Privacy Notice

1. Who we are

A/B Simulate is operated by Jacquard Group Limited (Jacquard, we, us). Jacquard Group Limited is registered in England and Wales under company number 09453268. Its registered office is 82 St John Street, London, United Kingdom, EC1M 4JN.

Questions and privacy requests can be sent to privacy@jacquard.com. This notice should be read with the A/B Simulate Terms of Service and the shorter Data Use statement.

2. Our role

Jacquard is controller for personal data used to manage A/B Simulate accounts, authentication, billing, security, service communications and the operation of the service.

Marketing text and campaign information submitted by a customer are Customer Content. If Customer Content contains personal data, the customer is normally controller and Jacquard processes that data on the customer's behalf. The Data Processing Terms in the Terms of Service apply to that processing.

3. Personal data we collect

Account and authentication data

• name, work email address and profile image, where provided;
• sign-in method and provider identifiers;
• authentication tokens and database-backed session records needed to sign you in and keep you signed in; and
• your workspace, role, brand access and last-active information.

Workspace, team and billing data

• workspace and brand names, plan, credit balance and service settings;
• team membership, roles and the email addresses of people invited to a workspace;
• API-key name, display fragment, creator and use dates; A/B Simulate stores only a one-way hash of the key itself; and
• Stripe customer and subscription identifiers, plan status, renewal date and a limited card description such as card brand and last four digits. Stripe, not Jacquard, holds the full card details.

Submitted copy and predictions

A/B Simulate stores each submitted variant of marketing text, the channel, its position in the simulation, its predicted rank and predicted lift against the control, time of the check, workspace and brand, and whether it came from a user, connected assistant or API key. Checks made before A/B simulations keep the score and verdict they were given. This allows the customer to see history and usage and allows A/B Simulate to provide the service.

Optional aggregate campaign results

If a customer chooses to share results, A/B Simulate may receive the exact marketing line, total sends or impressions, total clicks, optional aggregate opens and attributed revenue, channel and send date. A/B Simulate associates that submission with the relevant workspace, brand, user, assistant or API key and, where possible, the earlier check.

These are campaign totals, not individual events. A/B Simulate does not solicit or provide fields for recipient names, email addresses, telephone numbers, subscriber lists, device identifiers or recipient-level engagement histories. Customers must not submit that information. Aggregate campaign totals that cannot reasonably identify an individual are not personal data, but Jacquard treats them as confidential Customer Content.

Connected assistants

When an AI assistant connects, A/B Simulate records the client registration, redirect addresses, the verified assistant name or unverified host label, the user, workspace and selected brand, and hashed access and refresh tokens. The assistant can submit copy and, when the user asks it to, aggregate campaign results. A/B Simulate returns predicted rankings and lifts, results and credit information to the assistant through the connected session.

Technical and security data

A/B Simulate records request identifiers, route, method, response status, timing, service events and authenticated account, workspace, connection or API-key identifiers. Application logs exclude submitted copy, request and response bodies, email addresses and credentials. Infrastructure security and access logs may include IP address, requested URL, user agent, timestamps, security-rule decisions and similar connection information.

If you contact us, we also process the details and contents of the correspondence needed to answer and keep an appropriate support record.

Analytics

If you accept analytics: records of how you use A/B Simulate, collected by PostHog, including recordings of your sessions showing the pages you view and what's on them, such as the copy you check and its results. Password fields are never recorded.

When you visit our marketing pages: RB2B, a website-visitor identification service, receives the address of each marketing page you view along with information from your browser and network connection, such as your IP address and cookie identifiers. For visitors in the United States, RB2B may match this to a business or a professional profile. RB2B doesn't run in the A/B Simulate app, on sign-in pages or on the connection approval page.

4. Where the data comes from

We receive personal data:

• from you and other authorised workspace users;
• from Google or Microsoft if you choose that sign-in method;
• from a connected AI assistant or API client acting on your instructions;
• from Stripe in connection with subscription and payment status; and
• automatically from browsers, devices and infrastructure when A/B Simulate is used.

A/B Simulate does not connect directly to an email, advertising or other marketing platform to obtain Customer Content or campaign results.

5. Why we use personal data

• Provide A/B Simulate and perform the contract: create accounts, authenticate users, score copy, store history, display aggregate results, manage workspaces, provide API and assistant connections, allocate credits and administer subscriptions.
• Operate and protect the service: prevent abuse, enforce limits, investigate faults and security incidents, maintain audit trails and protect Jacquard, customers and users. We rely on our legitimate interests in running a secure and reliable business service.
• Communicate: send sign-in links, invitations, connection notices, low-credit messages, billing information and important service or legal updates. This is necessary to provide the service and administer the customer relationship.
• Meet legal obligations and establish or defend legal claims: including accounting, tax, regulatory and law-enforcement requirements.
• To understand how A/B Simulate is used and improve it, using PostHog analytics and, if you accept, session recordings. We rely on your consent for cookies and recordings, and on our legitimate interests for counting visits anonymously before you choose.
• To find businesses that may be interested in A/B Simulate, using RB2B on our marketing pages. We rely on our legitimate interests in understanding which organisations visit our website.

