Privacy Policy

• Information you provide: name, business email address and phone number, account credentials and settings, and the content of your communications with us.
• Information collected automatically: Internet Protocol (IP) address, device and browser characteristics, and usage information, collected through cookies and similar technologies (see Section 6).
• Operational telemetry: non-content usage, diagnostic, and performance data, such as feature-usage counts, performance metrics, and error information.

We collect this information from:

• you, when you provide it directly;
• your device or browser, through cookies and similar technologies;
• your Customer organization, in connection with account administration and use of the Services;
• our service providers; and
• publicly available business-contact sources, such as company websites, professional networking sites, and business directories.

Where we do not collect personal information directly from you, the categories generally are business-contact details (such as name, business email address, business phone number, employer, and job title), account-administration information, and communications related to the Services.

Some personal information (such as account registration details and authentication credentials) is necessary to create and maintain an account, provide and secure the Services, authenticate users, respond to requests, and meet our legal obligations. Where we request such information and you do not provide it, we may be unable to create or administer your account or provide the relevant feature, support, or response.

Information from accounts you connect. If you connect a third-party account, such as an email, calendar or file-storage account, we receive only the information covered by the permissions you approve. Each permission is presented separately before anything is requested, you may decline any of them, and your organization's administrator may also need to approve them. Section 2 lists what each permission covers. You can disconnect an account at any time in the Services, and you can revoke our access directly with that provider at any time.

Information captured by our applications. Some Osoru applications can capture material from the device they run on, so you can record a walkthrough, a demonstration or a conversation. Depending on the application and on what you enable, this may include a still image of a screen you choose, video of a screen you choose, audio from your microphone, audio from a call you are on, and your location where a feature you are using requires it. Capture happens only on an application you have installed, on a device you control, and only while you have started it. Nothing is captured in the background. Before capture is possible, we ask you to confirm that you understand you are responsible for informing people before you record them, and we point you to guidance on recording law. Your obligations are set out in our Acceptable Use Policy. While capture is running the application shows you that it is running. You choose whether captures are sent to us or stay on that device.

This section describes exactly what we ask for when you connect a Microsoft or Google account, and the commitments that govern information we obtain from Google APIs. Each permission below is a separate choice you make before anything is requested, and we ask for the narrowest permission that does the job. On Google, file access is limited to files created by Google Meet; we do not request access to the rest of your Drive.

Signing in with Apple. Where the Services offer Sign in with Apple, we receive an account identifier and, if you choose to provide them, your name and an email address. Apple lets you hide your real address, in which case we receive a private relay address instead and we use it exactly as we would any other: to identify your account and to contact you about the Services. We do not receive, and do not ask for, access to your mail, your calendar or your files from Apple. Signing in with Apple gives us identity and nothing more.

Mailbox, calendar and file permissions apply to Microsoft and Google only. Apple does not offer access to those, so it does not appear below.

Limited Use. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. These commitments apply to that information and to anything aggregated, anonymized or derived from it.

• We use Google user data only to provide and improve the user-facing features described above, which are visible in the Services.
• We do not transfer Google user data except where it is necessary to provide those features, where you have consented, where security requires it, where the law requires it, or in connection with a merger or acquisition where you have given explicit prior consent.
• We do not use Google user data for advertising, we do not transfer it to advertising platforms or data brokers, and we do not use it to determine creditworthiness or for lending.
• We do not allow humans to read Google user data, except where you have given agreement for those specific items, where it is necessary for security, where the law requires it, or where the data has been aggregated and anonymized for internal operations.

Where you use an artificial-intelligence feature that acts on information obtained from Google APIs, that information may be sent to a model provider in order to produce the result you asked for. That is a transfer necessary to provide a feature you chose to use, it is not used to train that provider's models, and it remains subject to the Limited Use requirements above.

Deleting your account. You can ask us to delete your account and the personal information we hold about you from within any Osoru application that supports creating an account, or by emailing info@osoru.io. We complete deletion within thirty (30) days. Section 8 describes the limited categories we are required to keep afterwards.

