This Privacy Policy explains how Solidroad, Inc. (“Solidroad,” “we,” “us,” or “our”) processes personal data in connection with its websites, applications, browser extensions, APIs, and related services (collectively, the “Services”).
Solidroad provides software to business customers, including enterprise customers and customers that sign up online. In most cases, Solidroad processes personal data on behalf of its customers and acts as a data processor, while customers act as data controllers. Solidroad acts as a data controller when it processes personal data for its own business purposes, including, where permitted, to train and improve its AI models (see Section 6).
This Privacy Policy is intended to provide transparency regarding Solidroad’s data practices and does not replace or override any contractual obligations, including any Data Processing Addendum (“DPA”) entered into with a customer.
1. Company Information
Solidroad, Inc.
55 Francisco Street
San Francisco, CA 94133
United States
Solidroad, Inc. wholly owns Solidroad Ltd, an Irish subsidiary supporting European operations. Solidroad Ltd provides customer support and engineering services to Solidroad and may access personal data in doing so.
Contact: security@solidroad.us
2. Scope of This Policy
This Privacy Policy applies to personal data processed in connection with:
- The Solidroad web application
- The Solidroad Chrome browser extension
- Solidroad APIs
- Solidroad’s websites, including solidroad.us
The Services are intended only for business users. The Services are not intended for children.
3. Roles and Responsibilities
Solidroad as a Data Processor
When customers use the Services to upload, record, or otherwise process content (including browser workflows, audio, video, or integration data), Solidroad acts as a data processor and processes such data solely on documented customer instructions, except as described in Section 6.
Customers are responsible for:
- Determining the lawful basis for processing
- Providing required notices to end users
- Obtaining any required consents
Solidroad as a Data Controller
Solidroad acts as a data controller with respect to personal data processed for its own business purposes, including:
- Account administration
- Authentication and access management
- Billing
- Marketing communications
- Advertising and marketing, including through cookies and similar technologies on our websites, as described in Sections 13 and 14
- Training and improving our AI models and Services, as described in Section 6
- Security, compliance, and legal obligations
Where a DPA applies, it governs in the event of any conflict with this Privacy Policy.
4. Personal Data We Process
A. Account and Identity Information
- Name
- Business email address
- Company name
- User identifiers
- Authentication and access credentials (stored securely)
B. Customer Content
Processed on behalf of customers (and, where described in Section 6, used by Solidroad to train and improve its AI models), which may include:
- Audio and video recordings
- Browser workflow recordings
- Text, images, and other content captured during workflows
- Data transmitted through customer-enabled integrations
- Scores, feedback, and other outputs generated by the Services
C. Chrome Extension Data
When a user explicitly initiates a recording session, the Solidroad Chrome extension may process:
- Web page content necessary to capture the initiated workflow
- User interactions required to generate guides or simulations
The extension:
- Activates only after user action
- Captures only data required for the requested workflow
- Uses session-capture technology (including rrweb)
- Applies PII redaction
- Does not collect unrelated browsing history
- Does not operate in the background
D. Usage and Technical Data
- IP address
- Device and browser metadata
- Log files and audit logs
- Security and performance telemetry
- Cookie, pixel, and similar identifiers collected on our websites (see Section 14)
E. Marketing Information
- Contact and business details you provide to us or that we obtain from marketing partners
- Information about your interactions with our emails, websites, and advertisements
5. How We Use Personal Data
Solidroad processes personal data solely for legitimate and limited purposes, including:
1. Service Delivery
- Recording workflows, audio, and video at the user’s request
- Generating AI-powered guides and simulations
- Securely storing and synchronizing customer content
2. Account and Access Management
- User authentication (including SSO and MFA)
- Subscription and workspace administration
3. Customer-Directed Integrations
- Processing data from third-party systems only when enabled by the customer
4. Security and Reliability
- Preventing fraud and abuse
- Maintaining system integrity and availability
- Monitoring and logging
5. Customer Support
- Responding to inquiries
- Troubleshooting and issue resolution
6. Marketing and Communications
- Sending service-related communications
- Sending marketing communications where permitted by law
- Delivering and measuring advertising about our Services, as described in Section 13
- Users may opt out of marketing communications at any time
7. Legal and Compliance
- Meeting contractual obligations
- Complying with applicable laws and regulations
8. Improving Our Services and AI Models
- Training, developing, and improving our AI models and Services, as described in Section 6
6. AI and Machine Learning
Solidroad uses AI models, including models provided by the third-party providers listed on our subprocessor list, to deliver the Services.
