Privacy and data retention

Who operates this service

FAUVION is operated by [Operator legal name not configured], at [Postal address not configured]. Questions about this notice or about your data go to [Contact email not configured]. The governing jurisdiction is stated as [Jurisdiction not configured].

What is collected

If you are a founder using the practice meeting:

• Your account — email address, a display name, and authentication records held by Supabase Auth.
• Your company brief — whatever you type into the brief form. Fields you leave blank are not collected.
• Your pitch deck, if you upload one — the PDF itself, stored in a private bucket, plus the text extracted from it on the server.
• Your session record — when the session was started and ended, which meeting focus you chose, which AI model held the conversation, and the session’s status. What was said in the meeting is not part of it.
• Figures measured during the meeting — numbers, not sound. While the meeting runs, your own browser measures the microphone signal on your device and keeps only the numbers: how long the meeting lasted; how long each of your turns was and how much of the talking you did; the pauses inside your turns — how many, the share of time spent in them, and the long ones; how long you took to start answering; how many times you began speaking while the investor was still speaking; how far your pitch moved (a range in semitones, relative to your own median); and, only where your browser leaves the microphone level unprocessed, how far your loudness varied. They are stored inside your report.
• What those figures leave out. Your absolute pitch — how high or low your voice is — is not kept; only the range is. The pitch and loudness figures are never sent to the AI. No voiceprint is created and nothing here identifies you by your voice. Every figure is approximate.
• No audio and no transcript. Your microphone audio is streamed from your browser to the live-voice provider (OpenAI) for the length of the meeting, and read on your device for the figures above, which keep the numbers and drop the sound. FAUVION itself never receives the audio: it does not pass through the web app or the meeting monitor described below, and it is not recorded, uploaded to or stored by this service, so we hold no recording of your voice to keep, share or delete. No transcript is made by this service either: none is shown, none is stored, and none is sent anywhere by it.
• Your chosen meeting focus — whether you practised a general investor meeting or one aimed at a named firm, and, if you typed a firm name yourself, that name. It is stored on the session, sent to the live-voice provider (OpenAI) to set the emphasis of the conversation, and deleted with the session on the same deadline as everything else. A chosen firm is only a practice focus. It is not shared with the firm, which has no involvement in this product, and your program manager cannot see it.
• Your report — the written feedback produced once, at the end of the meeting. It covers the content of your pitch, whether each investor question was answered, partly answered or not answered, and coaching on spoken presentation — pace, pauses and clarity, along with filler words, structure and concision, and — only when your browser measured you repeatedly starting a full answer before the investor had finished — turn-taking. It also holds the measured figures above. It is written in the AI’s own words and contains no transcript and no quotes or excerpts of anything you said or wrote; each point names what it is based on and where in it.
• Theme tags and housekeeping records — short tags from a fixed list that your report is filed under, stored with it and deleted with it (they are not counted or shown to anyone: see below), and the records of the deletion jobs queued for your content.
• Usage figures for each live conversation — the AI provider’s reference for the call, which AI model was used, when the call opened and closed, how much of the session’s usage limit it used (amounts worked out from counts of the tokens the AI processed), and a short fixed code for why the call ended (for example, that the report was stored, that you left, that the usage limit was reached, or that the meeting monitor saw the session changed), and whether the call was ended for that last reason. No audio, and nothing that was said. They are kept on this service’s servers and are not shown to you or to your program manager. They are kept with the session. When the session is deleted, the provider’s reference and the code are wiped as soon as the call’s account is closed (at once, unless the call is still running); the rest — your account, the model, the times, the amounts and whether the call was ended for tampering — is kept until two days after the call was opened, and then deleted. That short overlap is deliberate: the service limits how much one account, and all accounts together, can use in any 24 hours, and deleting a session must not reset that.
• A count of the sessions you start — your account and the time, nothing else — kept for two days, so that the limit on how many sessions can be started in an hour cannot be reset by deleting them. It is not shown to anyone.
• A record that you accepted this notice — the time, and which version you accepted.

If you are a program manager: your account, your program details, your cohorts, and the invitations you create.

