Privacy Policy — LPH Roleplay

In most situations, LPH acts as data processor, processing personal data in accordance with the Customer's instructions, who is the controller. In these cases, the obligations of transparency and obtaining consent from data subjects belong to the Customer.

LPH acts as controller when it autonomously defines the purposes and means of processing — for example, when processing data of LPH's own Customers and platform users for managing the commercial relationship, when developing AI models with genuinely anonymized data that does not originate from Google APIs, or when complying with LPH's own legal obligations.

To enable the provision of the Services and the management of the commercial relationship, LPH collects the following data from the Customer's representatives and Authorized Users:

• Identification data: full name, role, company, tax ID;
• Contact data: business email, phone, WhatsApp;
• Access data: login credentials, access logs, IP address, device used;
• Platform usage data: features accessed, configurations, history of support interactions;
• Financial data: billing information, tax ID for invoice issuance (we do not store credit card data).

When accessing the platform, LPH automatically collects:

• IP address, device and browser type, operating system;
• Pages accessed, session duration, and navigation flow;
• Cookie data and similar technologies, as described in Section 10.

Google Sign-In (authentication)

When a user chooses to sign in with Google, LPH receives from the Google Sign-In (OAuth) service exclusively basic identity information: the user's Google account identifier, email address, and profile information (name and profile picture). This data is used solely to authenticate the user and to create or manage their account within LPH Roleplay. No other scope is requested at the moment of login. LPH does not store the access or refresh token issued by Google in this flow — only the email and name are retained for account identification.

Google Meet (optional integration)

Separately, if an already-authenticated user wishes to connect their Google Meet account, they may do so explicitly on their account settings page. At that moment — and only at that moment — the platform requests, with the user's express consent, the meetings.space.readonly scope, which allows listing recordings and accessing transcripts of the user's Google Meet meetings. The transcripts are processed to identify objection patterns, customer questions, and improvement opportunities, generating roleplay scenarios personalized for that user. This integration is optional, user-initiated, and may be revoked at any time in the account settings or directly on the Google account permissions page.

The complete description and the Google Limited Use disclosure are in the product-specific section below.

The primary use of data is the operation of the Services contracted by the Customer. Without this data, it is not possible to deliver the Services.

Customer and platform user data is used for: invoice issuance and billing; communications about contracted Services; technical support; and renewals or contract changes.

LPH uses anonymized and aggregated platform-usage data to identify errors and improve the platform. Data obtained from Google APIs is never used to develop, train, or improve generalized AI or machine-learning models. Transcripts accessed through the Google Meet API are processed exclusively to generate roleplay scenarios personalized for the user who authorized the access — a service the user directly requests and that is displayed prominently in the product's interface. No transcript is used outside the scope of the user who originated it. Apart from this user-facing scenario generation, any use of Google data is strictly limited to providing the sign-in and account features of LPH Roleplay.

LPH may process personal data to comply with legal, regulatory, judicial, or administrative obligations, disclosing only the minimum necessary.

Platform access and usage data are used for security monitoring, detecting improper use, fraud prevention, and protection of system integrity.

LPH may share personal data with the following recipients:

• Service providers and sub-processors: cloud infrastructure providers (including Google Cloud Platform), video conferencing platforms, CRM and analytics tools — contractually obligated to maintain equivalent protection standards;
• Customers: in the course of providing the Services, LPH shares generated outputs with the contracting Customer;
• Competent authorities: when required by law, judicial decision, or administrative authority request, only to the extent strictly necessary;
• Acquirers in corporate transactions: in the event of a merger, acquisition, or sale of LPH's assets, with notice to users.

Data obtained through Google APIs — both Google Sign-In identity data and Google Meet transcripts — is shared only with infrastructure sub-processors strictly necessary to operate the corresponding features of LPH Roleplay (e.g., cloud hosting). It is never shared with analytics providers, CRM systems, advertising networks, other platform users, or any third party for their own purposes, and is never sold.