Customers that sign up online. Where a customer uses the Services under our online Terms of Service, Solidroad may use de-identified and aggregated data derived from customer content, together with usage data, to train, develop, and improve its AI models and Services. We take reasonable measures so that this data cannot reasonably be linked to a customer or individual, and we do not attempt to re-identify it. Solidroad uses identifiable customer content (such as recordings, transcripts, and other materials uploaded to or generated through the Services) for training only if the customer opts in. When Solidroad uses identifiable personal data for this purpose, it acts as a data controller and relies on its legitimate interests in developing and improving its Services. Customers can opt in, or withdraw an opt-in, by emailing support@solidroad.us. A withdrawal takes effect within 30 days, after which we will not use any of that customer’s content for further training; models trained before a withdrawal takes effect are not retrained. Individuals may also object to this use of their personal data, as described in Section 10.
Enterprise customers. Where a customer has a signed agreement with Solidroad, Solidroad does not use that customer’s personal data to train AI models except as permitted by that agreement or on the customer’s written instructions. Solidroad may use de-identified and aggregated data that does not identify any customer or individual to improve its Services.
Third-party AI providers. Our contracts with third-party AI model providers restrict them from using customer personal data to train their own models.
What our Training product does not do. In the Solidroad Training product, scoring and feedback are based on transcripts and, for system simulations, on the user’s on-screen actions (such as clicks); audio and video recordings are not analyzed for scoring. The Training product does not identify individuals using voiceprints or other biometric data, perform voice matching, or analyze facial features, and it does not infer emotion, sentiment, stress, or personality traits from audio or video. Voice and likeness cloning is not available to customers who sign up online. It is offered only as a beta feature to customers with a signed agreement that addresses its use.
7. Data Sharing and Subprocessors
Solidroad may engage third-party subprocessors to support delivery of the Services, including providers of:
- Cloud hosting
- Infrastructure
- Security
- Analytics
- Customer support
- AI models
- Payments
All subprocessors are subject to contractual obligations requiring appropriate confidentiality, security, and data protection safeguards. Our current subprocessors, including our affiliate Solidroad Ltd, are listed at https://security.solidroad.us/subprocessors.
Solidroad does not sell personal data for money. However, as described in Sections 13 and 14, we share limited identifiers with advertising and marketing partners (such as Google, Meta, LinkedIn, Reddit, OpenAI, HubSpot, and Vector) and allow certain partners to collect information through cookies and pixels on our websites. Under some US state privacy laws, this may be considered a “sale” of personal data or “sharing” of personal data for targeted advertising. We do not share customer content, such as recordings or transcripts, with advertising partners.
8. International Data Transfers
Personal data may be processed in the United States, Ireland, and other jurisdictions where Solidroad or its subprocessors operate. Where required, Solidroad relies on lawful transfer mechanisms, including Standard Contractual Clauses and other recognized safeguards.
9. Data Retention
Solidroad retains customer data for the duration of the applicable customer contract.
Unless otherwise agreed or legally required:
- Customer data is deleted after a 30-day period following contract termination (during which the customer may request an export) or upon verified deletion request
- Customer data in free trial accounts that do not upgrade to a paid plan may be deleted 30 days after the trial ends
- AI models trained in accordance with Section 6 before customer data is deleted are not retrained or deleted
- Backup and log data may be retained for a limited period for security, compliance, and disaster recovery purposes
10. Data Subject Rights
Where Solidroad acts as a data processor, data subject requests should be directed to the relevant customer acting as data controller.
