Legal

Privacy Policy

Last updated: October 2026

Legal documents

Privacy Policy

Terms and Conditions

Trust Center

Questions

Email hello@secondbody.co or write to SecondBody Inc., 2061 Broadway, Suite 5, New York, NY 10023.

Useful links: SecondBody Trust Center

Introduction

SecondBody Inc. (“SecondBody,” “we,” “us,” or “our”) is committed to protecting your privacy and ensuring transparency about how we collect, use, and protect your personal information.

This Privacy Policy describes how we process personal data when you use our AI-powered conversation simulation platform (“Service”). By using our Service, you acknowledge that you have read and understood this Privacy Policy.

Important: Our Service processes voice recordings using artificial intelligence. Please read this Privacy Policy carefully, particularly the sections on voice data processing and your rights.

Who We Are

SecondBody Inc.
2061 Broadway, Suite 5
New York, NY 10023
Email: hello@secondbody.co

For EU/UK users, we act as a data controller for your personal information.

Information We Collect

Voice Recordings and Audio Data

As the core of our AI conversation simulation service, we collect and process:

  • Voice recordings during your conversations and practice sessions

  • Audio quality metadata (volume levels, background noise indicators)

  • Conversation transcripts generated from your voice recordings

  • Voice pattern data for personalization and AI model improvement

  • Speech characteristics (pace, tone patterns) for conversation analysis

Important: Voice recordings may inadvertently contain sensitive personal data such as health information (cough, breathing patterns) or biometric identifiers (voice patterns). We implement technical measures to minimize processing of such characteristics and do not use voice data for biometric identification.

Account and Profile Information

  • Full name and email address

  • Account preferences and settings

  • Subscription and billing information

  • Usage history and conversation logs

Technical and Usage Data

  • Device information (type, operating system, browser)

  • IP address and approximate geographic location

  • Service usage patterns and performance metrics

  • Error logs and diagnostic information

  • Interaction data (features used, session duration)

Connected Services Data

When you connect a third-party account (currently Google), we collect:

  • Authentication tokens and connection status

  • The minimum calendar information authorized by you

  • Integration usage data needed to deliver the feature

See Connected Services and Third-Party Integrations below for the specific data accessed.

Connected Services and Third-Party Integrations

Connecting your Google account is optional and initiated by you. We request the narrowest access needed, and you can disconnect at any time.

Google Calendar

If you connect your Google account, SecondBody requests read-only access to your Google Calendar events, using the single scope `https://www.googleapis.com/auth/calendar.events.readonly`.

  • What we access: events from your primary Google Calendar within a short upcoming window. For each event we read the title, start/end time, location, organizer, attendees, and a short preview of the description.

  • Why: to generate a brief summary of your upcoming meetings so your AI coach can prepare relevant, context-aware coaching.

  • What we never do: we do not create, edit, or delete your calendar events.

  • Storage: calendar events are retrieved on demand and processed transiently to build that summary; we do not store your calendar events on our servers — only the connection tokens needed to maintain the integration.

  • Transfers: when you start a live coaching session, your upcoming events are provided to your AI coach through our real-time voice infrastructure (LiveKit) and our AI inference provider (OpenAI) to prepare context for that session. This is done solely to deliver the feature — never to train their models.

  • No sale / no ads / no model training: we do not sell your Google data, use it for advertising, or use it to develop, improve, or train generalized AI/ML models.

  • Revoking access: you can disconnect at any time in your SecondBody settings or via your Google Account permissions; disconnecting revokes our access and deletes the stored tokens.