We use personal information to provide, secure, and operate the Services; create and manage accounts and communicate about the Services; provide support; monitor and improve the Services using non-content operational telemetry; detect and prevent fraud, abuse, and security incidents; and comply with legal obligations and establish or defend legal claims. We use publicly available business-contact information to respond to business inquiries, manage Customer and prospective-Customer relationships, and send business communications where permitted by law; you may opt out of marketing communications at any time using the unsubscribe link or by contacting info@osoru.io.

Where we use in-product session-study tools that record detailed interaction patterns, such as mouse movements or navigation paths, we turn them on only after asking you, and we configure them to exclude the content of your records.

If you are in the European Economic Area or the United Kingdom, the laws we rely on to use your information are: performing our contract with you; our legitimate interests in operating, securing, and improving the Services, managing our business relationships, and preventing misuse; your consent where we ask for it (for example, for non-essential cookies or marketing); and compliance with our legal obligations. You can contact us at info@osoru.io for more detail on any of these. Outside the European Economic Area, the United Kingdom, and Switzerland, we rely on similar legal grounds to process personal information, including the need to provide the Services, our legitimate interests in operating and improving our business, your consent where we request it, and compliance with legal obligations. Customer Data that we process only on a Customer's behalf is outside this Policy and is governed by the applicable Customer agreement and, once in place, the Data Processing Addendum; until then, our Terms of Use describe how we handle Customer Data.

We do not currently use personal information covered by this Policy to make solely automated decisions, within the meaning of Article 22 of the GDPR, that produce legal or similarly significant effects. We also do not use it for targeted advertising or covered profiling, as those terms are defined under applicable law.

We do not use the records you keep in the Services, such as your contacts, accounts, and deal data, to train, fine-tune, or improve artificial-intelligence models, and we do not sell those records, in each case as those terms are defined under applicable law. These records are Customer Data, which we process on a Customer's behalf under the applicable Customer agreement (and Data Processing Addendum, once in place; until then, our Terms of Use describe how we handle Customer Data); we would use Customer Data to train or improve artificial-intelligence models only under a separate signed agreement with that Customer.

For other personal information covered by this Policy, we likewise do not currently use it to train, fine-tune, or improve artificial-intelligence models. We may use de-identified and aggregated usage information to operate, evaluate, and improve the Services and their features, and where we de-identify information we maintain and use it only in de-identified form and do not attempt to re-identify it, except as reasonably necessary to test that our de-identification is effective. If we later use personal information to train or improve artificial-intelligence models, we will do so only with your permission. We evaluate any such artificial-intelligence features against our privacy and security obligations and applicable law before deploying them.

If a feature needs to study the content you keep in the Services, such as call recordings or emails to power forecasting or intelligence features, we will ask you first: that use requires your express, feature-specific permission, which you can withdraw at any time. When you leave the Services, we stop studying your data and delete it as described in Section 8. Learning we gained while you were a customer, in de-identified and aggregated form that does not identify you or reveal your data, may remain; your account data, meaning the records you keep in the Services, does not. (Our own administrative records about the relationship, such as registration and billing information, are retained as described in Section 8.)

Agents, automations, and connected services you configure. Osoru lets Customers and their Authorized Users create and configure agents and automations, and connect third-party services such as email, calendar, meeting, CRM, and other AI providers. These act on the Customer's instructions, and we treat every configuration and instruction entered under a Customer's account, by any of its Authorized Users, as an instruction from that Customer. When a Customer configures an agent, automation, or connection to send Customer Data or personal information to a destination outside the Services (for example a third-party service, a model provider, a mailbox, or another system), we make that transfer on the Customer's instructions; how the law characterizes such a transfer depends on applicable law and the parties' roles. Our safeguards under this Policy apply to information we hold or transmit. The destination's own terms and privacy practices, including any retention or training settings the Customer selects there, apply to the information it receives, and our commitments about training and selling describe our own use of information, not a destination's. Where the Services offer permission, approval, or activity-history controls for a workflow, they operate as described in the Services at the time of use.

What an agent can reach. An agent does not get open access to a Customer's information. It runs under the identity of the tenant and of the person it acts for, it reads through defined interfaces rather than a direct database connection, and it is given a set of information assembled for the task in front of it rather than the Customer's records at large. What may be sent to a model provider is tested against that person's permissions and against our data-exposure rules, so categories a Customer restricts are withheld even where the person could otherwise see them. Actions that change records or reach outside the Services run through defined capabilities, with the actual values presented for review where sign-off is required, rather than a model writing directly to the database. Where the Services offer these controls, they operate as described in the Services at the time of use.

