Privacy Policy

Introduction

AfterAction AI (the "Organization," "we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services. We built this platform for veterans, by veterans — and we take your privacy seriously.

1. Information We Collect

We collect only what we need to provide our services:

• Information You Provide: Name, email address, military service history, and other information you voluntarily share through the AI chat, forms, or account registration.
• Account Information: If you create an account, we store your email address, display name, and account preferences to provide personalized features such as saved plans and generated documents.
• Conversation History: When you interact with our AI assistant, we store the conversation history associated with your account. This allows you to access your plan and outputs across sessions. Conversation history may contain information you choose to share, such as service history, medical information, or financial circumstances. See Section 3 for retention details.
• Uploaded Documents: Documents you upload (DD-214, VA letters, medical records, etc.) are transmitted securely to our AI provider for processing. AfterActionAI.org does not permanently store the content of your uploaded documents on our servers. Document content is used only to provide benefits guidance and is not retained beyond the active session. See Section 8 for details on AI provider data handling.
• Usage Information: We may collect basic technical information such as browser type and pages visited to improve site functionality. We do not use third-party analytics tracking services.
• Crisis Information: If you use our crisis support features, we route you directly to the Veterans Crisis Line. We do not store or forward your identity in connection with crisis referrals.

2. How We Use Your Information

We use the information we collect to:

• Generate personalized benefits recommendations, action plans, and document templates using AI
• Provide account-based features including saved plans, generated documents, and VA checklists
• Remember your session history so you can return to your plan
• Respond to your inquiries and provide support
• Comply with legal obligations

We do not use your information for advertising, profiling, or sale to third parties.

3. Data Retention

We retain data only as long as necessary to provide our services. The following table describes what we store and for how long:

Data Type	Where Stored	Retention Period	Deletable?
Account credentials	Supabase (encrypted)	Until account deleted	Yes — delete account
User profile	Supabase	Until account deleted	Yes — contact us
Conversation history	Supabase	90 days (auto-deleted)	Yes — contact us
AI reports & plans	Supabase	90 days (auto-deleted)	Yes — contact us
Generated documents	Supabase	180 days (auto-deleted)	Yes — contact us
VA checklists	Supabase	365 days (auto-deleted)	Yes — contact us
Newsletter signups	Supabase	Until unsubscribed	Yes — unsubscribe link
Uploaded documents	Not stored	Not applicable	N/A — browser only
Voice session tokens	Not stored	Ephemeral (~10 minutes)	N/A — auto-expire

4. Data Sharing

We do not sell, trade, or rent your personal information. We only share data in the following circumstances:

• AI Processing: Your conversation input and any uploaded document content is transmitted to our AI providers for processing. See Section 8 for details.
• Crisis Situations: If crisis detection triggers, we direct you to the Veterans Crisis Line. We do not transmit your identity as part of this referral.
• Legal Requirements: If required by law, subpoena, or valid court order.
• With Your Consent: If you explicitly authorize sharing with partner organizations.

5. Data Security

We use industry-standard security measures to protect your data, including encrypted connections (HTTPS), row-level security on our database (each user's data is isolated), and server-side API key management. However, no system is 100% secure. If you believe your information has been compromised, contact us immediately at hello@afteractionai.org.

6. Cookies and Tracking

We do not use cookies for tracking, targeting, or marketing purposes. We do not use Google Analytics or any third-party analytics platform. We do not use advertising networks, tracking pixels, or data brokers. Your activity on this site is not tracked for commercial purposes.

7. Your Rights

You have the right to:

• Know what personal data we hold about you
• Access your personal data upon request
• Correct inaccurate information (profile updates available in your account)
• Delete your data — we will honor deletion requests within 30 days
• Opt out of newsletter communications at any time

To exercise any of these rights, contact us at hello@afteractionai.org. We do not charge for reasonable data requests and will respond within 30 days.

California residents have additional rights under the California Privacy Rights Act (CPRA), including the right to know the categories of sensitive personal information collected and the right to limit its use. To exercise CPRA rights, contact us at hello@afteractionai.org.

8. AI Providers and Third-Party Processing

This platform uses two AI providers to deliver its services. Both providers receive your conversation input and any document content you share during a session.

• Anthropic Claude — Used for all text-based conversations, benefits analysis, and document generation. When you type a message or upload a document, that content is sent to Anthropic's API for processing. Anthropic's API usage policy states that API inputs and outputs are not used to train their models by default. For details, see Anthropic's Privacy Policy.
• OpenAI GPT-4o Realtime — Used for voice-based conversations. If you use the voice feature, your spoken input is processed by OpenAI's Realtime API. OpenAI's API usage policy states that API data is not used to train models by default. For details, see OpenAI's Privacy Policy.
• Supabase — Cloud database and authentication provider. Your account data, conversation history, and generated outputs are stored in Supabase's PostgreSQL infrastructure. See Supabase's Privacy Policy.
• Netlify — Website hosting and serverless functions. Our site is served from Netlify's infrastructure. See Netlify's Privacy Policy.

We do not use advertising networks, retargeting services, or data broker integrations. We make no guarantees about third-party provider policies on your behalf — please review each provider's policy directly for the most current terms.

9. Sensitive Veteran Information

Veterans may share sensitive information through our platform including health conditions, disability ratings, mental health disclosures, financial circumstances, and discharge information. We treat this information with the highest level of care. This data is stored only in connection with your account, is subject to automatic deletion per the retention schedule in Section 3, and is never sold or shared with third parties except as required to provide our AI services (Section 8).

AfterAction AI is not a covered entity under HIPAA and is not a licensed healthcare provider. Do not use this platform as a substitute for medical care or legal advice.

10. Children's Privacy

Our services are designed for adult veterans and their families. We do not knowingly collect information from children under 13. If you believe we have collected such information, please contact us immediately at hello@afteractionai.org.

11. Updates to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email and will post the updated policy on our website with an updated date below. Continued use of the platform constitutes acceptance of the updated policy.

12. Contact Us

Questions about this Privacy Policy or your privacy rights:

• Email: hello@afteractionai.org
• Website: AfterActionAI.org
• Location: Fort Lauderdale, FL