At Distill, we take your privacy seriously. This policy explains what information we collect, how we use it, and what rights you have. We aim to be transparent and straightforward.

1. Information We Collect

Account information: When you sign up, we collect your name, email address, and organization details. If you sign in through a third-party provider (like Google), we receive basic profile information from that service.

Survey data: This includes the surveys you create, the questions you write, and the responses collected from participants. Survey responses are the property of the organization that created the survey.

Usage analytics: We collect information about how you interact with Distill, including pages visited, features used, and general usage patterns. This helps us improve the product.

2. How We Use Your Data

We use the information we collect to:

Provide and maintain the Distill service
Process survey responses and generate insights and reports
Send you account-related communications (confirmations, security alerts, updates)
Improve our product based on usage patterns
Respond to your support requests
Comply with legal obligations

We do not sell your personal information or survey data to third parties. Ever.

3. Survey Response Data

This is important, so we want to be very clear:

Survey responses belong to the organization that created the survey. Distill does not claim ownership of response data.
We process responses to generate insights. This includes sentiment analysis, theme extraction, and summary reports. This processing uses third-party language models (see Section 5).
Your survey data is not used to train AI models. Responses are processed to produce insights for your organization only. They are not fed into training datasets.
We do not sell or share survey responses with third parties for their own purposes.

4. Data Storage and Security

Your data is stored on infrastructure provided by Supabase (database) and Vercel (application hosting). All data is encrypted in transit using TLS. We follow industry-standard security practices to protect your information, including access controls, secure authentication, and regular security reviews.

No system is 100% secure. While we take reasonable measures to protect your data, we cannot guarantee absolute security. If we become aware of a breach, we will notify affected users promptly.

5. Third-Party Services

We use the following third-party services to operate Distill:

Supabase: Database and authentication infrastructure
Vercel: Application hosting and deployment
Stripe: Payment processing (if applicable to your plan)
OpenAI and Anthropic: Language model providers used to analyze survey responses and generate insights. Survey data sent to these providers is processed according to their data processing agreements and is not used to train their models.

Each of these services has its own privacy policy. We choose partners who meet our standards for data protection and security.

6. Cookies

Distill uses essential cookies to keep you logged in and maintain your session. We may also use analytics cookies to understand how people use the product. We do not use advertising or tracking cookies. You can disable cookies in your browser settings, but some features may not work properly without them.

7. Data Retention

We retain your account data for as long as your account is active. Survey data is retained until you or your organization deletes it. If you delete your account, we will remove your personal information within 30 days, except where we are required by law to retain it. Aggregated, anonymized data that cannot be linked back to you may be retained indefinitely.

8. Your Rights

You have the right to:

Access the personal data we hold about you
Delete your account and associated data
Export your survey data in a portable format
Correct inaccurate information in your account
Withdraw consent for data processing where consent is the basis

To exercise any of these rights, contact us at hello@getdistill.tech. We will respond within 30 days.

9. Children's Privacy

Distill is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 16, we will delete it promptly.

10. International Data Transfers

Distill is based in Canada. Your data may be processed and stored in Canada, the United States, or other countries where our service providers operate. By using Distill, you consent to the transfer of your data to these locations. We ensure that appropriate safeguards are in place for international transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. For significant changes, we will make reasonable efforts to notify you via email or an in-app notice. Continued use of Distill after changes are posted means you accept the updated policy.

12. Contact

Questions or concerns about this policy? Reach out at hello@getdistill.tech.