Corrections. Corrections and feedback your team gives Osoru are used to improve Osoru's understanding of your business, for you. They are part of your account's data: they are deleted with it as described in Section 8, and we do not use them to train or improve models for other customers unless you agree in writing.

Where AI processing happens. You can use the artificial-intelligence features we provide, and you can connect the Services to a model provider you choose. When you use the features we provide, the content those features act on is sent to a third-party model provider under our own account, solely to produce the result you asked for; it is not used to train that provider's models, and the current list of providers is available on request. When you connect a model provider of your own, that destination is your choice, the data goes there on your instruction, and that provider's own terms govern what it receives.

Information obtained from Google APIs is treated differently. Nothing in this section permits us to keep or use information obtained from Google APIs, or anything aggregated, anonymized or derived from it, beyond what the Limited Use requirements described in Section 2 allow. Where this section and those requirements differ, those requirements govern.

We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act. We disclose personal information only:

• to service providers and processors that support the Services (such as hosting, security, analytics, support, and incident-response providers) and are bound by confidentiality and data-protection obligations; for Customer Data we process on a Customer's behalf, we use a subset of these providers, identified in our sub-processor list, which we provide on request;
• to our professional advisers (such as lawyers, accountants, and auditors) under confidentiality obligations;
• to administrators within your Customer organization, for administration, auditing, and reporting;
• as required for legal compliance, lawful requests, and to protect rights, property, and safety; and
• in connection with a merger, acquisition, financing, reorganization, or sale of assets, as reasonably necessary for that transaction and subject to appropriate confidentiality or data-protection terms; we do not sell personal information as part of any such transaction, and any successor must honor commitments materially consistent with this Policy.
• to third-party services, model providers, and recipients that a Customer or Authorized User directs us to send information to, including through agents, automations, and connections the Customer configures;

Service providers. We use a small number of service providers to run the Services, in the categories of cloud hosting and content delivery, database and file storage, artificial-intelligence model providers, payment processing, and business-information lookup. Each processes personal information only on our instructions and only to provide the Services. We do not sell personal information and we do not share it for advertising. A current list of these providers is available on request, and we will tell a Customer before we add one.

Systems you connect are not our service providers. Where you connect the Services to a system of your own, such as your email, calendar, file storage, CRM or a model provider you have chosen, we reach that system with your credentials, on your instruction, and into your own account. That system is yours rather than ours, and its own terms govern what it receives.

We use essential cookies and similar technologies, and do not use advertising or marketing cookies. We use analytics and other non-essential technologies only where permitted by law or after obtaining any required consent; where consent is required, those technologies are disabled unless and until enabled by the user. You can manage or delete cookies through your browser settings, and blocking essential cookies may prevent parts of the Services from working. We honor recognized opt-out preference signals, such as Global Privacy Control (GPC), where required by law, by treating them as a request to opt out of any sale or sharing of personal information or processing for targeted advertising, even though we do not currently engage in such processing. Because there is no common standard for "Do Not Track" browser signals, we do not respond to them. Where we rely on consent for non-essential technologies, you may withdraw that consent through any cookie or preference controls we make available in the Services or by contacting us.

We maintain an information security program with administrative, technical, organizational, and physical safeguards designed to protect personal information against unauthorized or unlawful access, use, alteration, disclosure, loss, or destruction, appropriate to the nature of the information we process. We operate to a defined minimum security standard across the environments that hold Customer Data. That standard includes: each Customer's records held in a separate tenant database, with tenant identity established before access and carried through every read, write, background job, index, and cache, so that a derived store which cannot enforce tenant and permission boundaries is not permitted to hold Customer Data; encryption in transit and at rest using the supported controls of the platforms we run on; multi-factor authentication for privileged human access; least-privilege service identities rather than shared administrative credentials; separated development, test, and production secrets, with rotation and revocation; database network exposure limited to what operation requires; tenant and permission enforcement tested independently of the interface, so that a control cannot appear to work merely because a screen hides something; dependency, secret, and vulnerability scanning in our delivery pipeline; changes reaching production only through peer-reviewed source control with automated checks that must pass before a change is merged, the tests of tenant and permission enforcement described above being among those checks; auditable privileged changes; production logging that avoids carrying sensitive content it does not need; and procedures for responding to security incidents and for revoking access. Where a Customer agreement requires a specific control set, certification, or audit, that agreement governs. No method of transmission or storage can be guaranteed to be completely secure, and we take reasonable and appropriate measures in light of the risks and the nature of the information.

