Privacy Policy

This Privacy Policy describes how Point11, Inc., a Delaware corporation (“Point11,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you visit our website (point11.ai), use our platform, or interact with our services.

1. Information We Collect

Information you provide: name, email address, company, and role when you create an account, fill out a form, or request a demo; billing details when you subscribe (payments are processed by Stripe; we never store full card numbers); and the content of your messages when you contact us.

Information collected automatically: device and usage data such as IP address, browser type, pages visited, and session duration, collected through cookies and similar technologies (see Section 5).

Signing up: when you open our sign-up page, we record how you reached it: any source the link names, such as our pricing page or a conference; the campaign tags and referral name in the link you followed; the domain of the website that sent you (never the address of its page); the page of our website you came from; and the sign-up offer and payment option you started with. As you sign up, we record which steps you reach and when, such as entering your website, filling in the card form, and moving on to create your account; for the card form, we also record how long it took, in broad ranges, and your browser's type. These records are kept under a random identifier for that sign-up. We do not add your name, email address, IP address, or what you enter in the form to them; from the link itself we keep only the campaign tags and referral name its author put in it, and we drop any value containing an @, a colon, or a slash, the marks of an email or web address. We record the source with your new organization, and at the payment step we note, until your organization's account is created, the identifier it will be created with, so that the account also keeps the other details of how you reached our sign-up page.

Using our signed-in application: we record the pages members view; the actions they take, including those we refused or that failed, with the reason as a code; and the errors a page shows, with the error's type and, in our logs, the place in our own code where it occurred, never an error message or anything entered. When a member opens a page from a link in one of our getting-started reminders, we record which reminder it was with that page view. When some of these records cannot be saved, we count how many were lost each hour for the organization, without recording whose they were, so that our usage figures show when they are incomplete.

AI conversations: if you talk to the chat or voice assistant on our website, we collect the conversation content and session metadata. Voice calls are recorded and transcribed, and the voice assistant tells you so before a call starts. To make follow-up conversations useful, we also maintain a lightweight profile of your interactions (for example, topics you asked about). This applies to signed-in users and anonymous visitors alike, and the profile is shared between the chat and voice assistants. Anonymous chat conversations are deleted 31 days after they start and voice conversations 30 days after they end. Our voice provider, ElevenLabs, keeps each call's recording and transcript in its own systems for up to 30 days and then deletes them. Our chat assistant runs on Vercel, which keeps its own working copy of each chat session, including its messages, until the session closes (at most 30 days after that session starts) and for up to 7 days after that, and then deletes it. Deleting a conversation or closing your account does not shorten that period. The profile is kept until you ask us to delete it or, if you are signed in, until you close your account. To have it deleted, email legal@point11.ai.

Analytics product data: when customers run our analytics products, we collect publicly available web content about the requested websites and brands (including competitors' websites used for comparison), send AI-driven browser visits to those websites, hold conversations with AI models led by synthetic customers (AI-generated personas), and store the resulting reports as durable customer artifacts. We also produce aggregated, de-identified benchmarks across customers; these cannot reasonably be used to identify any person.

Customer uploads: a customer may add its customers under New customers from a CRM export or another customer list (a CSV or Excel file). Your browser converts the file into one CSV file, without checking it for personal details, and attaches it to a “Describe your customers” chat as your first message. We store the file whole, including any names, email addresses, phone numbers, or other personal details in it, with that chat. The chat is not deleted automatically: the file is deleted within 30 days after you delete your Alpha chat history or close your account, and when the organization is closed (Section 4). An AI agent reads the file and fills a customer sheet from it, copying each column it places whole. The AI model provider that runs the agent keeps none of the data sent to it and does not train on it, and our records of the agent's AI model calls keep the chat, the file's column headers, and values on the sheet, but not the rest of the file. The agent is instructed never to put on the sheet, or repeat in the chat, a person's name, email address, phone number, street address, date of birth, government, tax, or account identifier, or payment details, and to leave out any column that holds them, even mixed with other words. No automated check enforces this instruction, and other information about customers, including health information, can be placed on the sheet. When you add the customers, each row of the sheet is sent to us: the customer's attributes; the account's website, industry, lifecycle stage, spend, purchase frequency, and tier; and its account context (other columns about the account, word for word up to 2,000 characters each). An AI model first checks the customers' attributes against our acceptable-use rules, and we keep them as that check's record; the AI model providers in Section 3 then write one synthetic customer from each row. We keep these rows until the organization is closed.

