How results may be used
Your company agreed results are never used to judge or rate anyone.
Survey results exist to understand how teams are doing and to act on it. The customer agrees to:
- use results only for groups of 5 or more;
- never use results, or any answer, to judge, rank, discipline or decide about one person, including pay, promotion or redundancy;
- never try to find out who gave an answer, or combine results with other data to do so;
- never act against anyone for answering, or for not answering.
TakeOnePiece LLC builds Gists AI to support these limits: results from fewer than 5 people are not shown or loaded, answers are never shown with a name, and every view of results is logged.
Liability is capped at 12 months' fees, as set out in the Terms.
What we process, and why
This agreement is part of the Terms between TakeOnePiece LLC ("processor") and the customer ("controller"). It covers employee names, work emails, time zones, teams, managers, start and leave dates, Slack user groups, and survey answers. We process them only to provide Gists AI on the customer's documented instructions, which are the Terms, this agreement, and the settings the customer chooses.
Our duties
- Process personal data only on the customer's instructions.
- Make sure everyone with access is bound by confidentiality. Gists AI staff never see who wrote what.
- Help the customer answer people's requests to see, correct, export or delete their data. If an employee asks us to delete their answers, we pass the request to the customer and tell the employee when we have.
- An HR admin can download all of the company's data in one file from Settings: people, teams, privacy settings and their history, and each survey's questions, results, briefs and reports. Results come out as they do in the app: nothing from fewer people than the group size floor, and no one's answers next to their name. The link goes by email to the admin who asked, works for 24 hours, and the file is deleted after 7 days. Anyone can download their own data from Gists AI, next to Delete all my data: their profile, connections, settings, consent and notice history, their check-ins, and which surveys were sent to them. Survey answers are not in it: they are stored without names, so nobody can pick out one person's answers, not HR, not Gists AI and not the person who wrote them.
- We tell you within 72 hours of learning of a breach.
- Help with impact assessments where the law requires it.
Privacy settings
Your company sets the privacy rules, each with a reason. Employees are always told what each one means, before they answer. Results show only when 5 or more people answer. Below that, answers are not loaded at all. 5 is the default and the lowest. Your company can raise it, never below 5. Lowering a raised number needs a reason, and everyone is told 7 days before it starts. Every view of results is logged.
Subprocessors
The customer authorizes these subprocessors:
- Google Cloud: hosting and storage
- Google (Gemini): themes, summaries and suggestions, only when AI is on
- SendGrid: email delivery
- Stripe: payments
We email you at least 30 days before adding or replacing a subprocessor, and you may object. Each subprocessor is bound by data protection terms at least as protective as these. See Subprocessors.
Security measures
- Encryption in transit (TLS) and at rest.
- Access limited to staff who need it, with every access logged.
- Results below the group size floor are not loaded at all.
- Backups, monitoring and alerts on the production service.
- SOC 2 in progress. The rest is on Security.
International transfers
Data is stored with Google Cloud in the United States. Where personal data moves from the EU or EEA to the United States, the Standard Contractual Clauses adopted by the European Commission (Module Two, controller to processor) are incorporated into this agreement by reference, with the customer as data exporter and TakeOnePiece LLC as data importer. For the UK, the UK International Data Transfer Addendum applies; for Switzerland, the Clauses apply with the necessary adjustments. Optional clauses are not used; supervisory authority and governing law follow the customer's establishment.
When the agreement ends
If your company cancels, or its trial ends without a plan, its results stay readable for 30 days, and its admins can download all of its data in one file. Then everything it has in Gists AI is deleted: surveys, answers, results, people, teams, settings and connections. We email its admins 7 days before, and again when it's done. Backups clear within two weeks after the deletion. We keep only a record that it happened (the company's id and the date, no names). Invoices stay with Stripe, as tax law requires.
Audits
On request, we provide the information needed to show we meet this agreement, including our security documentation. Ask at support@gists.ai.
Contact
TakeOnePiece LLC, 1 Broadway, Cambridge, MA 02142. support@gists.ai.
TakeOnePiece LLC · 1 Broadway, Cambridge, MA 02142 · support@gists.ai