1. Who We Are

Impetus AI is a product of Impetus Studio ("we," "us," or "our"). Impetus AI provides an AI-powered quiz funnel builder and lead-capture platform available at impetusai.live. This Privacy Policy explains how we collect, use, store, share, and protect information when you use our website and services (collectively, the "Service").

Our mailing address is: [Company address]

2. Information We Collect

We collect information in the following categories:

a) Account and Profile Data. When you create an account or use the Service, we may collect your email address and display name. In the current free tier, authentication is session-based and no password is stored on our servers.

b) Lead Data (Customer Content). When end users ("Respondents") complete a quiz funnel you have built, we collect the data those Respondents submit. This may include: email address (always required), and optionally name, phone number, and company name. Quiz answers and result summaries may also be stored if you have enabled the "Store Full Answers" toggle.

c) Quiz and Funnel Configuration. We store the quizzes, questions, outcomes, lead-capture settings, destination configurations, and related metadata you create within the Service.

d) Usage and Analytics Data. We may collect anonymized usage data such as pages visited, features used, session duration, referral source, and browser/device type. This data helps us improve the Service.

e) Device and Log Data. Our servers automatically record information sent by your browser, including IP address, request timestamps, HTTP headers, and referring URLs. IP addresses are used for rate limiting and security (e.g., blocking abuse) and are not linked to individual user profiles.

3. How We Use Information

We use the information we collect to:

• Provide and operate the Service: generating quizzes, capturing leads, routing data to your configured destinations, and displaying results.
• Enforce security: rate limiting, SSRF protection, sensitive-data detection, and log redaction.
• Provide support: responding to your inquiries and troubleshooting issues.
• Improve the product: analyzing aggregated, anonymized usage patterns to enhance features and fix bugs.
• Send transactional communications: email notifications triggered only when you explicitly enable them per-funnel and configure a recipient address and mail-service endpoint.

We do not sell your personal data or lead data to third parties. We do not use lead data to train machine-learning models.

4. Legal Bases for Processing (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, our legal bases for processing your personal data are:

• Contract performance: processing necessary to provide the Service you have requested (Art. 6(1)(b) GDPR).
• Legitimate interests: processing for security, fraud prevention, product improvement, and analytics, where such interests are not overridden by your rights (Art. 6(1)(f) GDPR).
• Consent: where you have given explicit consent, such as enabling email notifications or optional data-storage toggles (Art. 6(1)(a) GDPR). You may withdraw consent at any time.
• Legal obligation: where processing is required to comply with applicable law (Art. 6(1)(c) GDPR).

5. How Lead Data Works

When you build a quiz funnel on Impetus AI and collect leads from Respondents:

• You are the Data Controller (or "Business" under CCPA) for any personal data collected from Respondents through your funnels.
• We are the Data Processor (or "Service Provider" under CCPA). We process Respondent data strictly on your behalf and according to your configuration.

Impetus Inbox. All captured leads are stored in your "Impetus Inbox," which is in-app storage only. The Impetus Inbox does not email leads to any administrator, owner, or global address by default. Leads are only forwarded via email if you explicitly enable email notifications for a specific funnel, provide a recipient address, and configure a mail-service endpoint.

Data minimization. You control which fields are persisted via storage toggles in your funnel settings. Email address, funnel ID, timestamp, and result summary are always stored. Name, phone, company, and full answers require explicit opt-in per funnel.

6. Sharing and Disclosures

We share personal data only in the following circumstances:

a) User-Configured Destinations. When you set up destinations (webhooks, CRM Form Post endpoints, Email Forward, HubSpot, Pipedrive), lead data is transmitted to those third-party services at your direction. You are responsible for ensuring those services provide adequate data protection.

b) Subprocessors. We use third-party infrastructure providers to host and operate the Service (see Section 7 below).

c) Legal Requirements. We may disclose information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Impetus Studio, our users, or others.

d) Business Transfers. In the event of a merger, acquisition, or asset sale, personal data may be transferred. We will provide notice before your data becomes subject to a different privacy policy.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising.

7. Subprocessors

We use the following categories of subprocessors to deliver the Service:

We will update this table as vendors change. User-configured destinations (HubSpot, Pipedrive, webhook endpoints, etc.) are not our subprocessors; they are services you select and control.

