Privacy Policy

This Privacy Policy explains how Cuanto Labs LLC, [Fill in: entity type, e.g. a Florida limited liability company] ("Cuanto Labs LLC", "we", "us" or "our") collects, uses, shares and protects personal information when you visit https://saymaya.com, use SayMaya (the "Service") or otherwise interact with us. It also explains the rights and choices you have.

For personal information we collect to run our own business, such as account, billing and website data, we are the "controller" (or "business") responsible for it. When a business customer uses the Service to process information about its own users, customers or contacts, that customer is the controller and we process the information on its behalf, as explained in the section on customer data below.

This policy does not cover third-party websites or services that you reach through links in the Service. Their own privacy policies apply.

We collect personal information in three ways: you give it to us, it is collected automatically when you use the Service, and we receive it from third parties. The table below lists the categories we collect, where they come from and why we use them.

You do not have to give us personal information, but some of it is needed to create an account and provide the Service. If you choose not to provide it, some features may not be available to you.

We use personal information to:

• create and manage your account, and provide the features you ask for;
• process payments, send receipts and manage subscriptions;
• send service messages, such as security alerts, account notices and changes to our terms, which you cannot opt out of while you have an account;
• respond to your requests and provide customer support;
• keep the Service secure, including detecting, investigating and preventing fraud, abuse, spam and security incidents;
• understand how the Service is used, fix problems and improve and develop features;
• send product updates and marketing, where the law allows and subject to your choices; and
• comply with legal obligations, enforce our terms and protect our rights and the rights of others.

Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases under the GDPR and UK GDPR:

• Contract: to provide the Service you signed up for and manage your account.
• Legitimate interests: to secure, support, understand and improve the Service, and to send business-to-business marketing. We balance these interests against your rights, and you can object at any time.
• Consent: for non-essential cookies, marketing emails where consent is required. You can withdraw consent at any time without affecting processing that already took place.
• Legal obligation: to keep tax and accounting records and respond to lawful requests.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.

Our business customers use the Service to store and process information about their own employees, customers and contacts ("Customer Data"). For Customer Data, the business customer is the controller and we are its processor or service provider. We process Customer Data only on the customer's instructions, as set out in our agreement with them and our Data Processing Addendum, and not for our own purposes.

The customer's own privacy policy governs how it uses Customer Data. If your information has been added to the Service by one of our customers and you want to exercise your privacy rights, please contact that customer directly. If you contact us, we will forward your request to the customer and help them respond.

When you use AI features, the content you submit (such as prompts, files and the context needed to answer them) is sent to our AI model providers, Anthropic, to generate output. The providers act as our sub-processors and process the content only to provide the feature to us.

We do not use your inputs or outputs to train or fine-tune AI models, and our agreements with our providers prohibit them from doing so.

Our providers may retain content for up to 30 days solely to detect and prevent abuse, and then delete it. Our AI Terms have more detail.

We use cookies and similar technologies, such as local storage, to keep you signed in, remember your preferences, secure the Service and, where permitted, understand how it is used. Our Cookie Policy lists each one and explains how to control them.

We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale or sharing of your personal information for that browser and, if you are signed in, for your account. Because we do not sell or share personal information, the signal has no further effect, but we honor it all the same. There is no common standard for "Do Not Track" browser signals, so we do not respond to them.

We share personal information only as follows:

• Service providers (sub-processors). Companies that host, secure, support and operate the Service for us, under contracts that limit their use of the information to providing services to us. The current list, with each provider's purpose and location, is on our Sub-processors page. They currently include Vercel, Neon, Upstash, Amazon Web Services, Sentry, Stripe and Anthropic.
• Your organization. If you use the Service through a workspace managed by your employer or another organization, its administrators can access information about your use of that workspace.
• At your direction. When you connect an integration, share content or ask us to share information with someone.
• Legal and safety. When we believe in good faith that disclosure is needed to comply with law, a court order or a valid legal process, to enforce our terms, or to protect the rights, property or safety of our users, the public or us. Where permitted, we tell affected users about government requests before disclosing.
• Business transfers. As part of a merger, acquisition, financing or sale of assets, subject to this policy. We will notify you before your information becomes subject to a different privacy policy.
• Professional advisers. Lawyers, auditors and insurers, under duties of confidentiality.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have not done so in the past 12 months.

We are based in the United States, and we and our service providers process personal information there and in other countries whose data protection laws may differ from yours. When we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision (including the EU-U.S. Data Privacy Framework where the recipient is certified) or on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional safeguards where appropriate. You can ask for a copy of the relevant safeguards by contacting privacy@saymaya.com.