Why it is used

Your brief, your deck text, your chosen meeting focus and what you say in the meeting are used to hold the practice conversation and to produce the report at the end, including coaching on pace, pauses and clarity, and the short theme tags it is filed under, which stay with it. Those are the only purposes. They are not used to train any model by us, not sold, not shared with other founders, and not shown to your program manager.

The report is written once, at the end, by the same AI model that held the conversation, from what it heard together with your brief and deck text. On the content of your pitch it sets out what held up, answers that were weak or unsupported, contradictions and points to clarify, questions and evidence to prepare, and three priority actions. Its notes on spoken presentation are the AI’s impressions from listening, not measurements, and it can mishear. The figures your browser measures are a separate thing: they describe sound — when you were speaking and pausing, how far your pitch moved, how far your loudness varied — and they are used as nothing more than that.

This service does not do emotion recognition. Nothing here infers or states emotions, confidence, nervousness or personality. The report gives no score, no grade and no likelihood of raising. It does not assess body language or appearance — there is no video — and it does not comment on your accent or your voice. No voiceprint is created, and nobody is identified by voice.

The live-voice provider (OpenAI)

The practice meeting is a live spoken conversation with an audio-capable AI model from OpenAI, reached through its Realtime API. The operator of this service chooses which model. The model hears your audio directly and replies aloud, in an AI voice, as a generic, sceptical practice investor. The connection is made from your browser directly to OpenAI, so your audio goes to OpenAI and not to FAUVION.

OpenAI receives:

• your microphone audio, streamed for the length of the meeting;
• your written company brief;
• the text extracted from your pitch deck, if you uploaded one — the first 24,000 characters;
• your chosen meeting focus — a firm name, if you chose or typed one — and, for a firm whose own public website this service has read and checked, the small amount of public context this service recorded from it. No firm supplied, reviewed or approved that context;
• a pseudonymous account identifier — a one-way hash of your account ID, the same for each of your meetings, with no name or email in it — which OpenAI uses for abuse monitoring;
• when the meeting ends, a handful of the figures your browser measured — but never the pitch and loudness figures, which are not sent to the AI at all.

OpenAI is not asked to transcribe what you say: input transcription is switched off. There is one detail we cannot switch off. OpenAI’s service produces a text version of the AI’s own spoken replies and sends it on the call’s event stream. Your browser does not receive that stream: its connection to OpenAI carries audio and nothing else. The meeting monitor described below does receive it, and drops that text unread.

The report is produced by the same model when the meeting ends.FAUVION’s server asks OpenAI for it through the meeting monitor, which holds the server-side connection to your meeting, then checks and stores the copy OpenAI returns. Your browser never receives that reply — its connection to OpenAI carries audio only — and cannot change what is stored. Your browser sends FAUVION only the figures it measured, which the server includes in that request.

What OpenAI does with what it receives, according to its published API data controls as we read them on 2 October 2026:

• API data is not used to train its models by default.
• It may keep abuse-monitoring logs, which can include content, for up to 30 days, or longer if the law requires.
• It keeps no other stored conversation state for this kind of connection, and the operator has tracing switched off.
• Zero data retention and EU data residency exist, but both need OpenAI’s approval and neither is arranged here. Processing is therefore in the United States by default.

OpenAI handles that data under its own terms, which we do not control, and FAUVION cannot delete what OpenAI holds. Before relying on this in production, the operator needs to review OpenAI’s commercial terms and data retention settings and, if appropriate, record the arrangement in whatever processor documentation applies to them.

The meeting monitor

FAUVION also runs a small, always-on service called the meeting monitor. It is operated by whoever runs this deployment — the operator named above — on a hosting provider they choose. It holds OpenAI’s server-side connection to each live meeting. Over that connection it opens the meeting, keeps the AI told how much time has passed and how much is left, ends the conversation when time is up, and asks the same model for the written report.

It also watches the session for changes it did not make itself — something added to or deleted from the conversation, a reply that none of your turns started, changed instructions, tools, tracing or transcription settings, or audio arriving faster than it could be spoken. Your browser cannot do any of those through the app: its connection to OpenAI carries audio only. If the monitor sees something that neither it nor your voice could have caused, it ends the call at once, no report is written for that meeting — a report written from it could not be trusted — and that session cannot open another conversation. It also ends a meeting it loses sight of.