8. Data Retention

Lead data retention is controlled by you:

• You may set a retention period of 7, 30, 60, 90, 180, or 365 days, or choose "Never auto-delete."
• Leads older than your retention period are automatically purged when the app loads (opportunistic cleanup).
• You may delete all leads at any time from the Data Controls section in Settings.
• You may delete individual leads from the Impetus Inbox.

Account and quiz configuration data is retained for as long as your account is active. If you request account deletion, we will remove all associated data within 30 days.

9. Data Security

We implement security measures appropriate to the nature of the data we process:

• Encryption at rest: CRM API tokens are encrypted using AES-256-CBC when an encryption key environment variable is configured.
• Encryption in transit: All data is transmitted over HTTPS/TLS.
• SSRF protections: All outbound URLs (webhooks, form-post endpoints, mail endpoints) are validated to block private IP ranges, localhost, cloud metadata endpoints, and non-HTTPS schemes.
• Sensitive data detection: The server blocks submissions containing patterns matching credit card numbers (Luhn validation), Social Security numbers, or password-named fields.
• Rate limiting: Submissions are rate-limited per IP address (30/minute) and per funnel (60/minute) to prevent abuse.
• Log redaction: Tokens, secrets, and API keys are automatically redacted from server logs.
• Access controls: Serverless functions run in isolated environments. No shared database or persistent server state exists between requests.

No system is 100% secure. These measures are provided on a best-effort basis. For self-hosted or forked deployments, security depends on your own configuration of environment variables and secrets.

10. Your Rights

Depending on your location, you may have the following rights:

For all users:

• Access: View and export your lead data from the Impetus Inbox at any time.
• Deletion: Delete individual leads or all leads from the Data Controls section. Request account deletion by contacting us.
• Correction: Update your quiz configurations and lead-capture settings at any time.
• Opt-out of marketing: We do not send marketing emails. If we begin doing so in the future, you will be able to unsubscribe.

For EEA/UK residents (GDPR): You additionally have the right to data portability, the right to restrict processing, the right to object to processing based on legitimate interests, and the right to lodge a complaint with your local supervisory authority.

For California residents (CCPA/CPRA): You have the right to know what personal information we collect and how it is used, the right to delete your personal information, the right to opt out of the sale of personal information (we do not sell personal information), and the right to non-discrimination for exercising your rights.

To exercise any of these rights, contact us at privacy@impetustudio.com.

11. International Transfers

The Service is hosted in the United States. If you access the Service from outside the United States, your data may be transferred to and processed in the United States.

For transfers of personal data from the EEA, UK, or Switzerland, we rely on: (a) Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable; and (b) any applicable adequacy decisions. If you require a Data Processing Agreement (DPA) or executed SCCs, please contact us.

12. Cookies and Analytics

Essential cookies: The Service may use essential cookies for session management and security. These are necessary for the Service to function and cannot be disabled.

Analytics: We may use anonymized, aggregated analytics to understand usage patterns. If we implement third-party analytics tools (e.g., Google Analytics, Plausible), we will update this section accordingly. You may opt out of non-essential analytics by disabling cookies in your browser settings or using a browser extension that blocks trackers.

We do not use advertising cookies or retargeting pixels. The Service does not participate in real-time bidding or programmatic advertising.

13. Children's Privacy

The Service is not directed to individuals under the age of 16 (or 13 where applicable under local law). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

14. Contact Information and Updates

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

• Email: privacy@impetustudio.com
• Website: impetustudio.com
• Mailing address: [Company address]

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the revised policy on this page and updating the "Last Updated" date above. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

1. Acceptance of Terms

By accessing or using the Impetus AI platform at impetusai.live (the "Service"), operated by Impetus Studio ("we," "us," or "our"), you ("Customer," "you," or "your") agree to be bound by these Terms & Conditions (the "Terms"). If you do not agree to all of these Terms, do not access or use the Service.

These Terms constitute a legally binding agreement between you and Impetus Studio. If you are using the Service on behalf of an organization, you represent that you have authority to bind that organization to these Terms.

2. Service Description

Impetus AI is a SaaS platform that enables you to:

• Create AI-generated or manually built quiz funnels for lead generation and audience qualification.
• Capture lead information (email, name, phone, company) through hosted quiz forms.
• Store leads in an in-app inbox ("Impetus Inbox") with configurable data-minimization and retention controls.
• Route lead data to external destinations you configure, including webhooks, CRM form-post endpoints, email forwarding, HubSpot, and Pipedrive.
• Receive optional email notifications for new leads when explicitly enabled per-funnel.

