We also briefly process technical information needed to deliver and protect the website, such as your IP address and browser type. This is used by our hosting and security provider to stop abuse, and is not used to identify you or build a profile.

To stop our forms being used to send unwanted email to other people:

• the automatic confirmation we send repeats only your first name and the option you chose (such as the topic or team size). It never repeats your message;
• we keep a scrambled, one-way fingerprint of the email address entered for 24 hours, so the same address cannot be sent repeated confirmations. The fingerprint cannot be turned back into your email address and is deleted automatically after 24 hours.

We do not use cookies, analytics, advertising trackers or third-party scripts on our website.

4. Information processed on the Awesome Ted platform

Depending on how your organisation uses Awesome Ted, the platform processes the following.

Some reflections may reveal sensitive information, for example about health or wellbeing, if you choose to share it. We treat any such information with extra care (see sections 5, 7 and 13).

5. How we use information and our legal bases

Where data protection laws require a legal basis, we rely on the following. For platform data, your organisation determines the legal basis for its own purposes; the bases shown for platform data are those we expect organisations to use, and those we use for our own limited purposes.

Where we rely on legitimate interests, we have balanced those interests against your rights. You can ask us for details and you can object (section 12).

We do not sell personal information, do not share it for cross-context behavioural advertising, and do not use it for targeted advertising.

6. How AI is used, and human review

Ted uses AI models to:

• hold the reflection conversation and ask follow-up questions;
• understand your organisation's framework documents and check that questions are covered by them;
• help evaluate the quality of reflections.

Your professor or lead can review any result and adjust it. Awesome Ted does not make decisions that produce legal or similarly significant effects on you based solely on automated processing. See section 13.4 for your rights in relation to automated processing.

To protect your privacy when using AI:

• we send our AI providers only what each task needs, using first names or pseudonyms in place of full details where possible;
• our AI providers process data under agreements that do not allow them to use it to train their models;
• common ways of hiding text in uploaded PDFs are detected and that text is removed before Ted sees it, and organisations are told when some was found;
• Ted treats documents and what people say as information, never as new instructions; attempts to change its rules that Ted detects are refused and flagged.

6.1 Talking with Ted by voice

If your organisation turns voice on, you can talk with Ted instead of typing. Voice is optional: you choose it each time, and you can switch to typing at any time.

• When you talk, your voice goes from your browser straight to our AI model provider, OpenAI, so Ted can hear and answer you. Our own servers never receive the sound of your voice, and we do not record or keep it.
• OpenAI keeps the data of a voice call for up to 30 days to check for misuse, and does not use it to train its models.
• A written transcript of what you and Ted say is made by speech recognition and kept as the record of your session, for the same people and for the same time as a typed conversation (sections 7 and 10). The captions shown during a call are not kept.
• Speech recognition can mishear. You see what Ted heard as captions during the call, and you can say it again or switch to typing. Your professor or lead can review any result.
• Before a call starts, the platform explains this, and your browser asks for your permission to use the microphone. The microphone is used only during the call.

7. Who can see what

• You can see your own reflections, the feedback and results released to you, and your own grade or result.
• You never see which teammate gave which rating; you see summaries only.
• Professors and leads see the reflections, results and concern flags for their own classes or teams. They see peer feedback as summaries and rater counts, not as individual ratings.
• Organisation administrators can see data across their organisation where their organisation enables it.
• Our staff access platform data only when needed to provide support, keep the service secure, or meet legal obligations.
• Frameworks an organisation submits for public sharing are read by the Janna AI review team. Reviewers see the framework as submitted (its text, source, Ted test run checks and rights confirmation) and the name it is shared under. If you report a framework, reviewers read the reason and note you write, but not your name or organisation. Reviewers do not see your sessions, conversations, feedback or grades.
• Each organisation's data is kept separate from every other organisation's at the database level.

8. Who we share information with

We share information only as described here.

8.1 Service providers (sub-processors)

We use a small number of carefully selected service providers to run Awesome Ted. Each one acts only on our instructions.

Every provider is bound by a written contract that limits its use of personal information to providing its service to us and requires appropriate security. Our AI model providers may not use your information to train their models. Organisations receive the full list of named sub-processors in our data processing agreement, and anyone can request it by emailing support@awesometed.com. We give organisations notice before adding or replacing a sub-processor, so they can object.

8.2 Your organisation

On the platform, information is shared with your organisation as described in section 7.

8.3 Legal and safety reasons

We may disclose information where required by law, regulation, legal process or an enforceable government request, or where necessary to protect the rights, safety and security of our users, the public or our service. Where lawful, we will tell your organisation before disclosing platform data.

8.4 Business changes

If we are involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to this notice.

9. International transfers

Our providers are based in, or process data in, the United States and other countries that may not have the same data protection laws as your country. Where the law requires it, we protect transfers with appropriate safeguards, such as:

• the European Commission's Standard Contractual Clauses;
• the UK International Data Transfer Addendum;
• the EU-US Data Privacy Framework and its UK and Swiss extensions, where a provider is certified;
• equivalent mechanisms recognised in other countries.

You can ask us for a copy of the relevant safeguards.

10. How long we keep information

10.1 How retention works

• Organisations can choose shorter periods than these defaults (within minimum periods that protect appeals and consent records), but never longer.
• Deletion is automatic. A scheduled job deletes records when their period ends and records only the number of items deleted, never their content.
• Legal holds: an organisation administrator may place a hold on specific records needed for an appeal, complaint or legal matter. Held records are not deleted until the hold is released. Every hold is recorded with a reason.
• Backups: deleted information is removed from backups as they expire, within about 4 weeks. If a backup is ever restored, the deletion job runs again before the service reopens, so deleted information does not come back.
• Provider copies: our AI and email providers keep only what their agreements allow, for the shortest period they offer, and never for training.

10.2 Deleting your account or your data

• Website enquiries: ask us at support@awesometed.com and we will delete your enquiry from our inbox, unless we must keep it for a legal reason.
• Platform accounts: ask your organisation. It can remove you from its classes or teams and close your account. Records your organisation must keep (for example grades needed for an appeal) are kept only for the retention period above, and then deleted.
• Your own copy: before deletion, you can ask for an export of your own data. The export contains the reflections you wrote, the evaluations of them and your results, and does not contain other people's feedback or identities.

10.3 When an organisation stops using Awesome Ted

When an organisation's contract ends, it can export its data for 30 days. We then delete its platform data, including content, reflections, results and accounts that belong only to that organisation, within 30 days, except for records we must keep by law (such as consent and audit records for their stated periods). Deleted data leaves our backups as they expire.

10.4 Anonymised and aggregated information

We may keep information that has been anonymised so that it can no longer identify anyone, and aggregated statistics (for example how many sessions were completed), to understand and improve our service. Research exports are pseudonymised with names, emails and identifying details removed, and are used only with consent as described in section 5.

11. How we protect information

Our security measures include:

• encryption of connections to the platform, between our services and to our providers, and encryption at rest of notes about wellbeing and other concerns;
• strict separation between organisations enforced in the database;
• role-based access, so people see only what their role allows;
• strong sign-in protection, including single-use codes and hashed passwords;
• rate limits and abuse protection on sign-in and forms;
• strict security headers and no third-party scripts on our website;
• logs that exclude reflection content and identify people only by pseudonyms;
• tamper-evident audit logs of sensitive actions;
• regular security reviews of every change before release.

No system is perfectly secure, but we work continually to protect your information.

12. Your rights, wherever you live

Depending on where you live, you may have some or all of these rights:

• to know what personal information we hold about you and how we use it, and to get a copy (access);
• to correct inaccurate information (rectification);
• to have information deleted (erasure);
• to restrict or object to certain uses, including uses based on legitimate interests;
• to receive your information in a portable format (portability);
• to withdraw consent at any time, without affecting earlier use;
• not to be subject to solely automated decisions with significant effects;
• to opt out of sale, sharing or targeted advertising (we do none of these);
• not to be treated differently for exercising your rights.

How to make a request:

• For website information, email support@awesometed.com.
• For platform information, contact your organisation first, because it controls that data. You may also contact us and we will forward your request and help your organisation respond. The platform can produce an export of your own data.
• You may use an authorised agent where the law allows; we may ask the agent for proof of authority.

We will verify your identity before acting on a request, normally by confirming access to your email address. We respond within the time the law requires (for example one month under GDPR, extendable in some cases, and 45 days under California law, extendable once). If we refuse a request, we will explain why and how you can appeal or complain.

13. Regional information: European Economic Area, United Kingdom and Switzerland

13.1 Controller and representatives

See section 1 for our details and representatives, and section 2 for when your organisation is the controller.

13.2 Legal bases

See section 5.

13.3 Special category data

Reflections may reveal health or wellbeing information if you choose to share it. Concern flags may record that such a concern was raised. Where this is special category data, it is processed only where a condition under Article 9 GDPR applies, such as your explicit choice to disclose it to receive support, protection of vital interests, or the substantial public interest conditions available to your organisation under applicable law. Such flags are visible only to the responsible professor or lead and your organisation's administrators, and notes are encrypted.

13.4 Automated decision-making (Article 22)

Ted helps evaluate reflections, and your professor or lead can review any result and adjust it. Awesome Ted is not used for decisions based solely on automated processing that produce legal or similarly significant effects. You can ask for a human to review any evaluation and to explain how it was reached, and you can contest it, through your organisation.

13.5 Complaints

You have the right to complain to a supervisory authority, in particular in the country where you live, work or where an alleged breach took place. In the UK this is the Information Commissioner's Office (ico.org.uk). In Switzerland it is the Federal Data Protection and Information Commissioner (FDPIC). In the EU, see the list of authorities at edpb.europa.eu. We would welcome the chance to address your concern first.