Uploads made through our API, or by our staff for a customer, follow other rules. Columns that identify private individuals (such as their names, email addresses, phone numbers, street addresses, dates of birth, and account or device identifiers), hold government identifiers or payment data, or record a person's race, ethnicity, religion, sexual orientation, sex, or gender are rejected; other columns, including health information, can be kept. To propose a mapping, the column headers and up to five sample values from each remaining column are sent to an AI model; the sample values are never stored in our AI model call records. An AI model checks the headers alone against our acceptable-use rules, and we keep them as that check's record. Values that look like personal identifiers are removed, and email addresses, links, phone numbers, and people's names are cut from free-text fields. Once the customer profile is built, the rows are deleted (rows of a failed upload within seven days). Their generalized facts and account context (other columns about the account, such as its ecommerce platform or a public figure who founded or fronts it, word for word up to 2,000 characters each) are kept with the upload until you delete it, and the AI model providers in Section 3 use them to write the synthetic customers based on each account.

Connected CRMs: a customer may instead connect HubSpot or Salesforce. To build generalized customer profiles, we import only the record fields the customer maps, and we never read a field whose name or type in the CRM shows it holds a private individual's name, email address, phone number, street address, date of birth, or other personal identifier, a government identifier or payment data, or a person's race, ethnicity, religion, sexual orientation, sex, or gender; other fields, including health information, can be mapped. We do not remove anything from the values of the fields we import, so a free-text field keeps whatever it says, and a field mapped to account context is stored word for word, up to 2,000 characters, with the import until it is deleted. If the customer also chooses connected contacts, we read those contacts' names, email addresses, job titles, and companies, and their call and meeting transcripts, and keep them up to date, to build a synthetic customer modeled on each contact; the AI model providers in Section 3 process these records.

Connected Google Ads: a customer may connect Google Ads by having one of its members sign in with Google. We read only the Google Ads accounts the customer chooses and, for each one, its keywords and Google's Quality Score history with impressions and cost, to show the customer how Google rates its ads. We change a Google Ads account only when the member whose sign-in connected it confirms a draft in Alpha: we then create paused ads from the customer's saved ad suite in the campaign or ad group that member picked, which can add a new paused ad group and upload the ads' images as image assets. We never enable ads, change budgets or bids, or pause or change anything already in the account. For the ads we created, we read their daily impressions, clicks, conversions, and cost. Vercel Connect holds the Google sign-in for us, and we never see the member's Google password. When the customer disconnects Google Ads, we revoke our access at once.

Connected Google Analytics: a customer may connect Google Analytics by having one of its members sign in with Google. We list the names of the properties that sign-in can reach, so the customer can choose which ones we read. From the ones it chooses, we read each property's time zone and currency and only daily totals: visits, key events, and purchase revenue, and the visits that arrived from AI assistants and the pages those visits landed on. We do not receive information about individual visitors, and we never change anything in Google Analytics. Vercel Connect holds the Google sign-in for us, and we never see the member's Google password. When the customer disconnects, we stop reading at once and revoke our access.

Connected Vercel Web Analytics: a customer may connect Vercel Web Analytics by having one of its members sign in with Vercel. We list the names of the Vercel projects that sign-in can reach with Web Analytics turned on, so the customer can choose which ones we read. From the ones it chooses, we read only daily totals: the visitors to the project's production website, the visitors that arrived from AI assistants, and the pages those visitors landed on. We do not receive information about individual visitors, and we never change anything in Vercel. Vercel Connect holds the Vercel sign-in for us, and we never see the member's Vercel password. When the customer disconnects, we stop reading at once and revoke our access.

Connected Shopify: a customer may connect its Shopify store by having one of its members approve Point11's app for that store in Shopify. We read the store's name, myshopify.com address, time zone, and currency, and only daily totals from Shopify's reports: online store sessions, orders, and total sales, and the sessions, orders, and sales that arrived from AI assistants and the pages those sessions landed on. We do not receive information about individual customers or orders, and we never change anything in Shopify. Vercel Connect holds the store's access for us. When the customer disconnects, we stop reading at once and delete our access; uninstalling Point11's app in Shopify also ends it.

Our sales records: when you book a demo, send us a message, leave your details with the chat assistant on our website, download a whitepaper, apply for First Month Free, ask for the report of a free scan you ran on our website, or reply to results we shared with you, our sales team keeps a record of you: your name, email address, role, and company, what you asked us for, how and when we first recorded you, whether we've marked you as not to be contacted and why, when we last engaged with you, and our team's notes and summaries of our conversations and follow-ups with you. Our team may also record, with the same details, someone it is in touch with at a business we work with or would like to work with. When a partner in our Partner Program registers your business with us, we record the business, not you. If you run a free scan without giving us your email address, we keep nothing personal about you from it. We never build these records from our customers' data. We use them only to answer you, send you what you asked for, and manage our relationship with your business, and we share them only with the service providers in Section 3. Section 4 says how long we keep them and how to have them deleted.

Our sales team's email and meetings: when you email or meet with someone on Point11's sales team and we already know you or your company, we keep a record of it to track our relationship with your company: who took part (their names and email addresses), when, the subject or meeting title, and a short summary of each email written by an AI model. We may add colleagues of yours on the same email or meeting to our sales records. We keep the text of the email, or the meeting's description, for up to 90 days and then delete it, and we delete a meeting's record if it's cancelled. We don't keep attachments, or the Google Meet links, dial-in numbers, and PINs Google adds to an invitation. The AI model that writes the summary doesn't retain the email or use it for training, and once the summary is written we remove the email from our record of that AI model call. We keep the rest of the record, including the summary, with our sales records (Section 4). To have these records deleted, email legal@point11.ai.

Business research: to prepare conversations with businesses we would like to work with, we may use our own products to study a business's public website and how AI assistants describe it, through the same service providers our products use (Section 3), and keep the results as our own business records, with no fixed deletion date. The results can include the names of people the business itself publishes on its website, such as on an About page; we do not add those people to our sales records. If we send a business a private link to its results, we count how many times the link is opened each day and keep those counts with the link. We do not use cookies for this or record who opened it.

2. How We Use Your Information

• Providing, operating, and improving the Point11 platform and services
• Processing transactions and sending related communications
• Responding to inquiries, support requests, and feedback
• Managing our sales relationships: answering the people who contact us, following up with them, and preparing conversations with businesses we would like to work with
• Analyzing usage patterns to improve the product
• Sending getting-started reminders based on how an account uses Point11 (for example, when new results have not been viewed, or to suggest inviting a teammate or trying another product), which each member can turn off in Settings or through the link in any reminder; to learn whether the reminders help, we hold back each kind from about 15% of the accounts it would go to, chosen at random, record which accounts were held back, and compare how they use Point11 with the rest
• Measuring how organizations find Point11 and complete sign-up, and what our marketing costs for each new customer, from the sign-up records described in Section 1
• Detecting and preventing fraud, abuse, and security issues
• Complying with legal obligations and enforcing our terms

We do not sell personal information, and we do not use customer data to train our own AI models. Some AI model providers may use the data they process for us to improve their models; see Section 3.

Point11's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Ads data only to show the customer its own ads' quality and results and to create the paused ad drafts its member confirms, and Google Analytics data only to show the customer its own traffic and revenue totals and how they moved after changes to its website: we do not use this data for advertising, we do not sell it, we do not use it to train AI models, and our staff read it only with the customer's permission, to keep the service secure, or when the law requires.

3. Service Providers

We share information with service providers only as needed to operate the platform. Each may use it solely to provide services to us, except as described under AI model training below:

• Hosting and infrastructure: Vercel (application hosting, content delivery, file storage, background jobs, and isolated sandboxes that render websites and generated artifacts), Neon (database), Upstash (cache and rate limiting).
• Automated browsing: Browserbase (remote browsers that visit the websites a customer specifies, and competitors' public websites, for Experience runs) and BrowserStack (real mobile devices, when a customer tests a native mobile app).
• AI model providers: Anthropic, OpenAI, Google, xAI, and Meta (language, image, speech, and transcription models) and Perplexity (web search inside model tool loops), accessed via Vercel AI Gateway; ElevenLabs (the voice assistant, which runs an OpenAI language model within ElevenLabs' service); and, when a customer configures its own credentials, that customer's Amazon Bedrock, Microsoft Azure, or Google Vertex AI account.
• Business data and locations: Google (Places for business location lookup, PageSpeed Insights for site performance checks, and Web Risk for URL safety checks) and Mapbox (maps, and geocoding of business and customer location text).
• Tools a customer connects: HubSpot and Salesforce (CRM records the customer chooses to import), Google Ads (keywords and Quality Score from the Ads accounts the customer chooses, and paused ad drafts, with their results, only when a member confirms them), Google Analytics (daily traffic and revenue totals from the properties the customer chooses), Vercel Web Analytics (daily visitor totals from the projects the customer chooses), Shopify (daily session, order, and sales totals from the store the customer connects), Slack (only when a customer installs the Slack agent into its own workspace), and Linear (only when a customer connects it to Alpha).
• Identity and payments: WorkOS (sign-in, single sign-on, and encrypted storage of the test-account credentials a customer provides for Experience runs), Stripe (payment processing).
• Communications: Resend (email delivery) and Google Workspace (our email and calendar, including demo bookings and our sales team's email and meetings described in Section 1).
• Website analytics: Vercel Web Analytics and Speed Insights (page-view and performance telemetry, and counts of events such as a form being submitted, a free scan finishing, or how long a page took to load, each with at most two labels; we add nothing that identifies you).

AI model training: Meta may use the inputs and outputs of its Muse Spark models to improve its models under Meta's terms. Muse Spark currently runs many Point11 Analytics features, including business profile research and forecasts, synthetic customer generation, Discovery conversation analysis, customer research studies, CRM imports and connected CRM contacts, Alpha and Ask Data, Experience analysis, Inspector benchmarks, and First Month Free eligibility reviews, as well as the chat assistants on Point11's website and demos when you are not signed in. These calls can include public web content about the brands and websites analyzed, synthetic customer conversations, the CRM records and contact details described in Section 1, the questions and material customers enter, and the messages visitors who are not signed in send to our website chat assistant. For our other language and image model calls through Vercel AI Gateway, we ask the Gateway to use only providers that do not train on the data sent. Speech, transcription, and voice calls are handled under each provider's own terms.

We may also disclose information when required by law or valid legal process, or in connection with a merger, acquisition, or sale of assets (in which case we will notify you).

4. Data Retention

We retain personal information for as long as needed to provide our services, maintain our business relationship with you, comply with legal obligations, and resolve disputes. When it is no longer needed, we delete or anonymize it. Deleted data can remain in our encrypted database backup history for up to 30 days after it is deleted, and then it expires. You can request deletion of your data at any time by emailing legal@point11.ai.

When you close your user account, we delete your assistant profile, remove your name and email address from your user record, and delete the chat conversations and messages tied to your account within 30 days. Your sign-in record at our identity provider, WorkOS, is not deleted automatically; email legal@point11.ai to have it removed.

When an organization account is closed, whether by its owner in the product or by us at the owner's request, its API keys, invitations, and connected-tool grants are revoked at once. Thirty days after closure we begin permanently deleting, or irreversibly redacting, all of the organization's data, and we finish within 45 days of the closure, unless a legal claim, a regulator's requirement, or a payment dispute such as a chargeback requires us to keep the organization's records. In that case we postpone deletion only for as long as that need lasts, reviewing it at least every 180 days, and delete the data once it ends. This covers everything the organization and its members provided and everything our services produced for it, including its campaigns and their Discovery, Research, Experience, and Inspector results; its customers, including synthetic customers and contacts synced from a connected CRM, and the business profiles and forecasts they were built from; records of calls and meetings; data read from Google Ads and our records of the paused ad drafts we created there; the daily totals read from Google Analytics, Vercel Web Analytics, and Shopify; uploaded CRM rows and stored files; conversations, voice sessions, and comments; Alpha and Ask Data content; saved locations, study drafts, and agent and site settings; and the inputs and outputs of its AI model calls. We keep only our security audit log, for at least one year; the billing and tax records the law requires us to keep; records stripped of that data, which keep only identifiers, dates, and counts; and the records of the closed account described in the next paragraph. To ask us to close an organization and delete its data, email legal@point11.ai.

When an organization's account is closed and its data is erased, we keep one record about the organization that holds no names, email addresses, or other identifiers of its people: how long it was a customer, how it signed up, and how its account was closed; its usage, account health, and subscription amount in its last 90 days; and the days in its last 180 on which it used what Point11 delivered. We also keep when it first reached each setup step and how it first took up Point11, which name no person either. We use these to understand why customers leave and to keep our retention and onboarding figures accurate, and keep them with the closed account's billing records, with no fixed deletion date.

Records of AI model calls, including their inputs and outputs, are kept for up to 365 days and then redacted; the fact of each call and its cost are kept with billing records. Retention periods for website conversations, customer uploads, our sales team's email and meetings, and business research are described in Section 1.

The record of the individual pages members view and the actions they take in our signed-in application is kept for 90 days and then deleted; daily counts of that usage are kept with the organization's account and deleted with its other data when the account is closed. When a person's account is deleted, these records stop referring to them: their entries are kept only under a placeholder for a deleted person, so each organization's totals stay correct. When our staff open a member's activity record in our internal tools, the organization's audit log records that Point11 support viewed it.

The record of how an organization signed up (the campaign tags and referral name of the link followed, the referring website's domain, and the page that led to sign-up) is kept with the organization's account and deleted with its other data when the account is closed; the single word for the source its link named stays on the closed account's record. Records of individual sign-up steps are kept for 180 days and then deleted.

We keep your details in our sales records (Section 1) for 24 months after we last engaged with you (for example, when you contact us again, when we email or meet with you, or when our team adds a note about you), unless a request or deal of yours is still open. We then delete them, with the notes and the email and meeting records that concern only you, and remove you from the rest: a note our team also filed under your business stays in our record of that business, and the record of an email or meeting that stays with your business or with someone else who took part loses its subject, text, and summary. If we have linked them to your Point11 account, we keep them with your account and delete them after you close it. You can ask us to delete your details sooner by emailing legal@point11.ai: we then also delete what you submitted through our website forms and remove your name, email address, and role from your First Month Free application. When we delete your details from our sales records, we keep only a one-way hash of your email address, which cannot be turned back into the address, so that our sales team's email and meeting records do not add you again; that stops applying if you later submit a form on our website or if our team adds you again. Otherwise, information you submit through our website forms is kept as described below.

We delete a job application, with any résumé attached, 12 months after we receive it. Other information you submit through our website forms and demo bookings (a booking also creates an event in our Google Workspace calendar), and the website visitor records linked to the __visitor_id cookie, have no fixed deletion date: we keep them until you ask us to delete them or we delete them.

5. Cookies and Tracking Technologies

• Essential: sign-in sessions, sign-up and invitation steps, your active organization and dashboard preferences in the signed-in application, and an anonymous visitor identifier (__visitor_id, kept for up to two years) that lets our website assistant recognize you and keep your conversations.
• Display preference: a session-only cookie (p11-theme) that keeps the light or dark theme you choose until you close your browser.
• Analytics: page-view and performance telemetry and event counts, to which we add nothing that identifies you (Vercel Analytics, Vercel Speed Insights).
• Payments: Stripe may set its own cookies on pages where you add a card, to prevent fraud.

You can control cookies through your browser settings; disabling certain cookies may affect functionality.

6. Your Rights and Choices

You may request to:

• Access a copy of the personal information we hold about you
• Correct inaccurate personal information
• Delete your personal information
• Receive a copy of your data in a structured, machine-readable format, prepared by our support team
• Opt out of marketing emails (use the unsubscribe link or contact us)

If you are a California resident or a resident of another U.S. state with comprehensive privacy legislation, these rights, including the right to know, the right to opt out of the sale or sharing of personal information (we do not sell or share it), and the right to non-discrimination for exercising your rights, apply as provided by your state's law.

If you are in the European Economic Area, the United Kingdom, or Switzerland, these rights apply as provided by the GDPR, the UK GDPR, or Swiss law. You can also object to or restrict our processing, and withdraw consent where we rely on it. Point11 controls the personal information this policy describes, except information a customer gives us about its own customers (Section 1), which we process for that customer; send requests about that information to the customer. We process personal information to perform our contract with you or your organization, for our legitimate interests in running, securing, and improving our services, to meet legal obligations, and with your consent where we ask for it. You may also complain to your local data protection authority.

To exercise any of these rights, contact us at legal@point11.ai. We will verify your identity and respond within the time required by applicable law. We complete a request to delete an organization's data within 45 days, as described in Section 4.

7. Security

We implement commercially reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit and at rest. For details on our security practices, see point11.ai/security. No method of transmission over the Internet is completely secure.

8. International Data Transfers

Point11 is based in the United States, and our service providers (Section 3) process information in the United States and other countries. If you use our services from outside the United States, your information is transferred to and processed in the United States. When we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum) or another mechanism the law recognizes.

9. Children's Privacy

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child, we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new “Last Updated” date and, where required, by providing additional notice (such as email).

11. Contact Us

Point11, Inc. 2301 Collins Avenue, Apt 334 Miami Beach, FL 33139 Email: legal@point11.ai