In brief
We keep very little. Your account is an email address. The material you submit for a review or a pitch session is processed to produce your report and is not saved to our database; the report lives in your browser. To produce it, your material is sent to AI, web-crawling and speech providers, most of them in the United States, who handle it under their own retention rules. We use no advertising, no analytics trackers and no marketing cookies, we do not sell personal data, and we do not use your material to train AI models. The Panel is for adults aged 18 and over.
1. About us and this notice
The Panel is the service at facethepanel.com, run by the operator of The Panel (“we”, “us”). We are the controller of the personal data described in this notice. It explains what we collect when you visit the website or use the tools, why, who receives it, how long it is kept, and your rights. Our Terms of Service govern your use of the service itself.
If you have any question about this notice or your personal data, write to us at hello@facethepanel.com.
2. The personal data we collect
Account information
You sign in with your email address and a one-time code. We hold your email address, an account identifier, the dates your account was created and last used, and session records, which include the IP address and browser details of the device that signed in. We do not hold a password for you, and we do not ask for your name or your date of birth. At sign-in you confirm that you are 18 or over.
Material you submit
This is whatever you choose to give a session: a website address, a written description or pitch, a voice recording you dictate, screenshots, a PDF deck, and the options you pick. It is business material rather than personal data in most cases, but it can contain personal data if you put it there, for example names in a pitch deck. We process this material to produce your report and do not save it, or the report, to our database. Please leave out other people's personal data and any sensitive personal information (such as health, beliefs or criminal records): the service does not need it.
Public web pages
When a session includes a website address, we fetch public pages from that site and run web searches about the product and its competitors. Those pages and results may contain personal data that their publishers made public, such as the names of a company's team. We use it only as part of the material under review.
Technical information
To prevent abuse and control cost, we count the sessions and transcriptions started from each IP address in short time windows. Our hosting provider also keeps standard request logs (IP address, time, page or route requested, browser details). Our own operational logs record timings, which AI models were called, token counts and error messages for each session; they are not designed to record your material.
What we do not collect
We do not use analytics or advertising trackers, session replay, or third-party marketing cookies, and we do not buy data about you from anyone.
3. Purposes and lawful bases
Under the UK GDPR and the EU GDPR we need a lawful basis for each use of personal data. Ours are set out below.
| Purpose | Lawful basis |
|---|---|
| Creating your account, signing you in, and emailing you login codes | Performance of a contract (Article 6(1)(b)) |
| Producing the review or pitch session you ask for, including sending your material to the AI, crawling, search and speech providers that the session needs | Performance of a contract (Article 6(1)(b)) |
| Reading public web pages and search results that mention identifiable people, as part of a session | Legitimate interests (Article 6(1)(f)): providing the review our user asked for, using only information already made public, and not keeping it |
| Rate limiting by IP address, request logs, and fault and security logging | Legitimate interests (Article 6(1)(f)): keeping the service secure, available and affordable to run |
| Service messages, such as notice of a material change to these documents | Performance of a contract; legitimate interests |
| Handling rights requests and complying with the law | Legal obligation (Article 6(1)(c)) |
Providing an email address is a contractual requirement: we cannot give you an account without it. Everything else you submit is your choice. We do not send marketing email. We do not make decisions about you that have legal or similarly significant effects by automated means; the AI scores in a report are about the product you submitted, not about you.
4. How the AI features use your material
The Panel is an AI product, so producing a report means sending your material to AI providers. For a session, the text you submit, the text of crawled pages, a screenshot of the site and the web research are sent to the language model providers that write the persona reviews and the final report. Screenshots and PDF decks you upload are sent to a vision model once to be described in text. A short summary of the product (its title, description and opening lines) is sent to a separate provider that estimates which personas are in the product's audience. If you dictate a pitch, the recording is sent to a speech-to-text provider and the transcript comes back to your browser. Website addresses and search queries go to the crawling and search provider. Each provider is named on the subprocessors page.
The language model providers, Anthropic and OpenAI, are called through their business APIs, whose terms do not use API data to train their models by default, and we do not use your material to train anything ourselves. Providers may keep inputs and outputs for a limited period under their own policies, typically up to 30 days, for abuse and safety monitoring, and for longer if content is flagged or the law requires it. Your email address and account identifier are not included in what we send to the AI providers.
The personas are simulated. No real person reads your material as part of a session.
5. Who receives personal data
We use service providers to run The Panel. The current list, with each one's role and location, is at facethepanel.com/subprocessors, and we update that page before a new provider begins processing personal data. At the date of this notice they are Neon (account database and sign-in), Resend (login emails), Vercel (hosting), Upstash (rate-limit counters), Anthropic and OpenAI (AI models), TypeSafe (audience estimate), Firecrawl (web crawling and search) and ElevenLabs (speech-to-text).
If the business or its assets are sold or reorganised, personal data may be transferred as part of that transaction, and the recipient will have to honour commitments consistent with this notice. We disclose personal data to public authorities only where the law requires it. We do not sell personal data and we do not show advertising.
6. International transfers
Your account data is stored in the European Union. Most of our other providers process data in the United States or on global infrastructure. Where personal data leaves the United Kingdom or the European Economic Area, the transfer is made under the UK International Data Transfer Addendum or the EU Standard Contractual Clauses in the provider's data processing terms, or in reliance on the provider's certification under the EU-US Data Privacy Framework and its UK Extension.
7. Retention
| Category | Period |
|---|---|
| Account (email address, account identifier, session records) | Until you ask us to delete your account. Sign-in sessions expire on their own. |
| Material you submit and the reports produced | Not stored by us: held in memory while the session runs. The report stays in your browser until you leave or reload the page. |
| Copies held by AI, crawling and speech providers | Under each provider's own policy, typically up to 30 days; see Section 4. |
| Rate-limit counters keyed by IP address | Up to 24 hours |
| Hosting request logs and our operational logs | For the hosting provider's standard log retention period |
| Correspondence and records of rights requests | As long as needed to deal with the matter and to show that we complied |
8. Your rights
You have the right to ask for access to your personal data, to have it corrected or erased, to restrict or object to our processing of it (including any processing based on legitimate interests), and to receive the data you gave us in a portable format. These rights are subject to the exceptions the law provides, and we will tell you if we rely on one.
To use any of these rights, including deleting your account, email hello@facethepanel.com from the address on your account. We will respond within one month, normally free of charge. If a request is complex we may extend that by up to two further months and will tell you so within the first month.
If you are unhappy with how we have handled your personal data, please tell us first. You also have the right to complain to the Information Commissioner's Office in the United Kingdom (ico.org.uk) or to the data protection authority where you live.
9. Cookies
The Panel sets only the cookies needed to keep you signed in. There are no analytics or advertising cookies, which is why there is no cookie banner. The cookie statement lists them.
10. Children
The Panel is for adults. You must be 18 or over to have an account, and we ask you to confirm this at sign-in. We do not collect dates of birth and do not knowingly collect personal data from anyone under 18. If you believe a child has created an account, tell us at hello@facethepanel.com and we will close it and delete its data.
11. Security
Traffic to The Panel is encrypted in transit. Sign-in uses one-time codes, so there is no password to leak. The tools and the routes behind them require a signed-in session, provider keys are held only on the server, and we keep the amount of personal data we hold to a minimum. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the regulator where the law requires it.
12. Changes to this notice
We will publish any revised version here with a new effective date, and keep earlier versions available once there is more than one. Where a change is material, for example if we start saving reports to your account or add a new kind of provider, we will tell you at sign-in or by email before it takes effect.