Privacy Policy

Last updated 18 August 2026

Who we are

The Gap Discovery Console is operated by Ran Merkazy Factor127, registration number 033984410, 25 Berl Katzenelson St., Kfar Saba, Israel. For anything in this policy, write to console@factor127.com.

The two roles in this Service — please read this one

This Service handles two different kinds of personal data, and our responsibility differs between them.

Consultant account data — we decide how it is used. Your name, email, login credentials and billing records exist because you have an account with us.
Everything inside a project — the consultant decides how it is used. Interview transcripts, participant names and roles, and the signals and reports built from them are uploaded and controlled by the consultant running the engagement. We process that material on their instruction and do not use it for our own purposes.

If you took part in an interview and want to know what happened to your contribution, ask the consultant or organisation that invited you — they hold the relationship and can act on it. If you cannot reach them, write to us and we will help you find the right route.

What we collect

Account data: name, email address, a hashed password, and the organisation you work with. We never store passwords in readable form.
Project content: briefs, uploaded documents and audio, interview and session transcripts, the signals extracted from them, and the reports and gap analyses built on top.
Participant details supplied by the consultant — typically a name, role and business unit — so that evidence can be attributed correctly.
Operational records: a log of edits and review decisions inside a project, and standard server logs. Interview transcripts are not written to application logs.
Billing records held by our payment provider. We never see or store your card details.

A note on anonymity

Interviews are often collected under a promise of anonymity. The Service supports that — contributions can be attributed to a role rather than a person — but anonymity is a property of how a study is designed and reported, not something software can guarantee. Free-text answers frequently identify people incidentally, and in a small participant group even aggregated findings can point to an individual. Consultants using this Service are responsible for setting a minimum group size before reporting and for honouring what they promised participants.

Why we process it

To provide the Service and the features you ask it to run.
To keep accounts secure, prevent abuse, and diagnose faults.
To take payment and meet accounting obligations.
To send transactional email — password resets, billing notices and service notifications.

We rely on the contract with you for the first three, and our legitimate interest in running a secure service for the rest. We do not sell personal data, we do not use it for advertising, and we do not use your project content to train AI models.

Who processes data on our behalf

Provider	What it handles
Anthropic	AI processing — signal extraction, report and gap drafting, AI-led interviews
OpenAI	Speech-to-text transcription of interview audio
Airtable	Structured project data — projects, signals, findings, participants
Cloudflare (R2)	Private storage for uploaded originals, extracted text, backups and archives
Railway	Application hosting
Resend	Transactional email
Google	Spreadsheet storage used by some interview flows
Paddle	Payment processing as Merchant of Record

These providers operate in various countries, including the United States, so using the Service involves international transfer of the material you put into it. Each provider is bound by its own terms to process data only as instructed.

How long we keep it

Active projects are kept for as long as the account is open and the project is in use.
Inactive or read-only projects may be moved out of live storage into a private archive. They remain yours and remain retrievable on request.
Backups of the whole system are taken regularly and held for 35 days.
Deletion on request: ask us and we will delete a project or an account, including archives, within 30 days — except where we must keep billing records to meet accounting or tax obligations.

Security

Access to the Service requires an account, sessions are signed and expire, and each consultant's projects are isolated from every other consultant's by checks made on the server rather than in the browser. Uploaded material is held in private storage that is not publicly reachable, and passwords are stored only as salted hashes. No system is perfectly secure, and we will tell affected users promptly if we become aware of a breach affecting their data.

Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to complain to a data protection authority. Write to console@factor127.com and we will respond within one month. If your request concerns material inside a consultant's project, we will pass it to them and support them in answering it.

Children

The Service is a professional tool sold to businesses and is not intended for anyone under 16.

Changes

If we change this policy in a way that materially affects you, we will give notice by email or in the Service before it takes effect.

← Back to sign-in