Privacy Policy
This Privacy Policy explains how rabbl ("rabbl", "we", "us" or "our") collects, uses, shares and protects information when you use our website and the rabbl synthetic audience research platform (the "Service").
rabbl is operated by Flat Earth Yeti Pty Ltd, which is the data controller for the purposes of applicable data protection law. If you have any questions about this policy or how we handle your information, contact us at hello@flatearthyeti.com.
By using rabbl, you agree to the practices described in this Privacy Policy.
1. A quick summary
- We collect the minimum we need to run your account, take payment, and deliver the Service.
- Your raw brief, structured research question, creative stimulus and uploaded audience data are stored only while your job needs them, then deleted after successful processing. A finished report may restate the question as part of its generated content. Failed or abandoned job inputs are deleted within 7 days.
- Your latest 20 finished reports and related podcast audio remain private to your account for up to 90 days. Compact category learning can improve your own future research in the same category and market, but is never shared with another customer or added to universal knowledge.
- rabbl uses YouTube API Services to retrieve publicly available information for competitor and creative intelligence. See Section 5.
- We use a small number of trusted third parties (for authentication, payments and AI processing). We do not sell your personal information.
- Wherever you live, you have rights over your data. See Section 9.
This summary is for convenience only. Please read the full policy below.
2. Information we collect
Account information. When you create an account, we collect your name, email address and authentication details. Sign-in and account management are handled by our authentication provider, Clerk.
Billing information. When you subscribe to a paid plan, payment is processed by Stripe. rabbl does not receive or store your full card number. We retain limited billing records (such as plan, transaction identifiers and invoices) needed to run your subscription and meet our tax and accounting obligations.
Research inputs. To use the Service, you submit briefs, questions, stimulus and, optionally, audience data files. As described in Section 6 (Data retention), the structured input fields are stored only while needed to generate your results and let an active job recover safely after a system restart. A finished report may naturally restate your question or other context as part of the generated result. Inputs and reports are private to your account and are not used to train rabbl, build cross-customer intelligence, or create rabbl's universal knowledge.
Information collected automatically. When you use the Service, we and our providers collect certain technical information automatically, including device and browser type, IP address, and usage data. See Section 8 (Cookies and similar technologies).
YouTube API Data. When features that rely on YouTube are used, rabbl retrieves publicly available data through the YouTube Data API. See Section 5.
3. How we use your information
We use the information we collect to:
- provide, operate and maintain the Service;
- create and manage your account and authenticate you;
- process payments and manage your subscription;
- generate the analysis and results you request;
- communicate with you about your account, security and service updates;
- monitor, secure, debug and improve the Service; and
- comply with our legal obligations.
Legal bases (for EEA and UK users). Where the GDPR or UK GDPR applies, we rely on performance of a contract to provide the Service, legitimate interests to secure, debug and improve it, consent for non-essential analytics cookies where required, and legal obligations for tax, accounting and similar requirements.
Automated decision-making. We do not use your personal information to make decisions that produce legal or similarly significant effects about you through solely automated means. The Service generates simulated audiences from your research inputs; this is not automated decision-making about you as an individual.
4. How we share your information
We share information only as needed to run the Service, and with providers who are bound to protect it. Our key providers ("sub-processors") are:
| Provider | Purpose |
|---|---|
| Clerk | Account authentication and management |
| Stripe | Payment processing |
| Anthropic, OpenAI, Google | AI model processing used to generate results |
| Google / YouTube | Source of publicly available data via the YouTube Data API |
| Microsoft (Clarity) | Product analytics |
| Replit | Application hosting and infrastructure |
To generate results, the briefs, questions and stimulus you submit are transmitted to our AI model providers (Anthropic, OpenAI and Google) for processing. These providers process the data to return a response and, under our agreements with them, do not use it to train their models.
We may also disclose information if required to do so by law, to protect our rights or the safety of others, or in connection with a merger, acquisition or sale of assets. We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising as those terms are defined under California law.
5. YouTube API Services
rabbl uses YouTube API Services. By using features that rely on YouTube data, you are also agreeing to be bound by the YouTube Terms of Service, available at https://www.youtube.com/t/terms.
Google's handling of data is governed by the Google Privacy Policy, available at http://www.google.com/policies/privacy.
What we access. rabbl uses the YouTube Data API to retrieve publicly available information about videos and channels, such as titles, descriptions, thumbnails, publicly reported view and engagement metrics, and related metadata. rabbl uses this information solely to provide competitor and creative intelligence within the Service.
What we do not do. rabbl does not require you to sign in to YouTube or Google to use the Service, and does not access your personal YouTube account, viewing history or private YouTube data.