Where Solidroad acts as a data controller, individuals may request:
- Access to personal data
- Correction of inaccuracies
- Deletion
- Restriction or objection to processing
- Objection to the use of their personal data to train our AI models
- Data portability, where applicable
Requests may be submitted to security@solidroad.us.
Depending on where you live, you may have additional rights under local law. You can exercise them by contacting us at security@solidroad.us.
11. Security Measures
Solidroad maintains technical and organizational measures designed to protect personal data, including:
- Encryption in transit and at rest (TLS 1.2 or above in transit and AES-256 at rest)
- Access controls and least-privilege policies
- Audit logging and monitoring
- Incident response procedures
Solidroad maintains ISO/IEC 27001 certification and a SOC 2 Type II attestation.
12. Children's Data
The Services are intended exclusively for adult business users. Solidroad does not knowingly process personal data of children.
13. Advertising and Marketing
We may use your name, email address, and other contact information to send you marketing communications about our products and services and to promote Solidroad’s offerings.
We may also share limited identifiers such as your name and email address with third-party advertising partners (such as Google, Meta, LinkedIn, Reddit, and OpenAI) to help us deliver relevant advertisements about our services and measure the effectiveness of our marketing campaigns. We and our partners also use cookies, pixels, and similar technologies on our websites, including the Vector pixel, which, with its data partners, helps us identify the businesses, and in some cases the individuals, that visit our websites so that we can follow up with relevant marketing (see Section 14). Where required by law (for example, in the EEA and the UK), we use cookies and similar technologies that are not strictly necessary, including analytics and advertising cookies and pixels, only with your consent.
To opt out of the sharing of your personal data with advertising partners, adjust your cookie settings or email security@solidroad.us.
You can opt out of receiving marketing communications from us at any time by using the unsubscribe link included in our emails or by contacting us at support@solidroad.us.
Even if you opt out of marketing communications, we may still send you service-related communications, such as account notifications, security alerts, and important updates about the Services.
14. Cookies and Similar Technologies
We use cookies and similar technologies, such as pixels and local storage, on our websites for the following purposes:
- Essential: required for our websites and the Services to operate, such as keeping you signed in
- Security: helping detect and prevent security risks and protect accounts
- Performance and analytics: helping us understand how our websites are used so we can improve them
- Advertising and marketing: helping us and our partners identify visitors, deliver advertising about our Services, and measure its effectiveness
The main cookies and similar technologies used on solidroad.us are:
Essential
- sr_consent (local storage), Solidroad: remembers your cookie choices so we don't ask again. Lasts until you change your choice or clear your browser storage.
- HubSpot form and meeting booking, HubSpot: lets you request a demo and book a meeting with our team. Set by HubSpot when you use the form or calendar.
Security
- __cf_bm, _cfuvid, Cloudflare, on behalf of HubSpot, LinkedIn and OpenAI: tells people apart from bots and protects against abuse. 30 minutes (__cf_bm); session (_cfuvid).
Performance and analytics
- ph_[project identifier]_posthog (cookie and local storage), PostHog, served through e.solidroad.us: measures how visitors use our website so we can improve it. Without your consent, PostHog counts visits without storing anything on your device. 1 year.
- _ga, _ga_3591Q5S61F, Google Analytics: measures website traffic and how visitors move between pages. Up to 13 months.
- hubspotutk, __hstc, __hssc, __hssrc, HubSpot: records which pages you viewed so our team has context if you contact us. 6 months (hubspotutk, __hstc); 30 minutes (__hssc); session (__hssrc).