3. Eligibility and Account Responsibility

You must be at least 16 years of age (or the minimum age required in your jurisdiction) to use the Service. By using the Service, you represent that you meet this requirement.

You are responsible for maintaining the confidentiality of any credentials associated with your account and for all activity that occurs under your account. You agree to notify us promptly of any unauthorized access.

4. Customer Content and Responsibilities

"Customer Content" includes all quizzes, questions, outcomes, lead data, configuration settings, API tokens, and any other materials you create, upload, or transmit through the Service.

You represent and warrant that:

• You have all rights necessary to use, submit, and transmit Customer Content.
• You will not use the Service to collect sensitive personal data, including but not limited to: passwords, payment card numbers, Social Security or government identification numbers, health or medical information, or biometric data.
• You will comply with all applicable laws and regulations, including data protection laws (GDPR, CCPA/CPRA, CAN-SPAM, etc.) in connection with your collection and use of lead data.
• You will provide Respondents (people completing your funnels) with appropriate privacy notices and obtain any required consent before collecting their data.
• You are the Data Controller (or "Business" under CCPA) for lead data collected through your funnels. We act as your Data Processor (or "Service Provider").

5. Prohibited Uses

You agree not to use the Service to:

• Engage in any unlawful, fraudulent, or harmful activity.
• Collect or attempt to collect sensitive personal data (passwords, credit card numbers, government IDs, medical information) through quiz funnels. Our server-side guardrails will block obvious patterns, but you remain responsible for compliance.
• Send unsolicited commercial communications (spam) using lead data collected through the Service.
• Scrape, crawl, or use automated means to access the Service except through our published APIs.
• Attempt to gain unauthorized access to accounts, systems, or networks.
• Attempt to harvest credentials, API tokens, or secrets belonging to other users.
• Circumvent or attempt to circumvent security controls, including rate limits, SSRF protections, or sensitive-data detection.
• Transmit malware, viruses, or any destructive code.
• Use the Service in a manner that could damage, disable, or impair it.

6. Fees and Billing

The Service currently offers the following plans:

• The Hobbyist (Free): Unlimited quizzes and leads, AI quiz generation, and permanent platform access at no cost.
• Professional Scale: $9/month flat rate with no per-lead or per-resolution fees. Includes branding removal, advanced logic and branching, CRM/webhook sync, and priority support.
• Whitelabel: Custom pricing for agencies requiring custom domains, API access, and custom integrations. Whitelabel subscribers become Impetus Studio Partners and receive $3,000 in digital business tools free upon signup.

We reserve the right to change pricing with at least 30 days' prior notice. Continued use of the Service after a pricing change takes effect constitutes acceptance of the new pricing. If you do not agree, you may cancel your subscription before the change takes effect.

7. Free Tier and Limits

The free tier ("The Hobbyist") is provided at our discretion and may be modified or discontinued with notice. Free-tier accounts are subject to the same acceptable-use policies and may have feature limitations as described on our pricing page.

8. Third-Party Services

The Service allows you to connect external services including webhooks, CRM form-post endpoints, email-forwarding services, HubSpot, and Pipedrive. When you configure these integrations:

• You are solely responsible for the configuration, accuracy, and security of those connections.
• API tokens you provide are transmitted over HTTPS and used server-side only. Tokens are never exposed in the browser, never logged, and are encrypted at rest when the deployment is configured with an encryption key.
• We are not responsible for the availability, security, or data-handling practices of third-party services.
• We recommend using scoped API tokens with the minimum permissions required for your use case.
• For self-hosted or forked deployments, you are responsible for configuring environment variable secrets for token encryption.

9. Disclaimer of Warranties

THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY. TO THE FULLEST EXTENT PERMITTED BY LAW, WE DISCLAIM ALL WARRANTIES, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND ANY WARRANTIES ARISING FROM COURSE OF DEALING OR USAGE OF TRADE.

We do not warrant that the Service will be uninterrupted, error-free, or secure, or that defects will be corrected. We do not guarantee delivery of lead data to third-party destinations. Delivery depends on the availability and configuration of external services.

10. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL IMPETUS STUDIO, ITS OFFICERS, DIRECTORS, EMPLOYEES, OR AGENTS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR ANY LOSS OF PROFITS, REVENUE, DATA, OR USE, WHETHER ARISING FROM CONTRACT, TORT (INCLUDING NEGLIGENCE), OR ANY OTHER LEGAL THEORY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

OUR TOTAL AGGREGATE LIABILITY FOR ALL CLAIMS ARISING FROM OR RELATED TO THE SERVICE SHALL NOT EXCEED THE GREATER OF (A) THE AMOUNTS YOU PAID TO US IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM, OR (B) ONE HUNDRED U.S. DOLLARS ($100).

Some jurisdictions do not allow the exclusion or limitation of certain damages. In such jurisdictions, our liability is limited to the greatest extent permitted by law.

11. Indemnification

You agree to indemnify, defend, and hold harmless Impetus Studio and its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, and expenses (including reasonable attorneys' fees) arising out of or in any way connected with: (a) your use of the Service; (b) your Customer Content; (c) your violation of these Terms; (d) your violation of any applicable law or regulation; or (e) your violation of any third party's rights, including privacy or data-protection rights of Respondents.

12. Termination

You may stop using the Service at any time. You may delete your leads and quiz data through the in-app Data Controls.

We may suspend or terminate your access to the Service at any time, with or without notice, for conduct that we determine, in our sole discretion, violates these Terms, is harmful to other users, or is otherwise objectionable.

Upon termination: (a) your right to use the Service ceases immediately; (b) we may delete your Customer Content after a reasonable wind-down period (not less than 30 days from notice of termination); (c) Sections 9, 10, 11, 14, and 16 survive termination.

13. Confidentiality

"Confidential Information" means any non-public information disclosed by either party, including API tokens, business data, and technical information. Each party agrees to: (a) use Confidential Information only for the purposes of these Terms; (b) protect Confidential Information using at least the same degree of care it uses for its own confidential information; and (c) not disclose Confidential Information to third parties except as required by law or with prior written consent.

Confidential Information does not include information that is: publicly available, independently developed, or rightfully received from a third party without restriction.

14. Intellectual Property

Our IP: The Service, including its design, code, features, documentation, and branding, is owned by Impetus Studio and is protected by applicable intellectual property laws. Nothing in these Terms transfers ownership of our IP to you.

Your Content: You retain ownership of all Customer Content you create or submit. By using the Service, you grant us a limited, non-exclusive, worldwide license to host, process, transmit, and display your Customer Content solely for the purpose of providing the Service to you.

Feedback: If you provide suggestions, ideas, or feedback about the Service, we may use it without obligation or compensation to you.

15. DMCA / Copyright Policy

We respect the intellectual property rights of others. If you believe that content on the Service infringes your copyright, please send a notice complying with the Digital Millennium Copyright Act (DMCA) to our designated agent at legal@impetustudio.com. Your notice must include: (a) identification of the copyrighted work; (b) identification of the infringing material; (c) your contact information; (d) a statement of good-faith belief; and (e) a statement under penalty of perjury that your notice is accurate.

16. Governing Law and Dispute Resolution

These Terms are governed by the laws of [Governing law / jurisdiction], without regard to conflict-of-law principles.

Any dispute arising from or relating to these Terms or the Service shall be resolved through good-faith negotiation. If negotiation fails, disputes shall be resolved through binding arbitration administered under the rules of the American Arbitration Association (AAA), unless you are located in a jurisdiction where arbitration agreements are not enforceable, in which case disputes shall be resolved in the courts of [Governing law / jurisdiction].

Nothing in this section prevents either party from seeking injunctive or other equitable relief in any court of competent jurisdiction.

17. Changes to Terms

We may update these Terms from time to time. If we make material changes, we will notify you by posting the revised Terms on this page and updating the "Last Updated" date above. For material changes to pricing or liability, we will provide at least 30 days' notice.

Your continued use of the Service after updated Terms take effect constitutes acceptance of the changes. If you do not agree, you must stop using the Service before the changes take effect.

18. Contact Information

For questions about these Terms, contact us at:

• Email: legal@impetustudio.com
• Website: impetustudio.com
• Mailing address: [Company address]