Privacy Policy

This Privacy Policy describes how Santa's AI Lab Inc. ("Santa's AI Lab," "Outside Agent," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with the Outside Agent website, platform, hosted agents, dashboards, application programming interfaces, and related services that link to this Privacy Policy (collectively, the "Service").

Outside Agent helps creators build, publish, test, and operate AI agents that can interact with people through web chat, SMS, voice, Telegram, and other supported channels. Those agents may use knowledge bases, integrations, automated rules, human handoff, billing, and other tools selected or configured by the creator.

This Privacy Policy applies to visitors to our website, people who create or manage Outside Agent accounts, and people who interact with agents hosted through the Service. If a creator provides its own privacy notice for an agent, that notice may also apply to the information collected through that creator's agent.

Outside Agent handles information in more than one role. We are responsible for information we collect to operate our website, accounts, billing, safety systems, support, and platform infrastructure. For information an agent collects from end users on behalf of the creator that configured that agent, we may act as a service provider or processor for the creator, depending on the facts and applicable law.

Creators are responsible for configuring their agents lawfully, providing any notices or consents required for their particular use case, and ensuring that their agents do not request or process information they are not authorized to collect.

We collect personal information that you provide to us, that is generated through use of the Service, and that we receive from third parties. The categories we collect depend on how you use the Service.

• Account and contact information, such as name, email address, phone number, display name, company or business name, profile details, authentication identifiers, and account settings.
• Creator content and configuration, such as agent names, prompts, instructions, rules, channels, capabilities, knowledge-base sources, uploaded files, pasted text, URLs, test conversations, admin views, and other materials a creator adds to an agent.
• Agent interaction data, such as messages, prompts, outputs, conversation history, session identifiers, channel identifiers, timestamps, call metadata, call transcripts, uploaded files, and information the end user chooses to provide while interacting with an agent.
• Voice and telephony information, such as caller and recipient phone numbers, call status, call duration, audio-derived transcripts, opt-out records, delivery attempts, and information needed to route SMS or voice sessions.
• Connector and integration information, such as which third-party services are enabled for an agent, OAuth connection status, provider account references, tool metadata, and information returned by connected services when an authorized user asks the agent to use them.
• Payment and billing information, such as subscription plan, wallet transactions, billing status, Stripe customer or payment method references, card brand and last four digits, invoices, payment outcomes, and dispute or failure events. We do not store full card numbers.
• Usage, device, and online activity information, such as IP address, browser type, operating system, device type, pages viewed, referring pages, access times, feature usage, model and channel usage, logs, diagnostics, and approximate location derived from IP address.
• Communications with us, such as support requests, survey responses, feedback, emails, contact-form submissions, and related metadata.
• Information from third parties, such as authentication providers, payment processors, telecom providers, integration providers, analytics or security tools, and publicly available sources where permitted.

Outside Agent may be used for ordinary business and customer workflows that involve contact details, scheduling preferences, customer messages, and similar operational information. The Service is not intended to process highly regulated information unless we have entered into a separate written agreement that expressly permits that use.

Do not submit protected health information subject to HIPAA, full payment card data, financial account credentials, government identification numbers, biometric identifiers, children's personal information, or other information subject to special legal handling requirements unless Outside Agent has expressly agreed in writing to support that use case.

We use personal information to provide, maintain, secure, and improve the Service, including to:

• create, authenticate, administer, and support accounts;
• build, test, publish, route, and operate agents and agent conversations;
• process messages, calls, uploaded materials, knowledge-base content, connector requests, and other agent actions;
• send service, security, administrative, transactional, billing, and support communications;
• process subscriptions, wallet balances, usage charges, credits, payment methods, invoices, disputes, and refunds where applicable;
• enforce rate limits, action budgets, abuse-prevention rules, opt-outs, safety reviews, access controls, and other platform protections;
• monitor, debug, audit, measure, and improve the Service, including model quality, reliability, latency, safety, and user experience;
• develop new features, conduct analytics, and generate de-identified or aggregate statistics;
• comply with law, legal process, and contractual obligations; and
• protect the rights, safety, property, and security of Outside Agent, our users, creators, end users, and others.

The Service uses AI systems and AI service providers to generate responses, classify requests, review agent behavior, search knowledge bases, summarize content, transcribe or synthesize speech, and perform other functions requested through the Service.

We may use conversations, prompts, outputs, usage data, and other Service data to operate, evaluate, troubleshoot, protect, and improve Outside Agent. We may also create and use de-identified or aggregate information for analytics, research, product improvement, and business purposes.

