Privacy Policy

1. Scope and Persons Covered

This Policy applies to personal information relating to:

• Website visitors, prospects, event participants, demonstration attendees, and business contacts;
• Customers, account owners, administrators, authorized users, billing contacts, and support contacts;
• People who interact with Customer-deployed avatar, chat, calling, messaging, email, or workflow agents;
• Job applicants, employees, learners, customers, prospects, patients, vendors, and other people whose information a Customer submits to the Service; and
• People who contact Provider, receive Provider-controlled marketing, or exercise privacy rights.

A Customer's own privacy notice governs the Customer's independent collection and use of Customer Data. This Policy does not replace that notice.

2. Provider and Customer Roles

3. Personal Information We May Process

The categories depend on the selected agent, workflow, Customer configuration, and integrations:

• Identity and business contact information, including name, email address, telephone number, employer, title, department, and account identifiers;
• Account and authentication information, including user names, password hashes, single sign-on identifiers, roles, permissions, API credentials, and audit history;
• Conversation and communication content, including chat messages, prompts, emails, WhatsApp messages, call audio, transcripts, summaries, notes, attachments, and escalation records;
• Recruiting and workforce content, including resumes, employment history, education, skills, screening responses, interview scheduling information, onboarding records, and learning progress;
• Customer service, sales, and scheduling information, including inquiries, tickets, lead data, appointment details, preferences, consent records, and follow-up activity;
• Workflow content, including source documents, images, handwriting, audio, video, meeting recordings, extracted text, structured resume data, knowledge-base files, and generated content;
• Avatar and media information, including selected avatar, language, voice settings, rendering data, reference images, and, for an authorized custom avatar, likeness or voice materials;
• Integration information received from Customer-selected email, messaging, calendar, CRM, help desk, storage, payment, knowledge-base, or API services;
• Device, network, and telemetry information, including IP address, approximate location, browser, operating system, device and session identifiers, logs, error reports, latency, security events, and usage measurements;
• Subscription and transaction information, including plans, activated agents, included minutes or credits, usage, invoices, payment status, tax information, and limited payment-provider information; and
• Website and cookie information described in the Cookie Policy.

4. Sources of Information

Provider may obtain personal information:

• Directly from individuals through the Website, Service, calls, messages, forms, demonstrations, support, or privacy requests;
• From Customers, their users, uploaded files, knowledge bases, contact lists, systems of record, and configured workflows;
• Automatically from websites, applications, APIs, devices, browsers, networks, cookies, logs, and security systems;
• From Customer-selected integrations, including messaging, email, calendar, telephony, CRM, help desk, storage, payment, and identity services; and
• From service providers, referral partners, resellers, event organizers, and lawful public or commercial sources.

5. How We Use Information

Provider may use personal information to:

• Provide, host, configure, operate, and support Digital Employees and Customer-requested actions;
• Generate chat responses, voice interactions, summaries, transcripts, extracted text, structured resume information, images, videos, recommendations, drafts, and workflow results;
• Route inquiries, schedule appointments, manage escalations, synchronize integrations, and deliver account analytics and usage records;
• Create and administer accounts, subscriptions, agents, permissions, invoices, payments, minutes, credits, and renewals;
• Authenticate users, detect fraud or abuse, investigate incidents, troubleshoot errors, and protect the Service;
• Communicate about accounts, demonstrations, support, incidents, billing, legal terms, and administrative matters;
• Improve reliability, usability, safety, and support using access-controlled telemetry and, where feasible, aggregated or de-identified information;
• Send Provider marketing where permitted and honor unsubscribe, objection, and suppression choices;
• Comply with law, legal process, audits, sanctions, and contractual obligations; and
• Establish, exercise, or defend legal rights and support a corporate transaction subject to appropriate safeguards.

6. Legal Bases

Where a legal basis is required, Provider relies as appropriate on performance of a contract, steps requested before a contract, consent, legitimate interests not overridden by individual rights, compliance with legal obligations, protection of vital interests, or another ground recognized by law. Withdrawal of consent does not affect processing that was lawful before withdrawal.

7. Customer Responsibilities

Each Customer is responsible for the lawfulness and configuration of its Digital Employees. Customers must:

• Provide required privacy, AI, recording, telemarketing, employment, biometric, and other notices;
• Obtain and document consent or another lawful basis for calls, texts, emails, recordings, uploads, profiling, and automated processing;
• Maintain suppression, do-not-contact, opt-out, and consent records and honor applicable choices promptly;
• Limit access, review permissions and integrations, secure credentials, and remove former or unauthorized users;
• Use appropriate retention settings and correct, export, or delete Customer Data when required;
• Avoid unsupported sensitive or regulated information and apply additional safeguards where an authorized use requires it; and
• Respond to rights requests concerning Customer Data and give Provider lawful, documented instructions.

8. AI Processing and Model Improvement

Digital Employees use AI models and workflow components to process inputs and generate outputs. Outputs may be inaccurate, incomplete, biased, or unsuitable for a specific purpose and require human review.

