This Privacy Policy explains how Highline Beta Inc. ("Highline Beta", "we", "us") collects, uses, and protects information when you use Candor (the "Service"), available at runcandor.com. The legal basis for each use of your information is set out below.
Information we collect
We collect the following categories of information:
- Account information. When you sign up, we collect your name, email address, and authentication identifiers. If you sign in with Google, we receive your name, email, and profile picture from Google — nothing else.
- Waitlist information. If you join our waitlist before general availability, we collect your email address. We look up publicly available professional and company information associated with that email (for example, your company’s homepage or a public LinkedIn profile) to evaluate fit and prioritize outreach. We do not purchase private personal data for this purpose. You can request deletion at any time via the contact email below; the rest of this policy applies to that data.
- Emails from us. When you create a Candor account or accept an invitation to a workspace, we add your email address (and your name, when you gave it) to our email list in Mailchimp, so we can send you factual updates about Candor and your account. If you tick the marketing box when you sign up or accept an invitation, or use the newsletter box on our website, we also mark you as wanting marketing emails, and only people marked that way receive them. Every email has an unsubscribe link, and deleting your Candor account unsubscribes you.
- Workspace content. Study definitions, uploaded documents, research inputs, generated synthetic participants, interview transcripts, and any other content you create or upload to the Service. For this content we act on your behalf, under our Data Processing Agreement, which governs how we use it where the two differ.
- Feedback answers. When you answer our in-app feedback questions, we store your answers and any comments you add. We use them to improve the Service.
- Help chat conversations. When you use the in-app help assistant, we store your messages and its replies, along with the page you were on. We use these to find where the Service or its help content is unclear. They are kept for 180 days, then deleted, and they are removed with your account if you ask us to delete it.
- Usage data. Logs of Service activity (requests, errors, timestamps, IP address, browser/device metadata) for reliability, security, and product improvement.
- Product analytics and session replay. Only if you have accepted analytics cookies, and only inside the signed-in application, we record how the interface is used: pages visited, clicks, scrolling, and the path taken through a task. This includes a replay of the session, which reproduces the screen as it appeared, so workspace content visible on the page at the time is visible in the replay. What you type into a field is masked before it is sent, and passwords and payment details are never captured at all. Profile photos and two-factor setup codes are excluded. We use this to find where the Service is confusing or broken. Decline, or withdraw later, and none of it happens.
- Billing information. When a workspace pays for Candor, our payment processor, Stripe, receives the workspace name, billing email address and workspace ID, and holds the subscription and invoice records. Card details are entered on Stripe’s own checkout page and never pass through Candor.
How we use information
- To provide, maintain, and improve the Service.
- To authenticate you and secure your account.
- To run the AI and search components of the Service on your behalf (e.g. generating synthetic participants, answering interview prompts).
- To communicate with you about the Service, including updates and support.
- To detect, prevent, and address fraud or abuse.
- To comply with legal obligations.
Our legal bases for using information
Data protection law in the European Economic Area, the UK and Switzerland requires a legal basis for each use of personal information. These are ours:
- Providing the Service. Your account, sign-in, running your studies, service and support emails, and billing: performance of our contract with you or your organization.
- Workspace content. We process it on behalf of your organization under our Data Processing Agreement. Your organization decides why it is processed and relies on its own legal basis.
- Security and reliability. Usage logs, error monitoring, and fraud and abuse prevention: our legitimate interest in keeping the Service secure and working.
- Improving the Service. Feedback answers, help chat conversations and usage data: our legitimate interest in finding where the Service is unclear or broken.
- Waitlist. Keeping the email address of people who join the waitlist, and looking up public professional information about them: our legitimate interest in managing the waitlist and prioritizing outreach.
- Analytics, session replay and the booking calendar. Your consent, given through the cookie banner.
- Marketing emails you asked for. The marketing box on the sign-up or invitation page, or the newsletter box: your consent.
- Product and account updates to account holders. Factual emails about Candor and your account: our legitimate interest in keeping people informed about the service they use. Every email has an unsubscribe link.
- Legal requirements. Keeping billing and tax records, and responding to lawful requests: compliance with a legal obligation.
You can withdraw consent at any time, through your cookie settings or the unsubscribe link, without affecting anything done before. Where we rely on legitimate interests, you can object, as described under "Your rights" below.
Third-party service providers
The Service relies on a small number of subprocessors to function. Each receives only the data needed to perform its role:
- Supabase — authentication, database, and file storage.
- Vercel — application hosting and edge delivery.
- Google — Sign-in with Google (OAuth) and Google Analytics on the public marketing pages. Analytics collects page-view, referrer, and aggregate-visitor data through cookies; it does not run on the authenticated application.
- Anthropic — large-language-model inference used to generate synthetic participants, run interview simulations, and synthesize research outputs. Prompts and outputs are processed by Anthropic under their API terms and are not used to train their models.
- Voyage AI — text embeddings for document search.
- Tavily — web search used to ground generated evidence.
- TypeSafe: small judgements while you set up a study, during audience research, during simulated interviews, when reading which option a participant picked in a concept test, and when grading how each option landed in a value proposition or messaging test. While you set up a study it receives what you wrote about the audience, with the age, role, region, company size and income you entered, and checks the age, role and region boxes against what you wrote. For audience research it receives the research questions planned for your study and the findings returned by web search. For interviews it receives excerpts of the transcript. To read a final pick it also receives the names and shortened descriptions of the options you are testing. To grade an option it receives the name and description of the product being tested, the option’s statement, and the participant’s answers about it. It never receives uploaded documents, and does not use any of it to train its models.