We do not operate our own data centers. The Services run on managed cloud platforms, and physical and environmental security for the underlying facilities is provided by those platform operators under their own controls.

Access by our people. Access to the production systems that hold Customer Data is limited to the people whose role requires it. That access uses named individual accounts rather than shared administrative credentials, and it requires multi-factor authentication. We remove it under our access-revocation procedure when a role changes or a person leaves.

Where we are responsible for personal information covered by this Policy and become aware of a breach of security leading to its accidental or unlawful destruction, loss, or alteration, or its unauthorized disclosure or access, we will investigate, take steps aimed at mitigating resulting risks where appropriate, and, where required by law, notify affected individuals or other parties. Security obligations for Customer Data are governed by the applicable Customer agreement and Data Processing Addendum, and by our Terms of Use until those documents are in place.

Some safeguards are in the Customer's hands: which people have access, which accounts and third-party services are connected, which agents and automations run, and what they are allowed to do or must ask approval for. Those settings belong to the Customer, and we act on them as configured, including after the person who configured an agent or connection changes roles or leaves, until the Customer updates or revokes them.

If we become aware of a security incident affecting Customer Data that we hold, we investigate and notify the affected Customer without undue delay, with the information available at the time and with further information as the investigation develops. Where a Customer Agreement or Data Processing Addendum sets specific notification requirements, that agreement governs.

For security-related questions or to report a potential vulnerability, you may contact us at info@osoru.io or at the postal address in Section 13.

We keep personal information for as long as we need it to provide the Services, and for as long as the law requires us to keep it. Where a legal, tax, audit, or recordkeeping obligation fixes a period, that period governs. Where a legal hold, an active dispute, or a security investigation applies, we keep what it covers until it is released, and any retention or deletion we would otherwise have carried out resumes when it is. Outside those cases we delete or de-identify the information. Customer Data is governed by the applicable Customer agreement and Data Processing Addendum, and by our Terms of Use until those documents are in place. We generally retain personal information as follows:

If you delete your data, or ask us to delete it, we delete or de-identify it promptly. After that we keep only what a specific legal obligation, an active dispute or security investigation, or tax and accounting requirements make us keep, and only for as long as they require. Deletion reaches derived copies and not only the original record: indexes, caches, and other stores built from deleted content are removed or invalidated with it. Residual copies in routine encrypted backups are deleted or overwritten in the ordinary course of our backup cycles. Where we restore from a backup, re-applying deletions recorded after that backup was taken is part of the restore, so that a restore does not reinstate content that was deleted. The periods below are maximums for information that has not been deleted, not holds we place on deleted data.

Deleting on request. You can ask us to delete your account and the personal information we hold about you, and we will do so within thirty (30) days of your request. You do not have to give a reason and we do not charge for it. After that we keep only what a specific legal obligation, an active dispute or security investigation, or tax and accounting requirements make us keep, and only for as long as they require, together with a record that you asked and that we complied, which we keep so that we can demonstrate we honored the request.

The Services are hosted in the United States, and processing of meeting recordings and transcripts runs in the United States and Canada. Your information may also be processed in other countries where we or our service providers operate, as described in this Policy. If you are in the European Economic Area, the United Kingdom, or Switzerland and we transfer your information to a country without an applicable adequacy decision, we rely on appropriate safeguards, such as the EU Standard Contractual Clauses and the UK equivalent. We also implement technical and organizational measures designed to protect personal information during and after transfer. You may contact us at info@osoru.io for more information about these safeguards or to obtain a copy or description of the relevant transfer mechanism, where legally required.

