Privacy Policy

We collect the following categories of information:

• Account information: name, work email, role, and company affiliation for Users who sign up or are invited to the Service.
• Survey content: questions configured by an organization, and the responses submitted by Respondents through unique survey links.
• Usage data: log and device information — IP address, browser and operating system, device type, screen size, language, time zone, the pages viewed and the site or link you arrived from — used to operate and secure the Service and to understand how our website is used. We derive an approximate location (country, and where available region or city) from the connection; we do not store the IP address in our analytics records, and none of this is collected on survey pages.
• Notification preferences: your choices about which in-app and email notifications you wish to receive, stored to personalize your experience.
• Sign-in and security data: your password in hashed form and, if you turn on two-factor sign-in, the data needed to operate it — an encrypted authenticator secret or one-time codes, hashed recovery codes, and a record of any device you ask us to remember (a hashed token, the browser and operating system it reported, and when it was last used).
• Terms acceptance records: the version of our Terms of Service you accepted and the date of acceptance, maintained for compliance purposes.
• Communications: messages you send us, such as support requests sent to [email protected].

• To operate, maintain, and improve the Service, including generating reports, scores, and AI-assisted insights for authorized Users;
• To send transactional communications, such as survey invitations, reminders, password resets, billing alerts, and account notices, as well as in-app notifications about campaign activity, payment status, and system updates;
• To generate downloadable PDF reports containing aggregated survey results and AI-assisted insights for authorized Users;
• To provide customer support and respond to inquiries;
• To monitor for, investigate, and prevent fraud, abuse, and security incidents; and
• To comply with legal obligations and enforce our agreements.

A core part of Timbre's design is enabling honest feedback through anonymity. Where the Service presents a campaign as anonymous, individual responses are not shown alongside the identity of the Respondent who submitted them. We apply additional safeguards — such as requiring a minimum number of completed responses before any per-respondent pattern breakdown is displayed — to reduce the practical risk that an individual could be identified by process of elimination.

We do not disclose which specific individual provided which specific response to the organization administering a campaign. Aggregated statistics (such as average scores, distributions, and anonymized per-respondent score patterns) may be shown to authorized Users to help them understand feedback at a team level.

Some features send data to a third-party AI provider for processing. In every case we instruct that the data be used only to generate the requested output and not to train the provider’s general models. There are two distinct uses, and what is sent differs between them:

• Insights and reports. When an authorized User requests an AI summary, sentiment analysis or culture report, aggregated survey results and free-text comments are sent for processing. We do not include names, email addresses or any identifier that links a comment to the Respondent who wrote it. Free text is submitted as data, not as instructions, and cannot direct the model.
• Campaign building (Conductor).When an authorized User asks Conductor to design a campaign, we send the plain-English description they typed together with a working list of the people it could involve — the names, job titles and email addresses of Users and contacts in that organization, and any list the User pastes or uploads. This is directory information, not survey responses: no answers, scores or comments are included, and no Respondent’s feedback is ever connected to their name for this purpose. It is sent so the tool can propose who should be surveyed, and the proposal is reviewed by a person before anything is created or sent.

AI-assisted features can be used or ignored at each User’s discretion; declining to use them means no data is sent to the AI provider on your behalf.

We do not use advertising or third-party tracking cookies. The Service stores a small amount of data in your browser, all of it necessary for the product to work:

• your sign-in session, so you are not asked for your password on every page;
• if you choose “remember this device” when using two-factor sign-in, a random token that lets that browser skip the second step for 30 days. It never skips your password, and you can revoke it for every device at once from Preferences;
• small display preferences, such as guidance you have dismissed, so you are not shown it repeatedly.

Clearing your browser storage signs you out and removes these; nothing is lost from your account.

We do not sell personal information. We may share information with:

• Service providers who host infrastructure, send emails, or process data on our behalf, under confidentiality obligations and only as needed to provide the Service (including the AI provider described above);
• Your organization, where applicable — for example, account information and aggregated survey results are visible to authorized Users within your company according to their role and permissions;
• Legal and safety purposes, where we believe disclosure is required by law, regulation, legal process, or to protect the rights, property, or safety of Foundry Lab, LLC, our users, or others; and
• Business transfers, in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.

We retain account information and survey data for as long as needed to provide the Service to the organization that collected it, and afterward for a reasonable period to comply with legal obligations, resolve disputes, and enforce our agreements. Organizations may request deletion of their data by contacting us at [email protected].

We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, loss, misuse, or alteration, including encryption of data in transit, access controls, and password hashing. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Users can review and update their account information within the Service. Respondents who receive a survey invitation and have questions about how their responses are handled may contact the organization that sent the invitation, or reach us directly at [email protected]. Depending on your location, you may have additional rights regarding your personal information, such as the right to request access to, correction of, or deletion of certain information; we will respond to verifiable requests as required by applicable law.

The Service is intended for use by working professionals and is not directed to individuals under the age of 18. We do not knowingly collect personal information from children.

The Service includes an in-app notification system that delivers alerts about campaign activity, billing events, and other account-related updates. We store your notification preference settings (which notification types you have enabled or disabled for in-app and email delivery) to respect your communication choices. You may update these preferences at any time through the Service. Notification data, including read/unread status, is retained for as long as your account is active.

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, such as by posting the updated policy on this page and updating the effective date above.

Questions about this Privacy Policy can be sent to [email protected].

Foundry Lab, LLC · Pennsylvania, USA