• It receives no audio. Your audio goes from your browser straight to OpenAI and never passes through it.
• It receives OpenAI’s event stream for the call. That includes the text of what the AI investor says, because OpenAI always sends it; the meeting monitor drops it unread.
• It never receives a transcript of you, because what you say is not transcribed at all.
• To open the meeting and ask for the report it is handed the meeting’s instructions (which contain your brief, your deck text and your meeting focus), the report request with the figures your browser measured, and the report on its way back to FAUVION’s server.
• It keeps a running total of what the call has used, from the counts of tokens OpenAI reports for each reply — counts only, never what was said — so that the session stays within its usage limit. It passes that total to FAUVION’s server, which stores it as described under “What is collected”.
• It tells the meeting screen, through FAUVION’s server, where the call stands: that you are heard speaking, that a reply has started, how it ended and when. States and times only, never what was said. That is what moves the orb on the meeting screen.
• It holds all of this in memory only, for the length of the call. It writes nothing to disk, and its logs record only event names, codes and those totals. After the call it keeps, in memory, only the fact that the call closed, why, and its total — for ten minutes, or for a day if the call was ended for tampering, so that FAUVION’s server is certain to learn of it — and nothing that was said.

The microphone, the AI voice and on-device measurements

A real meeting needs a microphone: there are no typed answers, and your browser’s own speech recognition is not used. What happens in the meeting room:

• Switching the microphone on. Starting a session does not touch the microphone. In the meeting room, a screen explains that your audio will be streamed to OpenAI and asks you to switch the microphone on; your browser then shows its own permission prompt.
• The conversation. You talk; the AI asks follow-up questions and is designed to take turns with you, and you can interrupt it by speaking, which works best with headphones. The voice you hear is synthetic — generated by AI. You are not talking to a real investor or to any named person, and the AI is not affiliated with, and does not speak for, any firm.
• Length, muting and ending. OpenAI limits a live session to 60 minutes and offers no way to extend or resume one. Within it, the spoken interview has a hard maximum of 55 minutes, and up to 5 minutes are kept for the same AI session to write your report from what it heard. At 55 minutes the conversation ends automatically and the report is requested. If the report cannot be finished before the 60-minute limit, nothing is stored for that meeting and you are told; an unfinished report is never saved or shown. Each session also has a usage limit, covering the AI’s replies, its closing words, the report and any conversation started again after a dropped connection; a meeting that reaches it ends before 55 minutes — the investor wraps up, you are told on screen, and your report is still written — so a meeting lasts up to 55 minutes, not always the full time. You can mute your microphone — no sound from it is sent while it is muted — and you can end the meeting at any time before then. Ending it produces the report, which usually takes a minute or two and can take a few minutes.
• No resuming. This service keeps no recording or transcript of what was said, so a meeting you leave before ending it, or whose connection drops, cannot be picked up later. You can start the conversation again — a session allows up to 3 live conversations — but there is one report per session.

The on-device measurements are separate from the conversation. While the meeting runs, your browser reads the microphone signal on your device, works out the figures listed under “What is collected”, and keeps only the numbers: the audio is read and dropped. The measuring makes no recording. When the meeting ends, the figures are stored inside your report and deleted with it; a handful of them go to the AI at that point, and the pitch and loudness figures never do.

Pitch is kept only as a range, in semitones, relative to your own median; your absolute pitch is not kept. Loudness variation is reported only where your browser leaves the microphone level unprocessed; where it does not, that figure is left out. All of the figures are approximate.

The site’s own pages are the only ones permitted to use the microphone — a page from another site embedded here never is — and your browser’s permission prompt always applies. There is no video: no page here may use the camera.

The demo at /demo is different. It is a labelled simulation that needs no account: no AI model is involved and nothing is sent anywhere. The investor’s lines are scripted and shown on screen, and can optionally be spoken by a voice built into your device as a stand-in for the AI voice the real product uses. You can optionally switch on your microphone so that your browser measures your turns for real — that audio never leaves the page — or use simulated turns. The report shown at the end is a pre-written example, not a response to what you said.

What your program manager can see

Your program manager can see that you joined the cohort and when, whether you started a session, and whether and when you completed one. Nothing else: nothing from your report reaches them, not even the theme tags it is filed under.

