Oozie.si Privacy Policy

This Privacy Policy explains how Oozie LLC ("Oozie.si," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit our websites at oozie.tech and oozie.si, sign up for or use the Oozie.si platform, or otherwise interact with us.

We wrote this policy in plain English. If something is unclear, contact us at privacy@oozie.si.

#1. Who We Are

Oozie.si is a horizontal AI digital-workforce platform for small and medium businesses. Businesses use Oozie.si to run AI agents for website chat, a shared inbox, SMS text messaging, voice calls (including an AI receptionist with call recording and transcripts), reviews, notifications, a knowledge base, integrations with other tools, and team accounts with two-factor authentication (2FA).

Oozie.si is operated by Oozie LLC, located at 5635 Springhouse Dr, Pleasanton, CA 94588.

#1.1 Key Terms

In this policy:

• "Services" means the Oozie.si platform, our websites at oozie.tech and oozie.si, and related support and communications.
• "Customer" means a business or organization that signs up for the Services, and "you" often refers to a Customer or a person using the Services on a Customer's behalf.
• "Team Member" means a person a Customer invites to use its Oozie.si account.
• "End Customer" means a person who interacts with a Customer through the Services, for example a caller, a website chat visitor, an SMS contact, a lead, a reviewer, or someone who sends a message to a Customer's inbox.
• "Customer Data" means the content and personal information about End Customers that a Customer, or its End Customers, submit to or generate through the Services, including call recordings, transcripts, messages, chats, leads, reviews, and knowledge base content.
• "Personal information" means information that identifies, relates to, or can reasonably be linked to a particular person or household. It includes "personal data" as used in the GDPR and UK GDPR.

#2. Scope and Our Roles

We handle personal information in two different roles. Which role applies depends on whose information it is and why we have it.

#2.1 When We Are the Controller or "Business"

We decide how and why to use the following information, so we act as a "controller" under the GDPR and UK GDPR and as a "business" under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and similar state laws:

• Account and Team Member information
• Billing and subscription information
• Information about visitors to oozie.tech and oozie.si
• Communications you send to us, such as support requests and sales inquiries
• Usage and device information about how Customers and Team Members use the Services

This Privacy Policy mainly describes how we handle that information.

#2.2 When We Are the Processor or "Service Provider"

When a Customer uses Oozie.si to talk with its own End Customers, we process Customer Data on the Customer's behalf and on its instructions. In that case:

• The Customer is the controller (or "business") and decides how and why End Customer information is used.
• We act as a "processor" under the GDPR and UK GDPR and as a "service provider" or "processor" under the CCPA/CPRA and other US state privacy laws.
• Our handling of Customer Data is governed by our agreement with the Customer, including the Data Processing Addendum in our Terms of Service.

If you are an End Customer, for example someone who called, texted, or chatted with a business that uses Oozie.si, the privacy policy of that business governs how your information is used. Please see Section 13 for how to make a request.

#2.3 What This Policy Does Not Cover

This policy does not cover the privacy practices of our Customers, or of third-party websites, apps, or services that you connect to or reach through the Services. Those parties have their own privacy policies.

#3. Information We Collect

#3.1 Account and Team Information

When you create an account or are invited as a Team Member, we collect information such as your name, business name, email address, phone number, job title or role, password (stored in hashed form), 2FA settings, and account preferences.

#3.2 Billing Information

Payments are processed by Stripe. When you start a paid plan or add a payment method, you give your card or payment details directly to Stripe. We do not store full card numbers. We receive limited information from Stripe, such as the card brand, last four digits, expiration date, billing name and address, and the status of payments and invoices.

#3.3 Usage and Device Information

When you use the Services or visit our websites, we automatically collect information such as:

• IP address, browser type, operating system, and device identifiers
• Pages and features you use, actions you take, and the date and time of your activity
• Usage counts that affect billing, such as voice minutes and SMS segments
• Log, diagnostic, and error information that helps us keep the Services working

#3.4 Website Visitor Information

When you visit oozie.tech or oozie.si, we collect usage and device information as described above, along with information you choose to provide, such as when you fill out a contact form, join a waitlist, request a demo, or start a free trial.