LPH uses cloud infrastructure that may be located outside Brazilian territory. International transfers are made under:

• European Union / EEA: Standard Contractual Clauses (SCCs) approved by the European Commission, under art. 46 of the GDPR;
• Brazil: for data sent to countries with an adequate level of protection recognized by the ANPD, the transfer occurs without additional requirements;
• Other countries: SCCs approved by ANPD Resolution No. 19/2024.

LPH does not sell, rent, share, or assign personal data to third parties for marketing or advertising purposes independent of the Services contracted by the Customer. For purposes of the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), LPH does not "sell" or "share" personal information as those terms are defined under California law.

LPH adopts technical and organizational measures consistent with market standards to protect personal data. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).

In the event of a Data Breach that may pose risk or harm to data subjects, LPH will notify the Customer within no more than 72 (seventy-two) hours after becoming aware of the incident, with the information necessary to comply with communication obligations to the ANPD (LGPD art. 48) and to affected data subjects under the GDPR (art. 33).

You may exercise your rights at any time by contacting privacy@leadsperhour.com. LPH will respond within no more than 15 (fifteen) days (LGPD) or 30 days (GDPR/CCPA).

Revoking Google Sign-In

You may revoke LPH Roleplay's access to your Google account at any time by visiting your Google Account permissions page. Revocation immediately stops the use of Google identity data for authentication. This does not delete your LPH Roleplay account, nor does it affect the Google Meet integration if it has been configured separately.

Revoking the Google Meet integration

If you have connected Google Meet, you may disconnect the integration at any time in the account settings within LPH Roleplay, or by revoking access directly on the Google Account permissions page. After revocation, LPH accesses no new transcripts; access and refresh tokens are deleted immediately. Transcripts already processed and linked to generated roleplay scenarios are retained for the period described in Section 6.

Revocation does not affect lawful processing performed prior to revocation.

To deliver training scenarios, LPH Roleplay may process the following categories of data, in addition to those described in Section 2:

• Sales Rep performance data: behavioral and performance data from real meetings (communication patterns, speech pace, language, duration of interactions);
• Objection and scenario library: anonymized objection patterns, language, and communication style extracted from LPH Meet outputs (only after irreversible anonymization or with separate consent);
• Practice session recordings: voice and/or video of the Sales Rep performing the role play;
• Scorecards and progression metrics over time.

Sales Rep performance data is retained during the contract term plus 1 year, then deleted or anonymized. Meeting transcripts obtained through the Google Meet API (scope meetings.space.readonly), when authorized by the user, are used as a basis for generating roleplay scenarios. The use of this data is governed by the Google API Services — Limited Use Disclosure described below.

Using data collected by LPH Meet as a training basis in LPH Roleplay constitutes processing for a new purpose, requiring:

• Independent and specific consent from data subjects for the training purpose — distinct from the consent obtained for real-time analysis;
• Robust anonymization of data before use in LPH Roleplay, such that participants cannot be identified;
• Documentation of the independent legal basis for this secondary processing.

It is expressly prohibited to use raw data from LPH Meet (images, facial templates, identifiable participant records) in LPH Roleplay without cumulative satisfaction of the above requirements.

This repurposing concerns outputs generated by the LPH Meet product and does not apply to data obtained through Google APIs. Google Sign-In data is used only for authentication, and Google Meet transcripts are used only to generate the authorizing user's roleplay scenarios; both are governed exclusively by the Google API Services — Limited Use Disclosure below.

The Customer must:

• Inform all Sales Reps in advance about the existence, purpose, and operation of the system;
• Describe the categories of behavior that will be analyzed;
• Obtain consent from Sales Reps when required by applicable law;
• In European markets, verify the need for consultation with worker representatives before implementation.

• Recording laws: in 11 U.S. states, recording video conferences for later use requires consent from all participants. The Customer is responsible for verifying and complying with the laws of each state.
• EEOC: the use of AI for performance evaluation may constitute discriminatory practice if it produces results systematically unfavorable to protected groups. The Customer must monitor and audit the outputs periodically.
• Illinois AI Employment Laws: the Illinois Artificial Intelligence Video Interview Act and similar state laws impose specific requirements for the use of AI in employment-related evaluations.