We keep personal information for as long as we need it for the purposes described in this policy, then delete or anonymize it. How long that is depends on the type of information and why we have it:

Deleted information may remain in encrypted backups for a short time until those backups are overwritten. We may keep information longer when the law requires it or to resolve a dispute, and only for as long as needed.

We protect personal information with administrative, technical and physical safeguards appropriate to its sensitivity, including encryption in transit (TLS) and at rest, least-privilege access controls, multi-factor authentication for staff, logging and monitoring, and vendor security reviews. No system is perfectly secure, and we cannot guarantee absolute security.

If a data breach affects your personal information, we will notify you and the relevant authorities as the law requires. To report a vulnerability, contact security@saymaya.com.

Wherever you live, you can:

• access and update most account information in your account settings;
• ask for a copy of your personal information in a portable format;
• ask us to correct inaccurate information;
• ask us to delete your personal information, subject to legal exceptions; and
• unsubscribe from marketing emails using the link in any of them. We will still send service messages.

To make a request, email privacy@saymaya.com from the address on your account, or use the tools in your account settings. We will verify your identity before acting, usually by confirming control of your account email, and may ask for more information if needed. We respond within 30 days and will tell you if we need more time, as the law allows. Requests are free unless they are manifestly unfounded or excessive. We will not discriminate against you for exercising your rights.

If the GDPR, UK GDPR or Swiss data protection law applies to you, you also have the right to object to processing based on our legitimate interests (and an absolute right to object to direct marketing), to ask us to restrict processing, to data portability, and to withdraw consent at any time.

You can lodge a complaint with your local data protection authority. In the UK, that is the Information Commissioner's Office. We would appreciate the chance to address your concern first, so please contact us at privacy@saymaya.com.

Privacy laws in California (CCPA, as amended by the CPRA), Florida (the Florida Digital Bill of Rights), Colorado, Connecticut, Virginia, Texas, Oregon and other states give their residents specific rights. We extend these rights to all of our users in the United States, whether or not their state's law applies to us.

Notice at collection

In the past 12 months we have collected these categories of personal information: Account information, Customer content, Billing information, Usage and device data, Communications and AI inputs and outputs. We collect them from the sources and for the business purposes described in the "Information we collect" section, keep them for the periods in the "How long we keep information" section, and disclose them for business purposes to the service providers described in "How we share information".

We do not sell or share personal information, including that of consumers under 16. We use sensitive personal information (such as account login credentials) only for purposes permitted by law, such as providing the Service you asked for, and not to infer characteristics about you.

Your rights

• Know and access: the categories and specific pieces of personal information we hold about you, the sources, our purposes, and the categories of third parties we disclose it to.
• Delete and correct your personal information.
• Portability: receive your information in a portable, readily usable format.
• Opt out of the sale of personal information, of sharing for targeted advertising, and of profiling in furtherance of decisions with legal or similarly significant effects. Use Global Privacy Control or email privacy@saymaya.com.
• Limit the use of sensitive personal information to permitted purposes.
• Non-discrimination: we will not deny you service, charge you a different price or give you a lower quality of service for exercising your rights.

How to make a request

Email privacy@saymaya.com with the subject line "Privacy request". You can also have an authorized agent make a request for you; we will ask the agent for proof of your signed permission and may ask you to verify your identity directly. We respond within 30 days, as required by law.

Appeals

If we decline your request, you can appeal by replying to our decision or emailing privacy@saymaya.com with the subject line "Privacy appeal". We will respond in writing within 60 days, explaining our decision. If you are not satisfied, you may contact your state attorney general.

California "Shine the Light"

California residents may ask once a year whether we disclosed personal information to third parties for their direct marketing purposes. We do not do so.

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. You must be at least 16 to use the Service. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly. If you believe a child has given us personal information, contact privacy@saymaya.com.

We may send you emails about new features, events and offers. Each marketing email identifies us, includes our postal address and contains an unsubscribe link. We process unsubscribe requests within 10 business days, and you will still receive service messages about your account. Where the law requires your consent to send marketing, such as in the EEA and UK, we ask for it first.

We may update this policy from time to time. If we make a material change, we will notify you by email or in the Service before it takes effect and update the "Last updated" date above. If a change means we will use personal information we already hold in a materially different way, we will ask for your consent where the law requires it. Previous versions are listed on our legal center.

For questions about this policy or to exercise your rights, email privacy@saymaya.com or write to Cuanto Labs LLC, Attn: Privacy, 1314 E Las Olas Blvd PMB 2570, Fort Lauderdale, FL 33301, USA.