They cannot see:

• your pitch deck, or any text extracted from it;
• your company brief;
• the meeting itself — they cannot see or hear it, and this service holds no recording and no transcript of it;
• the figures your browser measured — the pause, pitch and loudness numbers included;
• your report, including its coaching on pace, pauses and clarity.

This is enforced by database access rules, not by the interface. The tables holding those things have no policy granting managers access, and the file bucket scopes every file to the account that uploaded it.

Theme counts are switched off. The service is built to show a program manager, for a cohort, how many founders’ reports raised each of a fixed list of themes, counted only in fixed groups of at least 3 founders, added and removed together. Independent review of that design found that a manager could still sometimes work out one founder’s themes from the counts: by knowing another founder’s report (or joining under another email address), by comparing groups that share founders, by choosing who is in a cohort, or across repeated meetings. Until that can be made safe enough, the counts are shown to nobody and no founder is counted. The tags your report is filed under stay with your report and are deleted with it.

This is enforced in the database, not only on the page: a founder is counted only for a session held under a version of this notice that describes the counts. This version does not. If a later one does, you will be shown it and asked to accept it before it can apply to you.

How long it is kept

Your deck, its extracted text, your brief, your session record and your report — the measured figures inside it included — have a deletion deadline of 7 days. This service holds no audio and no transcript. That deadline is recorded against everything you create, and a deletion job is queued for it as soon as you create anything.

The job is carried out by a cleanup task that the operator of this service runs on a schedule: it removes your content from the live service the next time it runs after the deadline. How promptly that happens depends on the operator keeping that schedule running. You can always delete your content yourself, immediately, from Your data.

• The clock starts the first time you save anything here — in practice your company brief, which has to exist before you can upload a deck or start a session.
• It does not restart when you come back, add material, or run a second session. The deadline is fixed at the first one and the database refuses to move it.
• Your dashboard shows the exact date and time, and you can trigger the same deletion immediately from there.

Some things outlive that window, deliberately, and none of them holds your material: your account itself and the name you gave it (so you can sign in again); your cohort membership and when you joined, which your program manager sees on the cohort roster; the record that you accepted this notice, which holds a timestamp and a version number; and the records of the deletion jobs queued for you (their status and dates).

Whether and when you started and completed a session is not kept separately: the roster works it out from your session records. When those are deleted — by you, or at the deadline — the roster shows you as not having started, so your program manager can see that your records have gone, and roughly when.

If a deletion keeps failing, your content stays until a later attempt succeeds, which can be after the 7-day deadline. The scheduled task tries a deletion up to six times; after that it stops, your data page says so, and the task reports a failure to the operator’s scheduler. Asking to delete again starts the tries afresh and covers everything you have at that moment.

And three things briefly outlive a deletion you make yourself, deliberately. The first two are the reduced usage figures for a live conversation (your account, the AI model, the times, the amounts and whether the call was ended for tampering — no call reference and nothing that was said), until two days after that conversation was opened; and the count of sessions you started (your account and the time), for two days. Both exist so that the service’s limits cannot be reset by deleting sessions. They are removed by a task the operator runs on a schedule, or, failing that, the next time a live conversation or a session is started on the service. The third is a note of which storage folder to check for a leftover file: your account’s reference, the reference of the brief that was deleted, and the time — none of your content. It exists so that a stored pitch deck is still removed if the brief it belonged to disappeared some other way, and it is removed the next time the operator’s scheduled clean-up task finds that folder empty.

There is no self-service account deletion in this version. To have the account and the consent record removed as well, write to [Contact email not configured] and the operator will delete them directly. We would rather say that than put a button here that does not exist.

What deletion actually covers

When deletion runs, the stored PDF is removed through the storage API, and the brief, extracted text, session record, report and the theme tags stored with it are deleted from the live database. The status shown on your dashboard reflects both halves: it does not say “deleted” until the file is gone as well as the rows. The usage figures for the session’s live conversations are reduced at the same moment to the short record described above, which goes two days after the conversation was opened — so for a session older than two days, at the next scheduled run.

The figures your browser measured — the pause, pitch and loudness numbers included — are stored inside the report and are therefore removed with it by the same deletion: immediately when you delete your data yourself, or when the scheduled cleanup runs after the deadline. There is no audio and no transcript to delete, because this service never records or stores either, and no absolute pitch, because it is never kept. The database still contains the table an earlier version used for per-answer transcripts; this version writes nothing to it.