Depending on where you live, you may have rights to confirm whether we process your personal information; to access, correct, delete, or obtain a portable copy of it; to receive a list of the specific third parties to whom we disclosed personal information, or categories of third parties where applicable, as required by law; to opt out of any sale, sharing, targeted advertising, or covered profiling; to limit the use and disclosure of sensitive personal information; to restrict or object to processing where applicable; to withdraw consent where processing is based on consent; and, under the GDPR, UK GDPR, or other applicable law, to lodge a complaint with a supervisory authority, in each case where we engage in the relevant processing and the applicable conditions are met. To exercise a right, you may email us at info@osoru.io or write to us at the postal address in Section 13. We may ask for information reasonably necessary to verify your identity and process the request, will respond within the time required by law, and will not discriminate against you. Authorized agents must provide proof that you have given them signed permission to submit the request, and we may require you to verify your identity directly with us unless prohibited by law. Where the law provides a right of appeal, you may appeal a denied request by emailing info@osoru.io with the subject line "Privacy Appeal."

European Economic Area, United Kingdom, and Switzerland. Where the GDPR or UK GDPR applies, you have the right to request access to your personal information, to request its rectification or erasure, to request restriction of processing, to object to processing (including where we rely on legitimate interests), and to request data portability, in each case where the relevant conditions are met. You also have the right to withdraw consent at any time where we rely on consent, and to lodge a complaint with a supervisory authority.

California. This section, together with the table under "U.S. state privacy disclosures" below, is our notice at collection for California residents. We do not sell personal information or share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act, and we have not done so in the preceding twelve (12) months. The categories of personal information we collect, the categories of sources, the business or commercial purposes for which we collect and use each category, the categories of third parties to whom we disclose each category, and our retention periods are set out in that table and in Sections 1, 2, 4, and 7. We may collect account log-in credentials, which may be sensitive personal information; we use and disclose such information only to provide, secure, and administer the Services, and not for any purpose that gives a right to limit its use or disclosure under California law, and we do not use or disclose sensitive personal information to infer characteristics about you. Because we do not use sensitive personal information for additional purposes, we do not offer a separate right to limit its use or disclosure. Under California's "Shine the Light" law, we do not disclose personal information to third parties for their direct marketing purposes.

U.S. state privacy disclosures. In the preceding twelve (12) months, we collected and disclosed the following categories of personal information for the business purposes described below. We do not sell personal information, share it for cross-context behavioral advertising, process it for targeted advertising, or use it for profiling that produces legal or similarly significant effects, as those terms are defined under applicable law.

Other jurisdictions. Where Canadian or other regional privacy laws apply, we handle personal information in accordance with those laws, including by providing any additional rights and protections they require. You may contact us at info@osoru.io with any question or complaint.

How to ask, and how long we take. You can make a request in any Osoru application that supports creating an account, or by emailing info@osoru.io. We will provide a copy of the personal information we hold about you within thirty (30) days of your request, in a commonly used, machine-readable format, and we will delete it within thirty (30) days of your request. Where the law allows a longer period or an extension, we will still meet these commitments unless we tell you otherwise and explain why.

The Services are intended for use by organizations and their adult representatives. We do not direct the Services to children and do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will post the updated version and revise the Effective Date above. If we make material changes, we will provide notice through the Services, by email, or by another legally sufficient method before the changes take effect where required by law.

If we ever change our commitment not to sell personal information, or our commitment not to use it to train or improve artificial-intelligence models, that change will apply only to information collected after the change takes effect, and we will give notice through the Services or by email before it does.

Intelligent Systems LLC, PO Box 221, Milwaukee, WI 53201. Email: info@osoru.io.

If you have a question or concern about how we handle personal information, you may contact us at info@osoru.io, and we will review and respond to complaints in accordance with applicable law.

As of the Effective Date, we do not direct the Services to individuals in the European Economic Area or the United Kingdom. Where a person in those regions uses the Services through a Customer, or contacts us directly, we handle that person's information as described in this Policy, including the legal bases in Section 3, the rights in Section 10, and the transfer safeguards in Section 9. If our activities bring us within Article 27 of the GDPR or the UK GDPR, we will designate a representative and update this Policy. If our obligations change, we will comply with applicable requirements and update this Privacy Policy as needed.