Provider does not use personal information from Customer agent interactions to train or fine-tune general-purpose AI models, and does not authorize external foundation-model providers to use Customer prompts or outputs for their general model training, except where a Customer expressly enables a separately disclosed program. Provider may use de-identified or aggregated telemetry to improve reliability, security, and safety.

Provider will not materially expand the use of Customer Data for model training through a retroactive policy change where additional consent or contractual authorization is required.

9. Voice, Video, Likeness, and Recording Data

Voice input may be processed to transcribe speech or operate a calling or avatar feature. Video or rendering data may be processed to display an avatar or create requested media. A Customer that supplies a real person's voice, photograph, video, or likeness must have all necessary rights, releases, consents, and notices.

Unless recording, transcript logging, or content retention is enabled, certain media inputs may be processed transiently. The Customer controls whether interactions are recorded or retained to the extent provided by the Service and remains responsible for applicable consent and recording laws.

10. Disclosure of Information

Provider may disclose personal information to:

• The Customer and its authorized administrators, users, affiliates, auditors, and advisors;
• Hosting, infrastructure, security, communications, telephony, messaging, payment, analytics, support, AI-model, transcription, OCR, and media-processing vendors acting under contract;
• Customer-selected integrations and third-party services when an authorized user enables or directs the connection;
• Professional advisors, insurers, auditors, financing sources, and parties to a proposed or completed corporate transaction under appropriate safeguards;
• Courts, regulators, law-enforcement bodies, or other persons when required by law or reasonably necessary to protect rights, safety, security, or Service integrity; and
• Other recipients with valid Customer direction or individual consent.

Provider does not sell personal information for money. If a practice constitutes sale, sharing, or targeted advertising under applicable law, Provider will provide the required notice and opt-out mechanism before enabling it.

11. Cookies and Similar Technologies

Provider uses cookies and similar technologies for authentication, security, preferences, analytics, performance, and, where enabled and lawfully permitted, marketing. Details and choices are provided in the Cookie Policy and Cookie Settings interface.

12. International Processing and Transfers

The Service may be accessed, supported, or processed in countries other than the individual's country. Where required, Provider uses lawful transfer safeguards, which may include contractual protections, the European Commission's Standard Contractual Clauses, the United Kingdom Addendum, or another recognized mechanism. Hosting and transfer commitments may be specified in an Order Form or DPA.

13. Retention and Deletion

Provider retains information only as reasonably necessary for Customer instructions, the disclosed purpose, the agreement, security, dispute resolution, and law. Retention depends on configuration, content type, sensitivity, risk, backup cycles, legal holds, and mandatory recordkeeping.

• Customer Data is retained according to Customer settings and contract terms, then returned or deleted subject to backups, legal holds, and law;
• Account, billing, tax, contract, security, audit, and support records may be retained after closure for compliance and dispute purposes;
• Recordings, transcripts, generated media, resumes, extracted text, and knowledge-base content follow the applicable workflow or Customer retention setting;
• Consent, suppression, and cookie-preference records may be retained as needed to demonstrate and honor the choice; and
• De-identified or aggregated information that cannot reasonably identify a person may be retained for lawful business purposes.

14. Security

Provider uses reasonable technical and organizational measures designed to protect information, which may include access controls, authentication, encryption where appropriate, logging, monitoring, backups, incident response, vendor controls, secure development practices, and personnel confidentiality obligations. No method of transmission or storage is completely secure.

15. Privacy Rights and Choices

Subject to applicable law, role, exceptions, and identity verification, an individual may have the right to:

• Request access to, confirmation of, or a portable copy of personal information;
• Request correction, completion, deletion, or restriction;
• Withdraw consent or object to direct marketing, profiling, sale, sharing, or targeted advertising;
• Request information about categories, sources, purposes, recipients, and disclosures;
• Request meaningful human review of certain automated decisions and submit information relevant to the review;
• Appeal a privacy-request decision where applicable; and
• Exercise rights without unlawful discrimination or retaliation.

Requests about Customer Data should normally be directed to the Customer that deployed the relevant agent. Provider-controlled requests may be submitted using the contact information below. Provider may verify identity, authority, account, and jurisdiction.

16. U.S. State Privacy Disclosures

Residents of states with comprehensive privacy laws may have rights to know, access, correct, delete, or obtain a portable copy of personal information and to opt out of certain sale, sharing, targeted advertising, or profiling. Provider honors qualifying browser-based opt-out signals, such as Global Privacy Control, where required and technically applicable. Provider does not use sensitive personal information to infer characteristics except as authorized or permitted by law.

17. Children

The Service is offered for business use and is not directed to children under 13. Provider does not knowingly collect personal information from a child in a manner requiring parental consent without that consent. A Customer deploying the Service in education or another youth setting is responsible for lawful authority, notices, parental or school consent, age-appropriate safeguards, and any applicable student-privacy obligations.

18. Changes to This Policy

Provider may update this Policy for legal, security, operational, or product reasons. Provider will post the revised Policy and update the effective date. Material changes will be communicated where required, and consent will be requested where law requires it.