How we handle it. YouTube API Data is retrieved on demand and used to produce your results. A limited snapshot of public YouTube comments and related source material may be cached privately to your account for up to 14 days, so rabbl can provide useful results if a later scan encounters an API limit or temporary source outage. It is not shared with other customers, used for advertising, or used to train rabbl. After 14 days, cached source material is no longer read and is physically deleted.
You can review and control the data that Google shares with third-party applications, and revoke access where applicable, through the Google security settings page at https://security.google.com/settings/security/permissions.
6. Data retention
- Research inputs and job data: to run your analysis, simulation or podcast, and to recover it safely if our systems restart while it is processing, rabbl temporarily stores the minimum information needed to carry out the job. Raw briefs, uploads, audience data, form snapshots and creative stimulus are deleted after a job completes successfully. Inputs for failed or abandoned jobs are automatically deleted within 7 days.
- Finished reports and podcast audio: your 20 most recent finished reports are available for up to 90 days. Reports older than 90 days, reports displaced by the 20-report limit, and related podcast audio older than 90 days are automatically deleted. Podcast audio is private to its owner.
- Customer-owned category learning: rabbl keeps compact, consolidated observations that can improve your future research only when the customer, category and market all match. Repeated observations are deduplicated or consolidated to avoid uncontrolled duplicate storage. This learning is separate from raw inputs and reports, survives ordinary report expiry, is never available to another customer, and never enters universal knowledge. It remains while your account is active and is deleted when we fulfil an account research-data deletion request.
- YouTube and Reddit source cache: limited public source material may be cached privately to your account and used for up to 14 days as a fallback when live source data is unavailable or too thin. It is not shared with other customers or used to train rabbl. Expired material is not read and is physically deleted.
- Universal knowledge: rabbl's shared knowledge layer accepts only approved public or licensed sources with recorded provenance and market scope. Customer briefs, uploads, reports, caches and derived customer learning are excluded.
- Account information: retained while your account is active. Following account closure, it is deleted within 30 days, except where we must keep it to meet a legal obligation.
- Billing records: retained for the period required by applicable tax and accounting law (typically 7 years).
- Automatically collected data: retained for up to 12 months for security and service-improvement purposes.
7. Data security
We use appropriate technical and organisational measures to protect information, including encryption in transit and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and any relevant regulator where required by law.
8. Cookies and similar technologies
We and our providers use cookies and similar technologies on our website and within the Service. These are used for:
- Essential purposes: authentication and keeping you signed in (via Clerk), and secure payment processing (via Stripe). The Service will not function correctly without these.
- Analytics purposes: to understand how the Service is used and to improve it, via Microsoft Clarity.
Consent. Where required by law, including in the EEA and UK, we ask for your consent before setting non-essential analytics cookies, and you can withdraw that consent at any time. You can also control cookies through your browser settings. Blocking essential cookies may prevent parts of the Service from working.
Global Privacy Control. Where required, we honour recognised opt-out preference signals such as Global Privacy Control transmitted by your browser.
9. Your privacy rights
Depending on where you live, you may have rights over your personal information, including the right to access, correct, delete, or port your information, to object to or restrict certain processing, and to withdraw consent.
- If you are in the European Economic Area or the United Kingdom (GDPR / UK GDPR): you have the rights described above and may lodge a complaint with your local supervisory authority.
- If you are in California (CCPA/CPRA): you have the right to know what personal information we collect and how it is used, to access and delete it, to correct it, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information, and we will not discriminate against you for exercising your rights.
- Other US states, Canada, and elsewhere: you may have similar rights under your local privacy law, and we will honour them where they apply to you.
- If you are in Australia (Australian Privacy Principles): you may request access to and correction of your personal information and make a complaint about how we handle it.
To exercise any of these rights, including deletion of your stored research data, contact us at hello@flatearthyeti.com. After verifying the account, we use an account-scoped deletion process covering raw jobs, reports, podcast audio, source caches and customer-owned learning without affecting another customer. We will respond within the timeframe required by applicable law. You may use an authorised agent to make a request where the law permits.
10. International data transfers
rabbl operates globally and uses providers located in various countries, including the United States. Where we transfer personal information out of the EEA, the UK, or another region with data-transfer restrictions, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or transfers to countries recognised as providing an adequate level of protection. You can contact us for more information about these safeguards.
11. Children's privacy
The Service is not directed to children, and you must be at least 18 to use it. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal information, please contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
13. Contact us
If you have any questions, requests or complaints about this Privacy Policy or our handling of your information, contact us at: hello@flatearthyeti.com