#3.5 Customer Data and End Customer Information

When Customers use the Services, we process Customer Data on their behalf. Depending on which features a Customer uses, this may include:

• Voice calls: caller phone numbers, call metadata (such as time and duration), call recordings, and transcripts.
• SMS: phone numbers, message content, delivery status, and opt-out status.
• Website chat: chat messages and information visitors choose to share.
• Shared inbox: messages and attachments sent to or from a Customer's inbox.
• Leads: names, contact details, and inquiry details that End Customers provide. When we record IP addresses associated with leads, we store them in hashed form rather than in plain form.
• Reviews: review content and reviewer information related to a Customer's business.
• Knowledge base and configuration: content a Customer uploads or writes to guide its AI agents, along with agent settings and scripts.
• Notifications: contact details and content needed to send notifications the Customer sets up.

#3.6 Integration Data

If a Customer chooses to connect an optional integration, such as a Google service, we receive the information that the Customer authorizes the integration to share, such as calendar availability, contacts, or business profile information. We use integration data only to provide the features the Customer has enabled. A Customer can disconnect an integration at any time.

#3.7 Communications With Us

When you contact us for support, sales, or other reasons, we collect your contact details and the content of your messages, along with any information you choose to share.

#4. Where We Get Information

We collect personal information from:

• You directly, when you sign up, configure the Services, contact us, or fill out a form.
• Your devices and browser, automatically, when you use the Services or our websites.
• Customers, who submit Customer Data and invite Team Members.
• End Customers, who call, text, chat with, or message a Customer through the Services.
• Service providers, such as Stripe for payment status and telephony or messaging providers for call and delivery information.
• Integrations that a Customer chooses to connect, such as Google services.

#5. How We Use Information

#5.1 Information We Control

We use account, billing, usage, visitor, and communications information to:

• Create and manage accounts and authenticate users, including 2FA
• Provide, operate, maintain, and support the Services
• Process payments, calculate usage such as voice minutes and SMS segments, and send invoices and receipts
• Send service messages, such as security alerts, billing notices, and changes to our terms or policies
• Respond to questions and support requests
• Monitor, debug, and improve the reliability, performance, and features of the Services
• Protect the security and integrity of the Services, and detect and prevent fraud, abuse, and violations of our Terms of Service
• Send marketing about Oozie.si where allowed by law, with the choice to opt out
• Comply with legal obligations and enforce our agreements

#5.2 Customer Data

We use Customer Data only to provide the Services to the Customer, following the Customer's instructions and our agreement with the Customer. For example, we use it to answer calls and chats, send and receive messages, produce recordings and transcripts, route leads, and power the Customer's AI agents. We may also use Customer Data as needed to secure the Services, prevent abuse, troubleshoot problems, and comply with law.

We may create aggregated or de-identified information from usage of the Services, such as overall usage statistics, that does not identify any person or Customer. We will not try to re-identify de-identified information, except as permitted by law.

#6. AI Processing

#6.1 How Our AI Agents Work

Oozie.si's AI agents generate responses using large language models and speech technologies provided by third parties. To produce a response, we send relevant inputs, such as the conversation, the Customer's knowledge base content, and agent instructions, to third-party model providers through OpenRouter, which routes requests to those providers. Voice features also use speech-to-text and text-to-speech providers, and planned voice AI services such as Retell.

#6.2 No Training on Customer Data

We do not use Customer Data to train our own AI models. Where providers offer the option, we configure our accounts not to allow providers to train their models on data we send. We use settings and terms intended to prevent providers from using that data to train their models, but each provider's practices are also governed by its own terms.

#6.3 AI Outputs

AI-generated responses may be inaccurate, incomplete, or out of date. Customers are responsible for configuring their agents and knowledge base and for reviewing outputs. AI outputs are not legal, medical, financial, or other professional advice.

#6.4 Disclosures to Callers

At the start of every call handled by the Oozie.si AI receptionist, a disclosure plays telling the caller that they are speaking with an AI agent and that the call may be recorded and transcribed. Callers may ask to speak with a staff member.

#7. Legal Bases for Processing (EEA and UK)

If the GDPR or UK GDPR applies to our handling of your personal information as a controller, we rely on these legal bases:

• Contract: to provide the Services you signed up for, manage your account, and process payments.
• Legitimate interests: to secure and improve the Services, prevent fraud and abuse, understand how the Services are used, communicate with business contacts, and send business-to-business marketing where permitted. We balance these interests against your rights and freedoms.
• Consent: where required, for example for non-essential cookies or certain marketing. You can withdraw consent at any time.
• Legal obligation: to comply with tax, accounting, and other legal requirements.