14. Regional information: United States

14.1 California (CCPA, as amended by the CPRA)

In the last 12 months, for our website, we collected these categories of personal information: identifiers (name, email); professional information (organisation, role); and internet or network activity limited to security logs. For the platform, acting as a service provider to organisations, we process: identifiers; professional or education information; inferences limited to the evaluation of reflections within your organisation's programme; and, only if you choose to share it, sensitive personal information about health or wellbeing.

• Sources: you, your organisation, and information generated by the platform.
• Purposes: as described in sections 5 and 6.
• Disclosures for a business purpose: to the service providers in section 8.1.
• Sale or sharing: we do not sell or share personal information (including for cross-context behavioural advertising), and we have not done so in the last 12 months. We have no actual knowledge of selling or sharing information of consumers under 16.
• Sensitive personal information: we use it only for purposes permitted under the CCPA regulations, such as providing the service you or your organisation requested, and do not use it to infer characteristics about you.
• Retention: see section 10.
• Your rights: to know, delete, correct, and limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. Use the methods in section 12.
• Opt-out preference signals: our website honours Global Privacy Control (GPC) signals as a request to opt out of sale or sharing, although we do neither.

14.2 Other US state privacy laws

Residents of states with comprehensive privacy laws, including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, may have rights to access, correct, delete and port their information, and to opt out of targeted advertising, sale and certain profiling. We do not sell personal information, do not engage in targeted advertising, and do not carry out profiling that produces legal or similarly significant effects. To make a request or appeal a decision, contact us as in section 12. If we deny your request, you may appeal by replying to our decision, and if you are not satisfied you may contact your state attorney general.

14.3 Education records (FERPA)

When a US educational institution uses Awesome Ted, student information may be part of education records under the Family Educational Rights and Privacy Act. We act as a school official with a legitimate educational interest, under the institution's direct control, and we use education records only for the purposes the institution authorises. We do not re-disclose them except as FERPA allows. Students should direct requests to inspect or amend education records to their institution.

14.4 Children (COPPA)

Awesome Ted is not directed to children under 13, and we do not knowingly collect personal information from children under 13. See section 16.

14.5 Do Not Track

Our website does not track you across sites, so we do not respond differently to browser Do Not Track signals.

15. Regional information: other countries

Where these laws apply, you have the rights described in section 12, and the following also applies.

• Canada (PIPEDA and provincial laws, including Quebec Law 25): we obtain meaningful consent where required, limit collection to what is needed, and you may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.
• Australia (Privacy Act 1988 and Australian Privacy Principles): you may access and correct your information, and complain to the Office of the Australian Information Commissioner (oaic.gov.au) if we do not resolve your concern.
• Brazil (LGPD): you may confirm processing, access, correct, anonymise, port or delete your data, obtain information about sharing, and revoke consent, and you may complain to the ANPD. Our legal bases are those in section 5.
• Nigeria (Nigeria Data Protection Act 2023): we process personal data lawfully, fairly and for specified purposes, and you may complain to the Nigeria Data Protection Commission.
• South Africa (POPIA): you may access and correct your information and object to processing, and complain to the Information Regulator.
• India (Digital Personal Data Protection Act 2023): we process digital personal data for the purposes described, you may access, correct and erase it and nominate another person to exercise rights, and grievances may be raised with us and then the Data Protection Board of India.
• Singapore (PDPA): you may access and correct your information and withdraw consent, and complain to the Personal Data Protection Commission.
• Japan (APPI): we handle personal information for the purposes described, take security measures, and transfer it abroad only as the APPI permits; you may request disclosure, correction or suspension of use.
• Switzerland (nFADP): see section 13.

If you live in a country not listed here, you can still use the rights in section 12 and contact us with any concern.

16. Children and age

Awesome Ted is intended for people aged 18 or over. Users confirm this when they accept the terms. Where an organisation allows younger people to use Awesome Ted, the organisation is responsible for obtaining any consent required by law, including parental consent. Awesome Ted is not directed to children under 13 (or the higher age set by local law) and we do not knowingly collect their personal information. If you believe a child has provided us information without the required consent, contact us and we will delete it.

17. Cookies and similar technologies

• Our website uses no cookies, analytics or advertising technologies.
• The platform uses only cookies that are strictly necessary to keep you signed in securely and protect your account. These do not require consent under the ePrivacy rules.
• The platform stores your light or dark appearance choice in your own browser. It is not sent to us.

18. Data breaches

If a personal data breach occurs, we will act quickly to contain it, assess the risk, and notify your organisation without undue delay so it can meet its obligations. Where we are the controller and the law requires it, we will notify the relevant authority (for example within 72 hours under GDPR) and affected people.

19. Changes to this notice

We will update this notice when our practices change and show the new date at the top. If a change is significant, we will tell organisations and users before it takes effect.

20. How to contact us

Awesome Ted, an extension of Business Case Logic, powered by Janna AI

United States

Privacy: support@awesometed.com

General support: support@awesometed.com