Limited Use. SecondBody’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How We Use Your Information

Core Service Delivery

  • AI Conversation Simulation: Processing voice recordings to create personalized conversation experiences

  • Performance Analytics: Analyzing conversation patterns to provide progress insights

  • Content Generation: Using AI models to generate appropriate responses and scenarios

  • Platform Personalization: Customizing experiences based on your usage patterns

Legal Basis for Processing

Voice Recordings and Core Service Data:

  • Consent: We rely on your explicit consent for processing voice recordings and sensitive audio characteristics

  • Contract Performance: Processing necessary to deliver our conversation simulation services

  • Legitimate Interests: Analytics and service improvement, balanced against your privacy rights

Account and Technical Data:

  • Contract Performance: Managing your account and service delivery

  • Legitimate Interests: Security, fraud prevention, and service optimization

Service Improvement

  • Analyzing aggregated, anonymized usage patterns to enhance AI model performance

  • Conducting research and development for new features

  • Quality assurance and error diagnosis

  • Security monitoring and threat detection

Note: We do not use individual voice recordings for AI model training unless you explicitly opt in to our improvement program. We never use data received from connected third-party services (such as Google) to train AI/ML models.

Information Sharing and Disclosure

Authorized Subprocessors

We share personal data only with vetted service providers under strict contractual obligations:

Provider

Purpose

Location

Safeguards

AWS

Cloud Infrastructure

USA

SCCs, encryption, transfer risk assessed

Koyeb

Cloud Compute

France

EEA-hosted

OpenAI

AI Inference

USA

API-only access, no training use, SCCs

PostHog

Analytics

USA

SCCs, access controls

Vanta

Security Compliance

USA

SCCs

Auth0

Identity Management

USA

SCCs

11Labs

Text-to-Speech

USA

SCCs, limited retention

Deepgram

Speech-to-Text

USA

SCCs, no permanent retention

Google Workspace

Email, collaboration

USA

SCCs

Pipedrive

CRM

EU/USA

SCCs

Stripe

Payments

USA

SCCs, PCI DSS compliant

SendinBlue

Communications

EU

EEA-hosted

Sentry

Monitoring & Logging

USA

SCCs

LiveKit

Audio delivery

USA

SCCs

AI Service Providers: For OpenAI, 11Labs, and Deepgram, we:

  • Use API-only access without data retention for model training

  • Implement contractual prohibitions on secondary data use

  • Monitor compliance with published data handling policies

  • Maintain technical controls to prevent unauthorized processing

Other Disclosures

We may share your information:

  • Legal Requirements: To comply with laws, regulations, or valid legal processes

  • Safety and Security: To protect against fraud, security threats, or illegal activity

  • Business Transfers: In connection with mergers, acquisitions, or asset sales

  • With Your Consent: For any other purpose with your explicit permission

International Data Transfers

Your personal data may be transferred to and processed in countries outside your residence, including the United States.

For EEA/UK Users:

  • We implement Standard Contractual Clauses (SCCs) for transfers to non-adequate countries

  • We conduct transfer risk assessments aligned with EDPB guidance

  • We implement supplementary safeguards including encryption and access controls

  • Formal Transfer Impact Assessments are available upon request

Safeguards in Place:

  • End-to-end encryption for voice data transmission

  • Access controls limiting personnel who can access transferred data

  • Contractual restrictions on data use by international processors

  • Regular compliance monitoring and auditing

Data Retention

  • Voice Recordings: Retained for up to 1 year for service delivery and improvement, then automatically deleted unless you request extended retention

  • Account Data: Maintained during your active subscription and for 30 days post-cancellation for account restoration

  • Connected Service Tokens: Retained only while the integration is connected; deleted immediately when you disconnect

  • Connected Service Content (e.g., calendar events): Retrieved on demand and not persisted

  • Usage Analytics: Aggregated, anonymized data may be retained indefinitely for service improvement

  • Legal Retention: Some data may be retained longer where required by law or for legal defense

  • Configurable Retention: Enterprise customers may request modified retention periods through their service agreements

