Privacy Policy

This Privacy Policy describes how RubricMind Inc. (“RubricHQ”, “we”, “us”, or “our”) collects, uses, discloses, and protects information when you use the RubricHQ platform, websites, and related services (collectively, the “Services”). By using the Services, you agree to the practices described here.

RubricHQ is a testing and evaluation platform for voice AI agents. Customers use it to simulate voice calls, evaluate transcripts, and optimize conversational AI systems. This policy applies to both visitors to our website and authenticated users of the platform.

1. Information we collect

Information you provide. When you create an account, contact us, or interact with the Services, we may collect your name, email address, company, billing details, and the content you choose to upload (such as prompts, scenarios, test transcripts, and agent configurations).

Usage data. We automatically collect limited technical information such as IP address, browser type, device identifiers, pages visited, and timestamps in order to operate and secure the Services.

Voice and conversation data. To run simulations and evaluations, the Services process audio, transcripts, and related metadata that you or your end users submit. This data is handled as described in Sections 3 through 5.

Cookies and similar technologies. We use essential cookies for authentication and session management, and limited analytics cookies to understand aggregate product usage. You can manage cookies through your browser settings.

2. How we use information

We use the information we collect to:

• Provide, maintain, and improve the Services;
• Run simulated voice calls and evaluate agent output on your behalf;
• Authenticate users, prevent abuse, and secure our infrastructure;
• Communicate with you about your account, updates, and support;
• Understand aggregate usage and improve product performance; and
• Comply with legal obligations and enforce our agreements.

3. AI processing and customer data

The Services use third-party AI providers (such as large language model, speech-to-text, and text-to-speech providers) to generate, transcribe, synthesize, and evaluate conversations. Customer content submitted to the Services may be transmitted to these providers solely to perform the tasks you request. The current list of AI and infrastructure subprocessors is in Section 7.

We do not use customer content to train our own general-purpose models, and we contractually require our AI subprocessors not to use customer content to train their models, where such opt-outs are available.

You are responsible for ensuring that you have the necessary rights and consents to submit any voice recordings, transcripts, or personal data to the Services, including compliance with applicable call-recording and consent laws.

4. Voice calls and testing-only use

RubricHQ is a testing tool. It is intended only for testing and evaluating your own AI voice agents — not for placing calls to real people, customers, or the general public. You must not use the Services to make production or live bot calls to actual end users, or to conduct outreach, telemarketing, robocalling, or any real-world calling campaign.

To run a test, the Services connect over live telephony to the AI agent, endpoint, or number you designate, and may interact with IVR menus, hold queues, voicemail, and any transfer or escalation your own agent triggers during the test. You are responsible for ensuring the target of every test is your own system (or one you are authorized to test), and that no test reaches an unintended real person.

You are solely responsible for:

• Ensuring every test targets only your own AI agent or a system you are authorized to test, and never a real end user, customer, emergency service, regulated hotline, or number you do not own or control;
• Handling any transfer, escalation, hold, keypad/DTMF flow, or hand-off that your own agent triggers during a test — including any recording, notice, or consent obligations that arise if a test unexpectedly reaches a third party or a live agent; and
• Any telephony, carrier, or usage charges that result from tests run through the Services.

Because tests run over live telephony, outcomes such as unexpected transfers or misdirected calls can occur. We are not responsible for the consequences of tests you configure and initiate, for any use of the Services to call real people in violation of these terms, or for how downstream systems and people handle a transferred or escalated call. It is your responsibility to configure your tests so that they only reach your own systems and so that transfers and other call events are handled safely.

5. Sharing data for observability and support

When you enable observability features or share call data, transcripts, recordings, or logs with us — for example, to debug an issue, review an evaluation, or receive support — you are expected to mask, redact, or remove any personally identifiable information (PII) and other sensitive data before sharing it.

You are responsible for the content you choose to share. To the extent you share unmasked PII or sensitive data with us, or expose it through observability, you do so at your own risk, and we are not responsible for PII that you fail to mask or redact before sharing. We will handle any data you share in accordance with this policy and our agreements, but the obligation to minimize and mask PII in shared data rests with you.

6. How we share information

We do not sell personal information. We share information only in these limited cases:

• Service providers and subprocessors that help us operate the Services (hosting, analytics, AI model inference, speech-to-text, text-to-speech, telephony, payments, and customer support), under written agreements that restrict their use of the data. See Section 7 for the current list;
• Within your organization, with other authorized users of your workspace;
• For legal reasons, when we reasonably believe disclosure is required by law, regulation, legal process, or to protect rights, safety, or property; and
• In connection with a corporate transaction such as a merger, acquisition, or asset sale, in which case we will provide notice consistent with applicable law.

Mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

7. Subprocessors

We engage the third-party subprocessors below to operate the Services. Each is engaged under a written agreement that limits their use of data to providing services to us. We may update this list as our providers change and will reflect those changes here.

8. Data retention

We retain information for as long as your account is active, as needed to provide the Services, and as required to comply with legal obligations, resolve disputes, and enforce our agreements. You can request deletion of your account and associated content at any time by contacting us; some information may remain in backups or logs for a limited additional period before being removed.

9. Security

We use industry-standard administrative, technical, and physical safeguards designed to protect information from unauthorized access, disclosure, alteration, or destruction. This includes encryption in transit, access controls, logging, and regular review of our security practices. No system is perfectly secure, however, and we cannot guarantee absolute security.

10. International transfers

We are based in the United States and may process information in the United States and other countries where we or our subprocessors operate. Where applicable, we rely on recognized transfer mechanisms such as Standard Contractual Clauses to protect personal data transferred across borders.

11. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, export, or restrict the use of your personal information, and to object to certain processing. Residents of the European Economic Area, the United Kingdom, California, and other jurisdictions with comparable privacy laws are entitled to these rights subject to applicable limitations.

To exercise any of these rights, email us at [email protected]. We will verify your request and respond within the timeframes required by applicable law. You may also have the right to lodge a complaint with your local data protection authority.

12. Children’s privacy

The Services are intended for business users and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in the Services, our practices, or applicable law. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice (such as by email or in-product notification).

14. Contact us

If you have questions about this Privacy Policy or our data practices, you can reach us at: