Pacct — Privacy Policy

Effective date: 27 August 2026

Last updated: 27 August 2026

1. Introduction

Pacct is a voice-based negotiation training service. You practise negotiating out loud with an AI counterpart, and we record, transcribe, measure and evaluate those practice sessions so we can give you feedback and track your progress.

That means we handle your voice, your words and an assessment of how you communicate. This policy explains exactly what we collect, why, who we share it with, how long we keep it and what you can do about it. We have tried to write it plainly rather than defensively.

Data controller: LGHTHSE Solutions GmbH (in incorporation) Blegistrasse 9, 6340 Baar, Switzerland [email protected]

2. Scope

This policy applies to the Pacct website at pacct.ai, the Pacct application at app.pacct.ai, and all related services. It does not apply to third-party services we link to, or to the identity providers you may use to sign in — those have their own policies.

It applies to you wherever you are. We offer Pacct worldwide, we run it from Switzerland on servers in Germany, and this policy is written to cover every user rather than only those in one region. The body describes what we do for everyone. Annex A at the end sets out the additional disclosures and rights that apply if you are in a particular country or region — the EEA, the UK, Switzerland, a US state, Canada, Brazil, Australia, New Zealand, Japan, South Korea, India, Singapore, South Africa or Türkiye. If Annex A gives you something the body does not, Annex A wins.

We do not offer the Service in every country. Where we have decided not to operate, or where sanctions or local law prevent us, the Service is unavailable rather than available on different terms — see §3.3 of our Terms of Service.

3. What we collect

3.1 Information you give us

3.2 Information we collect automatically

3.3 What we do not collect

We do not use advertising trackers, marketing pixels or social plugins. The only analytics tool we use is Google Analytics (§3.2, §10), and we do not use it for advertising or to build a profile of you. We do not buy personal data about you from data brokers. We do not track you across other websites. We do not ask for special-category data — health, race, religion, political opinion, sexual orientation, trade-union membership — and you should not put it into a practice session.

4. Your voice recordings, specifically

Because this is the part people care about most:

• Recordings are made only during a live session, and only after your browser has asked you for microphone permission. You can withdraw that permission at any time in your browser settings.
• Recordings are stored in your account so you can replay them alongside your transcript and feedback. They are not public and are not visible to other users.
• We do not create a voiceprint. We do not perform speaker identification or verification, we do not match one recording against another, and we do not use your audio to build any biometric template. We say this deliberately, because several countries define biometric data by whether it is used to identify a person. Where the law where you live treats stored voice recordings as sensitive or biometric data regardless of that — as, for example, Brazil and South Korea do — we handle them on that footing and ask for your explicit consent before your first session. See Annex A.
• We do not use your recordings, transcripts or evaluations to train AI models — not ours, and not our vendors'. Our vendors process them under contract, on our instructions, to deliver the Service to you.
• You can delete them. Deleting a session deletes its recording, transcript, measurements and evaluation. See §14.
• Please keep real confidential information out of them. Practice sessions are practice. Use invented names and round numbers. See §7.4 of our Terms of Service.

5. Why we use your data, and our legal basis

For users in the EEA, UK and Switzerland, we rely on the following legal bases under the GDPR, UK GDPR and Swiss FADP:

Where we rely on legitimate interests, we have weighed those interests against your rights and you may object at any time (§14).

If you are somewhere that requires consent instead. A number of countries — South Korea, Japan, Türkiye, Thailand, Indonesia and Vietnam among them — do not recognise the contractual-necessity or legitimate-interests analysis above in the same way, and require your consent for some or all of this processing, for the handling of sensitive data, and for sending your data abroad. Where that is the case we ask you for that consent, separately and unbundled, before we collect the data, and we tell you what happens if you decline. The specific disclosures are in Annex A.

Consent to the processing that runs a live session — recording, transcription, measurement and evaluation — is not optional in the sense that matters: if you withhold or withdraw it, we cannot provide practice sessions to you, because they are the Service. You can withdraw it at any time, and you can keep an account without ever starting a session.

6. Automated processing you should know about

Your session is processed by artificial intelligence at several points: speech recognition turns your voice into text; a language model plays the counterpart and responds to you; another language model scores your performance, writes observations and reads an overall mood for the session; a further model labels the tone of each turn as you speak, for the live transcript only, and discards it; and a further model may write the counterpart memory if you have purchased that add-on. If you plan a real negotiation, a language model reads your description and the text of the documents you attach (and, for scanned pages or images, the page itself) to ask its questions, write the plan and build a practice counterpart from it; if you analyse a real meeting, speech recognition transcribes it and a language model writes the analysis.

These systems produce estimates. They can be wrong. Your scores are not a professional assessment of your ability, and we do not use them to make any decision that has a legal or similarly significant effect on you. See §16 for your rights around automated decision-making.

7. Who we share your data with

We do not sell your personal data. We do not share it for advertising. We do not license it to anyone to train AI models.

We do use service providers ("sub-processors") to run the Service. Each processes your data only on our instructions and under a written contract:

We may also disclose personal data:

• To your organization, if you hold a team seat — but only what you have opted into. See §10.
• To professional advisers (lawyers, accountants, auditors) under a duty of confidentiality.
• To authorities, where we are legally required to, or where necessary to establish, exercise or defend legal claims. We will notify you unless legally prohibited.
• In a corporate transaction — a merger, acquisition or sale of assets — in which case we will tell you before your data becomes subject to a different privacy policy.

We keep this list current. Where practical we will notify account holders before adding a sub-processor that processes session content.

8. Where your data is processed, and international transfers

We run the Service from Switzerland, and we store your data in the European Union. Your account, your session recordings, your transcripts, your evaluations and your profile are stored on DigitalOcean servers in Frankfurt, Germany. Parts of the processing happen elsewhere: during a live session your audio is transported and transcribed, and the counterpart's replies are generated and voiced, by the providers in §7, most of which operate in the United States; your evaluation and the usage analytics are produced the same way. Those providers receive what they need for their step and are bound by contract; they are not where your data lives. We do not currently offer a choice of storage region, for anyone. If that changes, we will update this policy.

So if you are in the EEA, the UK or Switzerland, your stored data stays in Europe, but the audio and transcript of a live session go to the United States for the duration of that processing. If you are elsewhere, using Pacct means your personal data leaves your country for Germany and, for those steps, the United States. Either way it goes to a country whose data protection law is different from your own and which your government may not have recognised as offering an equivalent level of protection, and where public authorities may in some circumstances be able to compel access to it under local law. We think you should know that in plain terms before you record your voice with us.

We do not treat that as a reason to send your data unprotected. Every provider in §7 is bound by a written contract that restricts them to our instructions, and we add the transfer mechanism the law where you live requires:

You can ask for a copy of the safeguards that apply to you — with commercially confidential terms removed — by writing to [email protected].

9. Marketing

We send two kinds of email.

Transactional email — account confirmation, password resets, security alerts, receipts and material changes to the Service or these policies. You cannot opt out of these while you hold an account, because they are part of providing it.

Marketing email — product news, negotiation tips and offers. We send these only if you have opted in. You can withdraw your consent at any time, using the unsubscribe link in any marketing email or from your account settings, and we will act on it promptly. Withdrawing consent does not affect the lawfulness of what we sent before, and it does not stop transactional email.

We do not sell or rent your email address, and we do not share it with third parties for their own marketing.

10. Cookies and local storage

We keep this short. The app sets two first-party cookies to sign you in, and both the website and the app load Google Analytics, which sets its own cookies. We do not use advertising cookies. Our web fonts are served from our own servers.

sid and uid are strictly necessary to provide the Service you asked for. Clearing them signs you out and, before sign-up, disconnects you from any trial session data.

The Google Analytics cookies are not necessary, and you can refuse them. To opt out of analytics: turn on the Global Privacy Control or Do Not Track setting in your browser — when either signal is sent we do not load Google Analytics at all; or use a content blocker; or install Google's opt-out browser add-on. We will add an in-app consent prompt for analytics cookies before general launch.

While the Service is in its feedback phase, the app additionally sits behind a shared access password. That is a perimeter control and stores nothing about you.

11. How long we keep your data

When you delete your account, we delete or irreversibly anonymize your personal data within 30 days, except where we must keep it for legal reasons (typically billing records) or in secure backups, which are overwritten on a short rolling cycle.

12. Security

• All traffic to and from the Service is encrypted with TLS, provisioned and renewed automatically.
• Passwords are stored only as salted bcrypt hashes. We cannot recover your password.
• Login session tokens are stored only as SHA-256 hashes, so a copy of our database does not let anyone sign in as you.
• Login attempts are rate-limited by IP address.
• Recordings and session records are stored on servers we control in Frankfurt, Germany, isolated per user, with access paths validated against directory traversal.
• Database connections are encrypted in transit.
• Access to production systems is restricted to the smallest number of people who need it and is protected by SSH key authentication; password logins are disabled.
• We take regular backups.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the relevant supervisory authority as required by law and without undue delay.

13. Team and organization accounts

If your employer or another organization bought your seat, the seat is how you get access to Pacct. It is not a way for them to watch you practise.

What your organization can see: that your seat exists and is in use; its own billing and usage; which trainings it assigned to you and whether you completed them; your activity — sessions started and completed, minutes practised, lessons and drills finished; and results aggregated across a group of at least 5 people.

What your organization cannot see: your scores, your skill ratings, your session mood, your evaluations, the written feedback, your recordings, your transcripts, or your training profile. Not on request, not by changing a setting, and not by asking us to enable it — there is no mechanism for it in the Service and we will not build one for a customer.

You may choose to share a specific report with a specific person. That is your decision to make, one report at a time, and you can withdraw it. Your organization cannot request a report through the Service.

Who is responsible for what. We are the controller for your session content — recordings, transcripts, measurements, evaluations and your profile. Your organization is the controller for its roster, its seat assignments, the trainings it writes, and its completion and cohort records. We do not hand your session content to your organization, and it cannot acquire it from us by agreement (Terms §14.2).

If your seat ends, your account and your content stay with you — your account converts to a free personal account and your history remains yours (Terms §14.7).

We tell organizations that Pacct scores are automated estimates and must not be used for any employment decision (Terms §14.6). Your organization is separately responsible under its own local law for workplace monitoring, employee data and employee-representative consultation.

14. Your rights

We give these rights to everyone, everywhere. Rather than work out what your country obliges us to offer, we extend the following to every user as a matter of policy, whether or not your local law requires it:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct data that is wrong or incomplete.
• Erasure — have your data deleted. You can delete individual sessions in the app. To delete your whole account, write to [email protected] — self-service account deletion is not built yet, so we do it by hand, within 30 days.
• Portability — receive your data in a structured, machine-readable format, or have it sent to another provider where technically feasible.
• Restriction — ask us to limit how we use your data while a dispute is resolved.
• Objection — object to processing based on legitimate interests, including profiling.
• Withdraw consent — at any time, for anything based on consent (such as marketing). This does not affect processing carried out before you withdrew.
• Complain — to your local data protection authority, wherever you are. Annex A names the authority for the main countries and regions we serve. We would appreciate the chance to address it first.

Where you live may give you more. Annex A sets out the extra rights and disclosures that apply in specific countries — for example the right to appeal a refusal in several US states, the right to an explanation of automated processing in Quebec and Brazil, and the consent and disclosure requirements in South Korea and Japan. Nothing in this policy takes away a right your local law gives you.

We will never charge you for exercising a right, and we will never treat you worse for it — no degraded service, no different price, no withheld feature.

To exercise any right, use your account settings where the control exists, or write to [email protected]. We aim to answer everyone within 30 days, and within any shorter period your local law sets. If a request is complex we may take longer, and we will tell you why before the first deadline passes. We may need to verify your identity first — we will ask for the minimum needed, and we will not use what you send us for anything else. You may use an authorized agent where the law permits, and we may ask you to confirm the agent is acting for you.

If we refuse a request, we will tell you why, and we will tell you how to challenge it — by appealing to us where your law provides for that, and by complaining to your authority in any case.

15. Children

The Service is for adults. You must be 18 or older to use Pacct, everywhere we operate. Some countries set a lower age at which a young person can consent to online services on their own — 13, 14, 15 or 16, depending where you are. We do not rely on any of them: our threshold is 18 worldwide, which is higher than any of these, and it applies regardless of parental consent.

We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, write to [email protected] and we will delete it promptly and tell you when it is done.

16. Automated decision-making and profiling

We build a profile of your negotiation behaviour and use it to decide what to recommend you practise next, and we score your sessions automatically (§6).

We do not use automated processing to make decisions producing legal effects concerning you or similarly significantly affecting you. Our scores are training feedback, not certification, and they are not used to determine your access to employment, credit, housing, education or any service.

You can always ask a human at [email protected] to look at an evaluation you think is wrong, challenge it, and have it corrected or removed. You can delete any session and its evaluation yourself, which also removes it from your profile.

17. Changes to this policy

We may update this policy. If a change is material we will tell you by email or in the Service at least 30 days before it takes effect, and we will always update the "Last updated" date above. Continuing to use the Service after a change takes effect means you accept it.

18. Contact us

Questions, requests or complaints about privacy, from anywhere in the world:

LGHTHSE Solutions GmbH (in incorporation) Blegistrasse 9, 6340 Baar, Switzerland [email protected]

You can write to us in English. If you write in another language we will do our best, and we will not refuse a request because of the language it arrived in.

We are established in Switzerland. Where the law requires us to appoint a local contact — for example a representative under Art. 27 GDPR for the EEA, or under Art. 27 UK GDPR for the United Kingdom — we will appoint one and name them here before general launch. Until then, [email protected] reaches the people responsible for this policy directly.

19. Language

This policy is written in English. Where we publish a translation it is for your convenience, and the English version governs if the two disagree — except where the law where you live says the local-language version prevails, in which case it does.

Annex A — Country and region-specific disclosures

This annex adds to the policy above; it does not replace it. Only the part for where you live applies to you. If anything here conflicts with the body of the policy, this annex wins for people it covers.

A1. EEA, United Kingdom and Switzerland

Your rights under the GDPR, the UK GDPR and the Swiss FADP are the ones listed in §14. The legal bases are in §5 and the transfer safeguards in §8.

Complaints: your local supervisory authority in the EEA (the one where you live, where you work, or where the issue arose); the Information Commissioner's Office in the UK; the Federal Data Protection and Information Commissioner in Switzerland.

Switzerland is where we are established, and the Swiss FADP is our home law. Representatives under Art. 27 GDPR and Art. 27 UK GDPR will be named in §18 once appointed.

A2. United States

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in the CCPA/CPRA and in the comprehensive privacy laws of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Delaware and the other states with equivalent statutes. We have not done so in the preceding 12 months, and we have no plans to. We do not run advertising trackers. The only analytics we use is Google Analytics (§10), and we honour the Global Privacy Control by not loading it at all when your browser sends the signal; we will also treat that signal as an opt-out of any sale or sharing should we ever do either.

Sensitive personal information. Your session audio, transcripts, session mood and evaluations are, or may be, "sensitive personal information" or "sensitive data" under these laws. We use them only to provide the Service you asked for, and never to infer characteristics about you outside that purpose — so the CPRA right to limit the use of sensitive personal information has nothing to restrict here. Where your state requires opt-in consent before we process sensitive data — Colorado, Connecticut, Virginia and others — we ask for it before your first session.

Categories, for CCPA/CPRA notice purposes. In the last 12 months we collected: identifiers (name, email, IP address, account and cookie identifiers); customer records (billing contact); commercial information (plan, purchases, usage); internet activity (pages requested, error logs); audio and electronic information (session recordings and transcripts); sensitive personal information (the audio and its derived labels); inferences (your derived profile, scores and recommendations). We collect them from you, from your device, and from an identity provider if you sign in with one. We use them for the purposes in §5, disclose them for a business purpose to the providers in §7, and retain them as described in §11.

Biometric statutes. We do not collect, capture, use, store, buy, sell, lease, trade or otherwise profit from biometric identifiers or biometric information as those terms are defined in the Illinois Biometric Information Privacy Act or the Texas Capture or Use of Biometric Identifier Act. Specifically, we do not create a voiceprint, and we do not use your audio to identify or verify who you are (§4). If we ever intend to, we will obtain your written consent and publish a retention and destruction schedule beforehand.

Washington My Health My Data Act and equivalents. We do not collect consumer health data, and we do not treat our tone labels or session mood as health data — they describe how a negotiation practice turn sounded, not your health. We do not sell any such data, and we would need your signed authorization to do so.

Appeals. If we refuse a request you made under a US state privacy law, you may appeal by replying to our decision or writing to [email protected] with "Appeal" in the subject. We will decide the appeal and explain the outcome in writing within 45 days. If we deny the appeal, we will give you a link to submit a complaint to your state Attorney General.

Timing. We answer within 45 days, extendable once by a further 45 days where the law allows and we tell you why.

Shine the Light (California Civil Code §1798.83). We do not disclose personal information to third parties for their own direct marketing purposes.

Nevada. We do not sell covered information, and we will honour a verified opt-out request sent to [email protected] regardless.

A3. Canada

We handle your personal information in accordance with PIPEDA and, where it applies, Quebec's Law 25 and the provincial private-sector laws of Alberta and British Columbia.

• Accountability. Your data is processed in the United States (§8). We remain accountable for it, and we require comparable protection from every provider by contract. While it is outside Canada it is subject to the laws of the country it is in, including lawful access by that country's authorities.
• Consent. We rely on your consent, express where the information is sensitive. Your session audio and its derived labels are sensitive, and we ask for express consent before your first session.
• Automated decision-making (Law 25). We use automated processing to score your sessions and to build the profile that drives your recommendations (§6, §16). You may ask us for the personal information we used, the principal factors that led to the result, and the right to have someone at our end review it. Write to [email protected].
• Biometrics (Law 25). If a Quebec regulator treats our stored session audio as biometric data, using it requires prior disclosure to the Commission d'accès à l'information. We have not made such a disclosure; we will do so before serving users in Quebec if it is required.
• Portability. You may ask for your computerised personal information in a structured, commonly used technological format.
• Complaints. To the Office of the Privacy Commissioner of Canada, or to the Commission d'accès à l'information du Québec if you are in Quebec.
• Language. A French-language version is not yet available; see §19.

A4. Brazil

We process your personal data under the LGPD.

• Sensitive data. The LGPD treats biometric data as sensitive. We treat your session audio and its derived emotional labels as sensitive personal data and process them on your specific and highlighted consent (Art. 11(I)), given before your first session.
• Legal bases. Consent for session data; performance of a contract for your account and billing; legal obligation for tax records; legitimate interests for security. The table in §5 maps across.
• International transfer. Your data goes to the United States under ANPD-approved standard contractual clauses, and with your consent where Art. 33 requires it.
• Your rights (Art. 18). Confirmation of processing, access, correction, anonymisation or deletion of unnecessary or excessive data, portability, information about who we share with, information about the consequences of refusing consent, revocation of consent, and review of decisions made solely by automated processing.
• Our encarregado is named in §18.
• Complaints. To the Autoridade Nacional de Proteção de Dados (ANPD).

A5. Australia

We handle personal information in accordance with the Australian Privacy Principles.

• Overseas disclosure (APP 8). Your personal information is disclosed to recipients in the United States (§7, §8). We take reasonable steps to ensure they handle it consistently with the APPs, by contract.
• Sensitive information. We collect your voice recordings and derived labels with your consent. We do not collect government-related identifiers, and you must not put them into a session.
• Anonymity and pseudonymity (APP 2). You can use a display name of your choosing, but we cannot provide an account, billing or your saved history without an email address, so the practical option of dealing with us anonymously is limited.
• Access and correction. As in §14. We do not charge for access.
• Data breaches. We comply with the Notifiable Data Breaches scheme and will notify you and the OAIC of any eligible data breach.
• Complaints. Write to [email protected] first; we will respond within 30 days. You may then complain to the Office of the Australian Information Commissioner.

A6. New Zealand

We handle personal information under the Privacy Act 2020 and its information privacy principles. Your data is disclosed overseas under IPP 12 on the basis of comparable contractual safeguards (§8). You have rights of access and correction under IPP 6 and IPP 7, exercisable as in §14. We will notify you and the Office of the Privacy Commissioner of any privacy breach that has caused or is likely to cause serious harm. Complaints go to the Office of the Privacy Commissioner.

A7. Japan

We handle personal information under the Act on the Protection of Personal Information (APPI).

• Purpose of use. The purposes are those in §5, and we do not use your data beyond them without your consent.
• Provision to third parties in a foreign country. We provide your personal data to the providers listed in §7, all of which are located in the United States. We give you this information in advance: the destination country, information about that country's personal information protection regime, and the measures those providers take — they are contractually bound to standards equivalent to APPI Chapter IV. You can request further detail at [email protected].
• Your rights. Disclosure, correction, addition, deletion, cessation of use, cessation of third-party provision, and disclosure of records of third-party provision.
• Complaints. To us at [email protected], or to the Personal Information Protection Commission.

A8. South Korea

We handle personal information under the Personal Information Protection Act (PIPA). Korean law requires us to ask for several consents separately, and to tell you that you may refuse each one and what happens if you do. We ask for these before we collect anything.

1. Collection and use of personal information

2. Sensitive information. Your voice recording and the session mood derived from it are handled as sensitive information and collected only on your separate consent.

3. Overseas transfer (Art. 28-8). We ask for your separate consent to this transfer:

4. Destruction. We destroy personal information without delay once its purpose is achieved — electronic files by permanent deletion, any printed material by shredding or incineration.

5. Your rights. Access, correction, deletion, suspension of processing, withdrawal of consent, and the right to refuse or object to an automated decision and ask for an explanation.

6. Contacts. Our domestic representative, where appointed, is named in §18. You may also report to the Personal Information Protection Commission, the Korea Internet & Security Agency (KISA) privacy call centre, or the Personal Information Dispute Mediation Committee.

A9. India

We process your personal data under the Digital Personal Data Protection Act, 2023.

• Notice and consent. We ask for your consent on the basis of a clear notice of what we collect and why, available in English and in the languages the Act specifies on request. You may withdraw consent at any time, as easily as you gave it; withdrawing consent to session processing means we can no longer provide sessions.
• Your rights. Access to a summary of your data and its processing, correction and completion, erasure, grievance redressal, and the right to nominate someone to exercise your rights if you die or become incapacitated.
• Grievance Officer. Named in §18. Write there first; we will respond within the period the Act requires.
• Complaints. To the Data Protection Board of India, after using our grievance process.
• Transfers. Your data is processed in the United States, which is permitted unless the Government restricts it.

A10. Singapore

We handle personal data under the PDPA. We collect, use and disclose your data for the purposes in §5, with your consent or as the PDPA otherwise permits. You may withdraw consent by writing to [email protected], and we will tell you the likely consequences — for the session data, that we can no longer provide sessions. You may request access to and correction of your data. Data is transferred to the United States under contractual terms requiring a comparable standard of protection (s.26). Our Data Protection Officer can be reached at [email protected]; complaints may be made to the Personal Data Protection Commission.

A11. South Africa

We process personal information under POPIA as the responsible party. Our Information Officer is named in §18. Special personal information — including your biometric information, if our stored session audio is treated as such — is processed only with your consent. Transfers to the United States rely on section 72 contractual safeguards. You have the rights in §14, plus the right to object to processing and the right to complain to the Information Regulator (South Africa). A PAIA manual is available on request.

A12. Türkiye

We process personal data under the KVKK. Voice recordings and any inference about your emotional state are treated as requiring your explicit consent, which we ask for before your first session. Transfers abroad rely on explicit consent and on the safeguards permitted by Art. 9. You have the rights in Art. 11 — to learn whether your data is processed, to request information, to know the purpose, to know the third parties it goes to at home and abroad, to have it corrected or deleted, to object to an adverse result produced solely by automated analysis, and to claim compensation for damage. Applications go to [email protected]; complaints go to the Kişisel Verileri Koruma Kurumu.

A13. Everywhere else

If you are somewhere not listed above, the body of this policy applies to you in full. We give you the rights in §14 as a matter of policy whether or not your local law requires them, we transfer your data under written contractual safeguards, and you can raise anything with us at [email protected] and with your local data protection authority if you have one. If your local law gives you a right we have not mentioned, you still have it, and asking us for it is enough.