Your Privacy Rights

Universal Rights

  • Access: Request copies of your personal data

  • Correction: Update inaccurate or incomplete information

  • Deletion: Request removal of your personal data

  • Portability: Receive your data in a machine-readable format

  • Objection: Object to certain types of processing

  • Restriction: Limit how we use your data in specific circumstances

Voice Data Specific Rights

  • Consent Withdrawal: Revoke consent for voice processing at any time

  • Voice Data Deletion: Request immediate deletion of voice recordings

  • Processing Limitation: Restrict use of voice data for specific purposes

  • Biometric Opt-Out: Exclude voice characteristics from any biometric processing

Additional Rights by Region

EU/UK Users (GDPR):

  • Right not to be subject to automated decision-making with legal effects

  • Right to lodge complaints with supervisory authorities

  • Enhanced consent and withdrawal mechanisms

California Users (CCPA/CPRA):

  • Right to know what personal information is collected and shared

  • Right to delete personal information

  • Right to opt-out of “sale” or sharing (not applicable to our service)

  • Right to non-discrimination for exercising privacy rights

To Exercise Your Rights: Contact us at hello@secondbody.co or use your account settings for available self-service options.

Automated Processing and AI Decision-Making

AI Processing Disclosure: Our Service uses artificial intelligence to:

  • Analyze voice patterns for conversation improvement suggestions

  • Generate contextually appropriate conversation responses

  • Provide personalized learning recommendations

No Automated Decisions with Legal Effects: We do not use AI to make decisions that produce legal consequences or significantly affect you without human involvement.

Profiling Activities: We do not engage in profiling that could result in discrimination or significantly impact your rights. Our AI analysis focuses solely on conversation simulation and learning improvement.

Data Security

We implement comprehensive security measures including:

Technical Safeguards:

  • AES-256 encryption for data at rest

  • TLS 1.3+ encryption for data in transit

  • Role-based access controls with multi-factor authentication

  • Regular penetration testing and vulnerability assessments

Organizational Measures:

  • Annual security and privacy training for all personnel

  • Incident response procedures with notification protocols

  • Vendor security assessments and monitoring

  • SOC 2 Type II compliance framework

Voice Data Protection:

  • Encrypted voice transmission to processing services

  • Contractual limitations on voice data use by AI providers

  • Automated deletion of temporary processing copies

  • Access logging and monitoring for voice data access

Limitations: No security system is 100% secure. While we implement industry-standard protections, we cannot guarantee absolute security.

Children’s Privacy

Age Restrictions: Our Service is not intended for users under 18 years of age. We do not knowingly collect personal information from individuals under 18.

Parental Notice: If we become aware that we have collected personal information from someone under 18, we will delete that information promptly and may terminate the associated account.

Voice Data Sensitivity: Due to the sensitive nature of voice processing and potential for biometric identification, we maintain strict age verification to protect minors.

Cookies and Tracking Technologies

We use cookies and similar technologies for:

Essential Functions:

  • User authentication and session management

  • Security and fraud prevention

  • Service delivery and performance

Analytics and Improvement:

  • Usage pattern analysis (aggregated)

  • Feature adoption tracking

  • Error monitoring and diagnosis

Your Choices:

  • Browser cookie controls for non-essential cookies

  • Account settings for analytics preferences

  • Opt-out mechanisms for marketing communications

Third-Party Tracking: We use limited third-party analytics tools (e.g., PostHog) under strict data processing agreements. These tools do not have access to voice recordings.

Changes to This Privacy Policy

Notification Process:

  • Material changes: 30 days advance notice via email and platform notification

  • Minor updates: Posted notice with effective date

  • Version history available upon request

Continued Use: Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

Contact Us

Privacy Questions: hello@secondbody.co
Mail: SecondBody Inc., 2061 Broadway, Suite 5, New York, NY 10023

Response Time: We aim to respond to privacy inquiries within 30 days (72 hours for urgent security matters).

Regulatory Information

Supervisory Authorities:

  • EU Users: Contact your national data protection authority

  • UK Users: Information Commissioner’s Office (ICO)

  • California Users: California Attorney General’s Office

Compliance Frameworks: We align our practices with GDPR, UK GDPR, CCPA/CPRA, and other applicable privacy regulations.