Advertising and marketing
- _gcl_au, _gcl_ls (local storage), IDE, Google Ads: measures whether our Google ads lead to visits and demo requests, and shows our ads to people who have visited our website. 90 days (_gcl_au); up to 13 months (IDE).
- _fbp, Meta: measures and targets our ads on Facebook and Instagram. 90 days.
- _li_ss, _lc2_fpi, _li_dcdm_c, bcookie, bscookie, li_sugr, lidc, AnalyticsSyncHistory, UserMatchHistory, LinkedIn: measures and targets our ads on LinkedIn. From 1 day to 13 months.
- _rdt_uuid, _rdt_pn, Reddit: measures and targets our ads on Reddit. 90 days.
- __obref, OpenAI: measures whether our ads in ChatGPT lead to demo requests. 1 year.
- Vector pixel (local storage), tuid (usbrowserspeed.com) and LiveIntent, Vector and its data partners: identifies the companies that visit our website so we can reach them with relevant advertising. Up to 1 year.
Third-party cookies are governed by the relevant provider’s own privacy policy. You can manage cookies through the cookie settings on our website and through your browser settings; blocking some cookies may affect how our websites work. Google provides a browser add-on to opt out of Google Analytics.
15. Notice to Individuals in the EEA, UK and Switzerland
This section applies if you are in the European Economic Area, the United Kingdom, or Switzerland, and supplements the rest of this Privacy Policy.
Controller. For the personal data we process as a controller, as described in Section 3, the controller is Solidroad, Inc. Our Irish subsidiary, Solidroad Ltd, supports our European operations. You can contact us at security@solidroad.us.
Legal bases. We rely on the following legal bases:
- Providing the Services, managing accounts, authentication, billing, and customer support: performance of our contract with you or your organization, and our legitimate interests in providing the Services to our business customers
- Security, fraud prevention, and service reliability: our legitimate interests in keeping the Services and our users secure
- Marketing communications: our legitimate interests in promoting our Services to business contacts or, where the law requires it, your consent
- Advertising, and cookies and similar technologies that are not strictly necessary: your consent
- Training and improving our AI models and Services, as described in Section 6: our legitimate interests in developing and improving our Services
- Complying with legal obligations and establishing or defending legal claims: our legal obligations and our legitimate interests
Retention. We keep personal data that we control only for as long as we need it for the purposes described in this Privacy Policy. Account and billing information is kept for the life of the account and afterward as required for tax, accounting, and legal purposes. Marketing information is kept until you opt out or it is no longer needed. Cookie retention periods are described in Section 14, and customer data is retained as described in Section 9.
Your rights. You may request access to, correction of, or deletion of your personal data, restriction of its processing, or a copy of it in a portable format, and you may object to our processing, including for direct marketing and for training our AI models. Where we rely on your consent, you may withdraw it at any time; this will not affect processing that took place before you withdrew. To exercise these rights, contact us at security@solidroad.us. You also have the right to lodge a complaint with the data protection authority where you live or work or where you believe an infringement occurred, including the UK Information Commissioner’s Office and the Swiss Federal Data Protection and Information Commissioner.
International transfers. When we transfer your personal data outside the EEA, the UK, or Switzerland, including to the United States, we rely on the European Commission’s Standard Contractual Clauses and the equivalent UK and Swiss mechanisms. You can request a copy of the relevant safeguards by contacting us.
Automated decisions. Solidroad does not make decisions about you that produce legal or similarly significant effects based solely on automated processing.
Providing your data. You are not required to provide personal data to us, but we need account information to provide the Services to you.
16. Changes to This Privacy Policy
Solidroad may update this Privacy Policy from time to time. Material changes will be communicated through the Services or other appropriate channels. If we make a material change to how we use personal data we have already collected, we will obtain consent where required by law.
Contact Information
If you have questions about this Privacy Policy or Solidroad's data practices, please contact us at security@solidroad.us or write to us at Solidroad, Inc., 55 Francisco Street, San Francisco, CA 94133.