We do not use identifiable customer conversations or uploaded content to train foundation models without permission or another disclosure at the time of collection. We require AI service providers that process personal information on our behalf to use it only to provide services to us, subject to their applicable terms and our agreements with them.

We disclose personal information as needed to provide and protect the Service and as otherwise described in this Privacy Policy.

• Service providers and subprocessors. We disclose information to vendors that provide hosting, cloud storage, databases, AI processing, speech-to-text, text-to-speech, authentication, telecom, SMS, voice, email, payments, analytics, security, logging, customer support, and other operational services.
• Creators and their authorized users. When an end user interacts with a creator's agent, information from that interaction may be available to the creator and people the creator authorizes to manage that agent.
• Integration providers. If a user connects or asks an agent to use a third-party service, we disclose information as needed to authenticate, call tools, receive results, and complete the requested integration workflow.
• Telecom carriers and communications providers. We disclose information needed to send, receive, route, monitor, and comply with rules for SMS, voice, and other communications.
• Payment processors. We disclose billing and payment information to payment processors to process transactions, subscriptions, refunds, disputes, and related records.
• Professional advisers. We disclose information to lawyers, auditors, accountants, insurers, bankers, and other professional advisers where necessary.
• Authorities, rights holders, and safety parties. We disclose information when we believe doing so is required or appropriate to comply with law, respond to legal process, protect rights or safety, investigate abuse or fraud, enforce our terms, or prevent harm.
• Business transferees. We may disclose information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.

We and our service providers may use cookies, local storage, pixels, SDKs, and similar technologies to keep you signed in, remember settings, operate the website, measure usage, improve performance, detect abuse, and understand how the Service is used.

You can usually adjust browser settings to remove or reject cookies. Some parts of the Service may not work properly if cookies or local storage are disabled. We do not currently respond to browser "Do Not Track" signals.

Depending on where you live and how you use the Service, you may have the right to request access to, correction of, deletion of, or information about certain personal information. You may also be able to object to or restrict certain processing, or request that we provide a portable copy of certain information.

To make a privacy request, contact us at hi@santasailab.com. We may ask for information to verify your identity and authority. If your request relates to information controlled by a creator, we may direct the request to that creator or help the creator respond, as appropriate.

You may opt out of marketing emails by using the unsubscribe link in those emails or by contacting us. You may still receive non-marketing communications, such as service, account, security, billing, or transactional messages.

Some agents can communicate by SMS, voice, web chat, Telegram, or other channels. Message and data rates may apply to SMS or mobile communications. If you no longer want to receive SMS messages from an agent, reply STOP or follow the opt-out instructions provided in the message. We maintain opt-out records to honor those requests.

Voice calls may be processed by automated systems to respond to you, create transcripts, measure usage, improve reliability, and maintain safety and audit records. Creators are responsible for providing any additional call recording or consent notices required for their specific use case and location.

We retain personal information for as long as reasonably necessary to provide the Service, maintain agents and account history, comply with legal and contractual obligations, resolve disputes, enforce agreements, prevent abuse, maintain security, and support legitimate business purposes.

Retention periods may vary based on the type of information, the creator's configuration, legal requirements, safety needs, billing or tax obligations, and whether information is part of an active agent, conversation, audit trail, or support request.

We use technical, organizational, and administrative safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You are responsible for protecting your account credentials, API keys, connected accounts, devices, and agent configurations. Notify us promptly if you believe your account or an agent has been compromised.

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information to us, contact us at hi@santasailab.com and we will take appropriate steps to delete the information.

If you are under the age of majority where you live, you may use the Service only with permission from a parent or legal guardian.

This section provides additional information for California residents. The personal information we collect may include identifiers, customer records information, commercial information, internet or other electronic network activity information, geolocation information, audio or similar information, professional or employment-related information, and inferences drawn from the information described above.

We collect and use these categories for the purposes described in this Privacy Policy, including providing the Service, operating accounts and agents, processing payments, communicating with you, maintaining security, preventing abuse, improving the Service, and complying with law.

We do not sell personal information or share personal information for cross-context behavioral advertising as those terms are defined by the California Consumer Privacy Act, based on our current launch practices. We do not knowingly sell or share personal information of people under 16.

California residents may have rights to know, access, correct, delete, and receive information about certain personal information, and to be free from discrimination for exercising privacy rights. To exercise these rights, contact us at hi@santasailab.com.

We may update this Privacy Policy from time to time. If we make material changes, we will update the date above and provide notice as required by law or through the Service.

If you have questions about this Privacy Policy or our privacy practices, contact us at hi@santasailab.com or write to Santa's AI Lab Inc., 11845 W Olympic Blvd, Suite 1100 West, Los Angeles, CA 90064.