Jacquard does not use submitted copy or aggregate campaign results to train or improve Neural 2.1 or another model unless Jacquard and the customer separately agree that use in writing. A/B Simulate does not use personal data for advertising and does not sell personal data.

A/B Simulate's scores evaluate marketing text, not people. A/B Simulate does not make solely automated decisions about individuals that produce legal or similarly significant effects.

6. Who receives the data

We may disclose relevant data to:

• Amazon Web Services, including Amazon SES: application and model hosting, database, backups, security logs and transactional email;
• Stripe: subscription and payment processing;
• Google or Microsoft: authentication, only if you choose that provider;
• the connected AI assistant: the tool response and related information needed to complete a request made through that assistant;
• professional advisers, auditors and insurers under duties of confidentiality;
• authorities or other parties where required by law or reasonably necessary to protect legal rights;
• PostHog (EU cloud): product analytics and, if you accept the analytics banner, session recordings;
• RB2B: identification of website visitors on our marketing pages. See RB2B's privacy notice at rb2b.com/privacy-policy.
• a buyer, investor or successor in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

An AI assistant, email platform or advertising platform chosen by the customer is governed by the customer's relationship with its provider. It is not Jacquard's subprocessor merely because the customer uses it to send information to or receive information from A/B Simulate.

7. Locations and international transfers

A/B Simulate's application, database and self-hosted Neural 2.1 service run in Amazon Web Services in Ireland (eu-west-1). Some providers, including Stripe, Google and Microsoft, may process data in other countries under their service arrangements. PostHog's EU cloud processes analytics data and recordings in the European Union. RB2B processes visitor data in the United States.

Where personal data is transferred from the UK or European Economic Area to a country without an applicable adequacy decision, Jacquard uses a lawful safeguard such as the UK International Data Transfer Agreement or Addendum and the European Commission's Standard Contractual Clauses, together with supplementary measures where required. Contact privacy@jacquard.com for information about relevant safeguards.

8. Retention

• Account, workspace and Customer Content: while the workspace is active. Following workspace closure or a verified deletion request, in-scope records are deleted or irreversibly anonymised within 30 days, unless a legal obligation or documented legal hold requires retention.
• Backups: residual copies expire through the normal backup cycle no later than 90 days after operational deletion and are isolated from ordinary use.
• Application, security, WAF and load-balancer logs: 30 days.
• Sign-in and connection credentials: for their configured validity period or until use, expiry or revocation.
• Billing and tax records: up to six years where needed for legal, tax and accounting purposes.
• Support and legal records: for as long as reasonably required to resolve the matter and establish or defend legal claims.
• Analytics (PostHog): session recordings up to 1 year. Following workspace closure or a verified deletion request, recordings linked to your account are deleted within 30 days, as with other Customer Content.

Automated customer-content deletion is being implemented. Until it is available, Jacquard will fulfil verified closure and deletion requests through a controlled manual process.

9. Cookies

A/B Simulate uses cookies needed to provide and secure the service (a session cookie, sign-in security and callback cookies, and short-lived cookies for email-link sign-in). A/B Simulate also uses PostHog (EU cloud) for product analytics. Until you accept the analytics banner, or if you decline it, no cookies or similar identifiers are stored on your device and no personal profile is created in PostHog; PostHog counts visits using a privacy-preserving code generated on its servers, not a cookie. Accepting lets PostHog set cookies to recognise repeat visits from the same browser, associate activity with your account if you're signed in, and record your sessions (see "Personal data we collect"). You can change your choice at any time from "Analytics settings" in the footer; declining stops further recording.

Our marketing pages load RB2B, which sets its own cookies to recognise returning visitors. You can block them in your browser's settings. You can also opt out at app.retention.com/optout.

10. Security

Jacquard uses technical and organisational safeguards appropriate to the risk. These include encrypted external connections, encrypted database and log storage, access controls, hashed API and connection credentials, structured log redaction, monitoring, backups and confidentiality obligations. No internet service can guarantee absolute security. Please report a suspected security issue to infosec@jacquard.com.

11. Your rights

Depending on the law that applies, you may have rights to access, correct, erase or restrict personal data, object to certain processing, receive portable data, and withdraw consent where processing relies on consent. You may also complain to the UK Information Commissioner's Office or your local data-protection authority.

Send a request to privacy@jacquard.com. We may need to verify your identity and, where Customer Content is concerned, coordinate with the customer that controls the data. Rights may be subject to legal exemptions.

12. Children

A/B Simulate is a business service for people aged 18 or over. It is not directed to children, and customers must not submit children's personal data in Customer Content.

13. Changes and contact

We may update this notice to reflect changes in A/B Simulate, the law or our processing. We will change the date above and, where a change materially affects users, provide a prominent notice or email before it takes effect where practicable.

Contact: privacy@jacquard.com, or write to General Counsel, Jacquard Group Limited, 82 St John Street, London, United Kingdom, EC1M 4JN.