Privacy Policy

What this covers

What we collect

Information you give us

When you create an account we receive your email address, name, profile image, and organization from our authentication provider. If you invite colleagues, we receive their email addresses from you. If you contact us through the form on our site, we receive your name, email, company, and message. If you subscribe to a paid plan, our payment processor handles your card details and we receive billing contact and transaction records. We never see or store full card numbers.

Information we collect automatically

When you use the website or the product we collect information about the device and browser you use, the pages you visit, the actions you take, referring URLs, and performance and error data. This may include a replay of on-screen interactions, with all form inputs masked, so what you type is not captured. We record IP addresses with security-relevant events such as sign-ins and administrative actions.

Categories of personal information

Using the statutory categories set out in California and several other US state privacy laws, we collect:

• Identifiers, such as name, email address, account identifiers, and IP address.
• Customer records, such as billing contact and transaction history.
• Commercial information, such as your plan and your usage of the service.
• Internet or network activity, such as pages viewed, features used, and error and performance data.
• Professional information, such as job role and company, where you tell us.
• Inferences we draw from the above about how the product is used.

We collect each of these from you, from your administrator, or from your use of the service, and we use them for the purposes described below. We do not collect biometric information, precise geolocation, or education information about our own users, and we do not ask you for information revealing racial or ethnic origin, religious belief, health, or sexual orientation.

How we use it

We use personal information to:

• provide, secure, and support the platform, and to authenticate you;
• bill you and administer your subscription;
• respond to your inquiries and provide support;
• understand how the product is used so we can improve it;
• send you service messages about your account, security, and material changes to these policies, which you cannot opt out of while you hold an account; and
• send you marketing about our products, which you can opt out of at any time using the unsubscribe link in any such message.

Where UK or EU law applies, we rely on the following legal bases: performance of our contract with you, for providing and billing the service; our legitimate interests in running, securing and improving our business, balanced against your rights; consent, for optional cookies and where else we ask for it; and compliance with legal obligations, for tax, accounting and responding to lawful requests.

Who we share it with

We share personal information with:

• Service providers who process it on our behalf and under contract, for things such as hosting, authentication, payments, email, error monitoring, analytics, and AI model providers. Our subprocessor list names them.
• Professional advisers such as lawyers and auditors, under confidentiality.
• Authorities, where we are legally required to, or where disclosure is necessary to protect the rights, property, or safety of our users or the public. We will tell you about a request for your data where we are lawfully able to.
• A successor, if we are involved in a merger, acquisition, financing, or sale of assets. We will tell you before your information becomes subject to a different privacy policy.

AI and model providers

The platform runs on AI models operated by third parties. Content processed through the platform, including prompts and generated results, is sent to those providers so they can return a result. They are named in our subprocessor list.

We do not use customer data to train models, and we hold contractual commitments from our model providers that they will not either.

Data we process for customers

Our customers bring their own material into the platform, such as research documents, interview transcripts, product analytics, and content from tools they connect. That material frequently contains personal information about people who are not our users.

We process it as a processor, on our customer's documented instructions, under the Data Processing Addendum. We do not use it for our own purposes, we do not combine it across customers, and we do not use it to train models.

Where a customer builds a simulated agent grounded in a specific, identifiable person's material, that agent remains personal information about that person. Our Acceptable Use Policy requires the customer to have the lawful authority and permissions needed for that processing and to honor withdrawal or deletion requests.

Cookies and privacy signals

We use cookies and similar technologies that are strictly necessary to run the site and keep you signed in, and optional ones for product analytics. Nothing optional runs until you choose. You can change your choice at any time from the Cookie preferences link in the footer of every page, and rejecting analytics does not degrade the service. Our Cookie Notice has the detail.

We honor Global Privacy Control and Do Not Track. If your browser or an extension sends either signal, we treat it as an instruction to opt out of optional analytics. We apply it to the browser or device that sent it, and to any profile associated with that browser or device, including a pseudonymous one. We do not ask you again after receiving a signal, and we do not require you to create an account or verify your identity to opt out.

Where we process data

We are based in the United States. Your information may be processed in the United States and in other countries where we or our service providers operate, which may have different data protection laws than your own.

Where personal information protected by UK or EU law is transferred out of those territories, we rely on the European Commission's Standard Contractual Clauses, and on the UK International Data Transfer Addendum for transfers from the UK. Copies are available from hello@sentialabs.ai.

Wherever your information is processed, it is subject to the laws of that country, which means it may be accessed by the courts, law enforcement, and national security authorities of that country. We require our service providers by contract to protect your information to a comparable standard, but no contract can override local law. We tell you about a request for your information wherever we are lawfully able to.

How long we keep it

We retain personal information for as long as necessary to provide the service and for the purposes described in this policy. To decide how long that is, we consider the duration of our relationship with you or your organization, whether the information is still needed to provide the service, our legal, tax, accounting and regulatory obligations, and whether the information is needed to resolve disputes or enforce our agreements.

Customers can delete their data at any time, and we delete or de-identify personal information once it is no longer needed for the purposes above. Contact hello@sentialabs.ai to request a deletion or export.

US state privacy rights

Depending on where you live, you may have the right to know what personal information we hold about you and to receive a copy of it, to correct it, to delete it, to receive it in a portable format, to opt out of the sale or sharing of it and of targeted advertising and certain profiling, and to appeal if we refuse a request. We do not sell or share personal information, so there is nothing to opt out of.