When we process Customer Data as a processor, the Customer is responsible for having a legal basis for that processing.

#8. How We Disclose Information

We do not sell personal information. We do not "share" personal information for cross-context behavioral advertising, as those terms are defined in the CCPA/CPRA.

We disclose personal information only as described below.

#8.1 Sub-processors and Service Providers

We use trusted vendors to host, operate, and support the Services. They may access personal information only to perform services for us, under contracts that restrict their use of it. Section 9 lists our sub-processors.

#8.2 At a Customer's Direction

We disclose Customer Data as the Customer directs, for example by sending messages to End Customers, delivering notifications, or sending data to integrations the Customer connects. Team Members of a Customer account can see Customer Data according to the roles and permissions the Customer sets.

#8.3 Legal Compliance and Protection

We may disclose information if we believe in good faith it is reasonably necessary to comply with a law, regulation, legal process, or valid government request; to enforce our agreements; to protect the security or integrity of the Services; or to protect the rights, property, or safety of Oozie.si, our Customers, or others. Where legally permitted and practical, we will notify the affected Customer before disclosing Customer Data in response to a legal demand.

#8.4 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our assets, personal information may be transferred as part of that transaction, subject to commitments at least as protective as this policy.

#8.5 With Consent

We may disclose information for other purposes with your consent or at your direction.

#9. Sub-processors

We currently use, or may use, the following sub-processors to provide the Services.

Third-party model providers that receive requests through OpenRouter process those requests to generate responses.

#9.1 Changes to Sub-processors

We will update this list before a new sub-processor begins processing personal information. Customers who have agreed to our Data Processing Addendum will receive advance notice of new sub-processors and may object on reasonable data protection grounds, as described in our Terms of Service.

#10. International Data Transfers

Oozie.si is based in the United States, and our primary hosting is in the United States. Our sub-processors may process information in the United States or in other countries where they operate.

If you are in the European Economic Area, the United Kingdom, or Switzerland, your personal information will be transferred to and processed in the United States and possibly other countries that may not have the same data protection laws as your country. Where required, we protect these transfers using appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, along with supplementary measures where appropriate.

#11. Data Retention

We keep personal information only for as long as we need it for the purposes described in this policy, unless the law requires or permits a longer period. In practice:

• Account information is kept while your account is active and as needed to provide the Services.
• Customer Data is kept while the Customer's account is active, unless the Customer deletes it sooner. Customers can delete content such as recordings, transcripts, messages, and leads through the Services or by contacting us.
• After an account is closed, we delete or de-identify Customer Data within a reasonable period, except where the law requires us to keep it. Customers can export their data before closure, as described in our Terms of Service.
• Backups are deleted as they roll off on their normal backup cycle. Until then, they remain protected and are not used for active processing.
• Billing and transaction records are kept for as long as tax, accounting, and other laws require.
• Logs and security records are kept for as long as reasonably needed for security, troubleshooting, and fraud prevention.

When deciding how long to keep information, we consider the amount, nature, and sensitivity of the information, the purposes for which we use it, the risk of harm from unauthorized use, and our legal obligations.

#12. Security

We use administrative, technical, and organizational measures designed to protect personal information. These include:

• Encryption of data in transit
• Storing IP addresses associated with leads in hashed form
• Role-based access controls, so Team Members see only what their role allows
• Two-factor authentication (2FA), available for team accounts
• Limiting our staff's and vendors' access to what they need for their work

No system is perfectly secure, and we cannot guarantee the security of information. You are responsible for keeping your login credentials confidential, turning on 2FA, and giving Team Members only the access they need.

If we learn of a security breach affecting personal information, we will notify affected Customers, individuals, and regulators as required by law. For Customer Data, we will notify the affected Customer without undue delay, as described in our Data Processing Addendum.

#13. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights regarding personal information we hold as a controller or business.