- Inngest — background job orchestration.
- Resend — transactional email delivery.
- Mailchimp: our email list. It holds the email address of every Candor account holder, with the name given at sign-up or when accepting an invitation, and the email address of people who ask for Candor news through the newsletter box.
- Calendly: the scheduling calendar on the Book a Demo page. It loads only for a visitor who has accepted functional cookies. It receives what that visitor enters to book, plus the IP address, browser details and cookies any embedded page receives, never account information or workspace content.
- Fullstory — product analytics and session replay inside the signed-in application, so we can see where the product is confusing or broken. A replay reproduces the screen as it appeared, so workspace content on the page is visible to our team in the recording. What you type into a field is masked before it leaves your browser, passwords and payment details are never captured, and profile photos and two-factor setup codes are excluded. Fullstory receives account identifiers only (user ID, workspace ID, role, plan), plus your workspace name if you have set one, and never your own name or email address. It runs only for someone who has accepted analytics cookies; it does not run on these public pages or on the admin console, and it is switched off while our support staff are viewing an account on a customer’s behalf.
A complete, versioned list with data-residency and legal-entity detail is maintained at /subprocessors.
Cookies and your choices
We use three kinds of cookies. The first kind is needed for the Service to work at all: keeping you signed in, and remembering the cookie choice you make below. These are set whenever you use the Service, because without them it cannot function. The consent banner and the record of your choice are run for us by CookieYes, listed at /subprocessors with everything it receives.
The second kind makes a feature work that we do not run ourselves. Booking a demo uses Calendly’s scheduling calendar, shown inside our page. Calendly sets its own cookies the moment that calendar loads, one of which lasts a year, so we do not load it until you agree. Decline and the booking page gives you a link to Calendly’s own site and an email address instead, and nothing reaches Calendly from our page at all. Calendly is listed at /subprocessors.
The third kind measures how the Service is used. Google Analytics tells us how people find and move through our public pages. Fullstory records sessions inside the signed-in application, so we can see where the product is confusing or broken. Neither is set until you agree to it. If you decline, nothing is stored in your browser by either one, neither can recognise you or your device, and Fullstory records nothing at all.
You can change or withdraw your choice at any time, and it takes effect immediately: . Your answer is stored in your browser, so it applies to this browser on this device and needs making again elsewhere.
How we share information
We do not sell your personal information. We share information only: (i) with the subprocessors listed above, to operate the Service; (ii) with other users of your workspace, to the extent you add them or share content with them; (iii) when required by law, valid legal process, or to protect the rights, property, or safety of users or the public; and (iv) as part of a business transfer (merger, acquisition, or asset sale), in which case we will notify you.
Data retention
We retain account and workspace content for as long as your account is active. You may delete studies, synthetic participants, and uploaded documents at any time from the app. Uploaded documents are also deleted automatically 30 days after upload, unless your workspace sets a different window. When you delete your account, we remove your personal information from our systems within 30 days, except where retention is required by law or for legitimate business purposes such as fraud prevention and dispute resolution. Workspace content belongs to the workspace rather than to you, so studies and projects you created stay available to the rest of your team, without your name attached.
Copies held by the AI and search providers listed above follow each provider’s own terms, and deleting your account does not reach them. Anthropic deletes what it receives within 30 days unless it is flagged for a usage-policy review, and Voyage AI deletes it as soon as it has been processed. Our web-search and interview quality-check providers set no fixed deletion period. What each one receives is listed at /subprocessors.
Session recordings held by our product-analytics provider are not removed when you delete your account either. They expire on the provider’s own retention schedule, and we will delete yours on request at ben@highlinebeta.com.
Your rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw any consent you have given. You can export your data and schedule its deletion yourself from Settings → Security. To exercise any other right, email us at ben@highlinebeta.com. We respond within one month.
If you are in the European Economic Area, the UK or Switzerland, you also have the right to complain to a data protection authority, usually the one where you live or work. In the UK that is the Information Commissioner’s Office. We’d welcome the chance to resolve your concern first.
Security
We use industry-standard measures to protect your information, including encryption in transit, encrypted storage at rest via our infrastructure providers, and role-based access controls. No service can guarantee absolute security.
Children
The Service is not directed to children under 16, and we do not knowingly collect personal information from children.
International transfers
Highline Beta is based in Canada, and the Service is hosted in the United States. Some subprocessors operate from other countries, listed at /subprocessors. If you use the Service from elsewhere, your information is transferred to and processed in those countries.
For information from the European Economic Area, the UK or Switzerland, we protect these transfers as follows. The European Commission, the UK and Switzerland each recognize Canada as giving adequate protection, so transfers to Highline Beta need no further safeguard. Transfers to the United States, or to any other country without that recognition, rely on the EU Standard Contractual Clauses (with the UK Addendum and the Swiss changes) or on the recipient’s certification under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. For workspace content, the Standard Contractual Clauses are part of our Data Processing Agreement. To ask for a copy of these safeguards, email ben@highlinebeta.com.
Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect.
Contact
Questions about this Privacy Policy? Email ben@highlinebeta.com, or write to Highline Beta Inc., 372 Bay St., Suite 200, Toronto, ON M5H 2W9, Canada.