1. Introduction
Multiply ("we", "our", "us") is a transfer intelligence platform. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our platform, including our web application and Slack integration.
We are committed to complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
2. Data Controller
The data controller for information processed through Multiply is your organization (the entity that has subscribed to or uses Multiply). Multiply acts as a data processor on behalf of your organization.
3. Data We Collect
3.1 Account Information
- Email address and name (from authentication provider)
- Organization name and membership role
- Slack workspace ID and user ID (when Slack integration is connected)
3.2 Training and Campaign Data
- Training content uploaded (PPTX presentations)
- Campaign configuration (topics, behaviors, goals, schedules)
- Generated messages and their delivery status
3.3 Diagnostic Data
- Performance diagnostic survey responses
- Scoring results and strategy recommendations
- Intervention analysis reports
3.4 Engagement and Analytics Data
- Slack reactions and thread replies to campaign messages
- Button clicks and form submissions within Slack messages
- Signal scores and composite metrics (aggregated and anonymized)
- Barrier reports submitted by learners
4. How We Use Your Data
- Service delivery: To generate and deliver training transfer interventions via Slack.
- Analytics: To calculate transfer scores, engagement indices, and business performance metrics for your organization.
- AI processing: Training content is sent to AI providers (Google Gemini) to generate behavioral analysis and campaign content. This data is not used to train AI models.
- Improvement: Aggregated, anonymized analytics may be used to improve our scoring algorithms and intervention templates.
5. Legal Basis for Processing
We process your personal data based on:
- Contract performance: Processing necessary to provide the Multiply service to your organization.
- Legitimate interest: Aggregated analytics to improve our platform.
- Consent: Where required, such as for data processing consent at signup.
6. Data Storage and Security
Your data is stored in the European Union using Supabase (PostgreSQL). We implement appropriate technical and organizational measures to protect your data, including:
- Encrypted connections (TLS) for all data in transit
- Database encryption at rest
- Organization-level data isolation (multi-tenant architecture)
- HMAC signature verification for Slack webhook events
- Role-based access control within organizations
7. Data Sharing
We share your data only with:
- Supabase: Database hosting (EU region)
- Vercel: Application hosting
- Google (Gemini API): AI content generation (training content only, not personal data)
- Slack:Message delivery (via your organization's connected workspace)
We do not sell your data to third parties.
8. Data Retention
We retain your data for as long as your organization maintains an active account. Campaign and analytics data is retained for the duration of the campaign plus 12 months to enable longitudinal analysis. You may request earlier deletion at any time.
9. Your Rights
Under the GDPR, you have the right to:
- Access: Request a copy of all your personal data (via
/api/user/export) - Rectification: Request correction of inaccurate data
- Erasure: Request deletion of your account and associated data (via
/api/user/delete) - Portability: Receive your data in a structured, machine-readable format (JSON export)
- Restriction: Request restriction of processing
- Objection: Object to processing based on legitimate interest
To exercise any of these rights, contact your organization administrator or email us at privacy@multiply.ai.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via the platform or email. The current version number is tracked in our consent system.