We will not discriminate against you for exercising any of these rights. We do not charge a fee, deny service, or provide a lesser experience because you made a request.

To make a request, email hello@sentialabs.ai. We verify requests by matching the information you give us against what we already hold, usually by confirming control of the email address on the account. We never require you to verify your identity to act on an opt-out preference signal. An authorized agent may make a request on your behalf with written permission, which we may ask to see.

We respond within the time your state's law allows, normally 45 days, and we will tell you if we need an extension. If we refuse, we will tell you why and how to appeal. If we deny your appeal you may complain to your state attorney general.

California

The categories of personal information we collect, our sources, and our purposes are listed above, and the categories we disclose to service providers and contractors for a business purpose are the same categories. As stated above, we do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not in the preceding twelve months.

We do not use or disclose sensitive personal information for any purpose other than those permitted without a right to limit, so we do not offer a “Limit the Use of My Sensitive Personal Information” option.

California residents may also ask us once a year to list the personal information we disclosed to third parties for their direct marketing purposes under the “Shine the Light” law. We do not disclose personal information for that purpose.

UK and EEA

If UK or EU data protection law applies to you, you have the right to access your personal data, to have it corrected or erased, to restrict or object to how we process it, to data portability, and to withdraw consent at any time without affecting processing carried out before you withdrew it. Where we rely on legitimate interests, you may object, and we will stop unless we have compelling grounds that override your rights.

Providing your name and email is necessary to hold an account; without it we cannot provide the service. Nothing else we ask for is a statutory or contractual requirement.

We do not make decisions producing legal or similarly significant effects about you by automated means alone.

You have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office at ico.org.uk. In the EEA it is the authority in your country of residence or workplace. We would appreciate the chance to address your concern first.

Canada

If you are in Canada, applicable Canadian federal and provincial privacy law gives you the right to know what personal information we hold about you and how we use and disclose it, to access it, to ask us to correct it if it is inaccurate or incomplete, to withdraw your consent subject to legal and contractual limits, and to complain about how we have handled it.

Who is accountable, and how to reach them

Our Privacy Officer is accountable for our compliance with Canadian privacy law and can answer questions about how we and our service providers collect, use, disclose, and store personal information, including service providers outside Canada. Write to the Privacy Officer at hello@sentialabs.ai.

Complaints

If you are not satisfied with how we have handled your personal information, write to the Privacy Officer. We will acknowledge your complaint, investigate it, and tell you the outcome. If you remain unsatisfied you may complain to the Office of the Privacy Commissioner of Canada, or to your provincial regulator, which in Quebec is the Commission d'accès à l'information, and in Alberta and British Columbia the Office of the Information and Privacy Commissioner.

Service providers outside Canada

We are based in the United States. The personal information we hold is processed outside Canada, in the United States and in other countries where we or the service providers in our subprocessor list operate, which may have different data protection laws than your own. While it is outside Canada it is subject to the laws of those countries and may be accessed by their courts, law enforcement, and national security authorities. We remain accountable for it, and we use contractual and other measures to require a comparable level of protection, but those measures cannot override foreign law. To request a written description of our policies and practices regarding service providers outside Canada, write to the Privacy Officer at the address above.

Quebec

If you are in Quebec, the following also applies. We collect personal information through our website and product using cookies and similar technologies, described in our Cookie Notice, and directly from you when you create an account or contact us. Some of those technologies allow us to analyze how the product is used, which can amount to profiling. They are switched off until you turn them on, and you can turn them on or off at any time using the Cookie preferences link in the footer of any page.

On request, we will tell you the personal information we hold about you, the categories of people within our organization who have access to it, how long we keep it, and how to reach our Privacy Officer. You may also ask us to provide the personal information you gave us in a structured, commonly used technological format, or to transmit it to another organization. We will publish a notice whenever we amend this policy, rather than only changing the date at the top.

We do not make decisions about you based exclusively on automated processing. Our platform produces simulated results to help our customers make their own decisions, and our Acceptable Use Policy prohibits our customers from using them to make decisions about specific people.

Marketing email

We send commercial email to people in Canada only where we have consent or are otherwise permitted to. Every commercial message identifies us, gives contact information that stays valid for at least 60 days, and includes an unsubscribe link that we honor without delay and in any case within 10 business days.

Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If a breach affects your personal information we will notify you and the relevant authorities as the law requires.

Children

Sentia is a business service intended for use by employees and authorized representatives of our customers, acting in a professional capacity. It is not directed to children, and we do not knowingly collect personal information from children under 13. We do not offer accounts to anyone under 18. If we learn we have collected personal information from a child under 13, we will delete it promptly and close any associated account.

Our customers control the material they bring into the platform. Our agreements prohibit them from submitting personal information about anyone under 13, and require the consents applicable law demands for anyone under 18.

Changes

We update this policy as the product and the law change. Every version carries its effective date at the top. For material changes we give at least 30 days' notice by email to workspace administrators or by a prominent notice on the site before they take effect.

We will not change this policy retroactively to permit uses of information we have already collected that you did not agree to when we collected it.

Contact us

For any privacy question or to exercise a right, email hello@sentialabs.ai.