The same applies at the live-voice provider. What OpenAI keeps — abuse-monitoring logs, which can include content, for up to 30 days, or longer if the law requires — is governed by its terms, not by this deadline. Your audio goes from your browser straight to OpenAI and never passes through this service, so our deletion cannot reach it: FAUVION cannot delete what OpenAI holds.

Analytics and debugging

Your content is not retained for analytics or debugging after it expires. Server logs record operational facts only — a job identifier, an attempt count, a status, a sanitised error category. They do not contain document text, prompt contents, the measured figures, signed file URLs, or credentials.

Your choices

• You can skip the deck entirely and use only a written brief.
• You can leave any sensitive brief field blank.
• You can practise a general investor meeting and name no firm.
• You can decline the microphone. No audio is then sent to OpenAI, but a real meeting cannot take place without it; there is no typed alternative.
• You can mute your microphone, or end the meeting, at any time.
• You can try the demo first, which involves no AI model and sends nothing anywhere.
• You can delete everything immediately from your dashboard (the reduced usage figures and the count of session starts follow within two days, as described above).
• You can decline the notice, in which case no brief, deck or session is created.

Changes

This notice carries a version number, shown at the top. When the wording changes in a way that matters, the version changes with it, and the version you accepted stays recorded against your consent. Version 2026-09-30.1 added spoken answers transcribed by the browser, and version 2026-10-01.1 added sound measurements made in the browser and the statement that this service does not do emotion recognition. Version 2026-10-02.1 replaced the question-and-answer interview with a live spoken conversation: your audio is streamed to the live-voice provider (OpenAI); there is no browser speech recognition, no typed answer and no transcript; and the report is written once, at the end, by the model that held the conversation. Anthropic, the AI provider named in earlier versions, is no longer used anywhere in this product. Version 2026-10-04.1 added the meeting monitor, which holds OpenAI’s server-side connection to each meeting and receives no audio; set the length of a meeting by OpenAI’s 60-minute limit, with up to 56 minutes of conversation; and said that the report contains no quotes or excerpts of anything you said. Version 2026-10-05.1 set a hard maximum of 55 minutes for the spoken interview, with up to 5 minutes for the same session to write the report, and said that a report that cannot be finished within the 60-minute limit is never saved or shown; that the meeting monitor handles the meeting’s instructions and the report in memory only, for the length of the call; and that turn-taking is coached only from interruptions your browser measured. Version 2026-10-06.1 added a usage limit per session, which can end a meeting before its 55 minutes are up (the investor wraps up, you are told on screen, and the report is still written), and said that, to keep to that limit, usage figures for each live conversation — amounts and times, the AI provider’s reference for the call, the model used and a short code for why the call ended, nothing that was said — are stored on this service’s servers until the session is deleted. Version 2026-10-09.1 said that your browser’s connection to OpenAI carries audio only, so the text version of the AI’s replies no longer reaches your browser, and that the meeting screen is told where the call stands by the meeting monitor, as states and times; that you can hold one live conversation at a time and have an allowance for any 24 hours as well as the limit per session; that a call in which the monitor sees something neither it nor your voice could have caused is ended at once and its session opens no further conversation; and — a change to retention — that after a session is deleted, reduced usage figures are kept until two days after the conversation was opened, and a count of session starts for two days, so that deleting sessions cannot reset the limits. Version 2026-10-12.1 said how you are counted in your cohort’s themes: only in a group of at least 3 founders, added together and taken out together; that this is grouping and not anonymity, and what a manager can still work out; that a manager’s own account cannot join their cohort as a founder; and — a change to retention — that the tags of a founder who was counted stay in those counts after the founder’s own deletion, until every report in their group has been deleted. Version 2026-10-14.1 says that the theme counts are switched off: nothing from your report reaches your program manager and no founder is counted; that the database counts a founder only for a session held under a version of this notice that describes the counts; and that if you ask to delete everything again while an earlier request is still outstanding, the request covers everything you have when you ask again. If you accepted an earlier version, you are asked to accept this one before starting a session.

See also the draft terms and how to contact the operator.