Privacy Policy

1. Introduction

TrainHQ provides sales training software for enterprise teams. This policy covers two groups: visitors to www.trainhq.ai, and platform users (employees of our enterprise customers).

For platform users, TrainHQ acts as a data processor under instruction from the employer. The employer’s Data Processing Agreement (DPA) with TrainHQ governs that processing. This policy provides the transparency overview; the DPA contains the full contractual detail.

2. Who is Responsible for Your Data

The data controller depends on your location:

• European Union: TrainHQ GmbH, Rollbergstraße 28A, 12053 Berlin, Germany; Commercial Register: HRB 265491 B

• United States:TrainHQ, Inc., 279 Galeon Court, Miami, Florida 33143, USA

Email: privacy@trainhq.ai

3. What Data We Collect and Why

We collect the following personal data:

- Account data (name, email, user ID, role): used to operate the service

- Voice recordings and transcripts from training sessions: used to generate AI feedback

- AI Assistant files uploaded by users (documents, audio, video): used to enable authoring features

- Usage data (session activity, progress, scores): used to provide and improve the service

- Call recordings (only if the optional Call Diagnostic module is activated by the employer)

- Website visitor data (IP address, browser, pages visited): used to operate our website

- Contact form submissions (name, email, message): used to respond to inquiries

We process platform data under contract with the employer (EU: Art. 6(1)(b) GDPR; US: performance of contract). Website visitor data is processed on the basis of legitimate interests. Where required by law, we obtain individual consent.

4. No Use of Customer Data for AI Training

TrainHQ does not use customer or user data to train, fine-tune, or improve AI models.

AI processing runs on data in transit only. No personal data is retained by AI service providers beyond the active request. This applies globally.

5. Data Location

EU customer data is stored and processed exclusively within the European Union. US customer data is stored and processed within the United States. We do not transfer customer data across regions without explicit customer consent.

TrainHQ GmbH is a subsidiary of TrainHQ, Inc. (USA). Where group-internal data transfers occur for EU users, they are governed by Standard Contractual Clauses. A Transfer Impact Assessment is available on request.

6. Sub-Processors

The following sub-processors process personal platform data on our behalf. We do not sell personal data to any third party.

- Sub-Processor: Amazon Web Services (AWS)
- Purpose: Cloud hosting and storage
- Location: EU regions (for EU customers) / US regions (for US customers)

- Sub-Processor: Microsoft Azure
- Purpose: AI services: speech-to-text, text-to-speech, transcript analysis
- Location: EU regions (for EU customers) / US regions (for US customers)

Internal tools only (no platform data access): Google Workspace, Slack, and HubSpot are used for our own website, communications, and marketing. They have no access to platform or customer employee data.

We notify customers of sub-processor changes at least 30 days (EU) or 14 days (US) before they take effect. To receive notifications, email privacy@trainhq.ai.

7. Data Retention

You control how long platform data is kept. Retention periods are set by your administrator; TrainHQ enforces whatever you configure. Zero retention is supported: voice recordings, for example, can be deleted immediately after transcription.

- Voice recordings: configurable, up to 90 days

- Transcripts: configurable, up to 3 years

- AI Assistant files: configurable, up to 1 year

- All platform data: deleted within 30 days of contract end

Website contact data (not customer-controlled): retained for up to 2 years.

8. Security

TrainHQ maintains SOC 2 Type II certification and conducts annual third-party penetration testing. Data is encrypted in transit and at rest. For details, contact privacy@trainhq.ai.

If a personal data breach occurs, we notify affected customers within 48 hours and support regulatory notification obligations (GDPR: 72 hours to supervisory authority; US: per applicable state law).

9. Your Rights

EU users (GDPR)

You have the right to access, correct, delete, restrict, or port your personal data, and to object to processing. You may also withdraw consent or lodge a complaint with your national supervisory authority.

US users, California (CCPA)

You have the right to know what personal information we collect and how it is used, to request deletion, to correct inaccurate information, and to non-discrimination for exercising your rights. We do not sell personal information.

Platform users: contact your employer first. You may also reach us directly at privacy@trainhq.ai. We respond within 30 days (EU) or 45 days (US).

10. Updates

If we make material changes, we notify active customers at least 14 days in advance. The current version is always at www.trainhq.ai/privacy-policy.

Questions: privacy@trainhq.ai