#13.1 Rights Under US State Privacy Laws

Residents of California and other US states with comprehensive privacy laws may have the right to:

• Know and access: request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients.
• Correct: ask us to correct inaccurate personal information.
• Delete: ask us to delete personal information, subject to legal exceptions.
• Portability: receive a copy of your personal information in a portable, commonly used format.
• Opt out: opt out of the sale or sharing of personal information, targeted advertising, and certain profiling. We do not sell or share personal information or use it for targeted advertising, so there is nothing to opt out of today, but you may still contact us.
• Limit use of sensitive personal information: where applicable. As explained in Section 15, we use sensitive personal information only for purposes permitted by law.
• Non-discrimination: we will not discriminate against you for exercising your rights.
• Appeal: if we deny your request, you may appeal by replying to our decision or emailing privacy@oozie.si with the subject line "Privacy Request Appeal." If we deny your appeal, you may contact your state attorney general.

#13.2 Rights Under the GDPR and UK GDPR

If you are in the European Economic Area or the United Kingdom, you have the right to:

• Access your personal information
• Correct inaccurate or incomplete personal information
• Delete your personal information
• Restrict our processing of your personal information
• Object to our processing, including processing based on legitimate interests and direct marketing
• Receive your personal information in a portable format
• Withdraw consent at any time, where we rely on consent, without affecting processing that happened before
• Lodge a complaint with your local data protection supervisory authority

#13.3 How to Exercise Your Rights

To make a request, email privacy@oozie.si. Account holders can also view, update, export, and delete much of their information directly in their account settings.

• Identity verification: we will take reasonable steps to verify your identity before acting on a request, for example by asking you to confirm information we already have or to respond from the email address on your account.
• Authorized agents: you may use an authorized agent to make a request on your behalf where the law allows. We may ask the agent for proof of authorization and ask you to verify your identity directly.
• Timing: we will respond within the time required by applicable law. Where the law allows, we may extend that time and will tell you if we do.
• Fees: we do not charge a fee for requests unless they are clearly unfounded, excessive, or repetitive, where the law allows.

#13.4 If You Are an End Customer of One of Our Customers

If you interacted with a business that uses Oozie.si, for example by calling, texting, or chatting with it, that business controls your information. Please contact that business first to make a privacy request. If you contact us instead, we will, where possible, forward your request to the relevant business and help that business respond, as our agreement with it requires.

#14. US State Privacy Notice

This section provides additional information for residents of California and other US states with comprehensive privacy laws. It describes information we handle as a business. It does not cover Customer Data we process as a service provider.

#14.1 Categories of Personal Information

In the past 12 months, we have collected the following categories of personal information.

We may also disclose any category of personal information for legal compliance, to protect rights and safety, in a business transfer, or with your consent, as described in Section 8.

#14.2 Sale, Sharing, and Targeted Advertising

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising. We have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16.

#14.3 Retention

We keep each category of personal information according to the criteria in Section 11.

#14.4 Your Rights

See Section 13 for your rights and how to exercise them.

#15. Sensitive Information

The only sensitive personal information we collect as a business is account login credentials, which we use to authenticate you and protect your account. We do not use or disclose sensitive personal information to infer characteristics about you or for any purpose beyond those permitted by applicable law.

Customers and End Customers should not enter sensitive regulated information into conversations, knowledge bases, forms, or other parts of the Services, except as the product expressly supports. That includes government identification numbers and full payment card numbers outside of Stripe's payment forms. See Section 19 for health information.

#16. Cookies and Similar Technologies

#16.1 What We Use

We use cookies and similar technologies on our websites and in the Services:

• Essential storage: We use browser local storage, not cookies, to keep you signed in and to continue a website-chat conversation; it is essential and stays until you sign out or clear it. You cannot turn this essential storage off in our Services, though you may be able to clear local storage in your browser, which may break some features.
• Analytics cookies, if we enable them, help us understand how our websites and the Services are used so we can improve them.

We do not currently use marketing or advertising cookies or trackers.

#16.2 Changes and Consent

Before we add any non-essential cookies, we will update this policy and, where the law requires, ask for your consent first. You can manage cookies through your browser settings.

#17. Do Not Track and Global Privacy Control

Some browsers send a "Do Not Track" signal. Because there is no common industry standard for responding to it, we do not respond to Do Not Track signals.

We honor Global Privacy Control (GPC) signals where required by law, treating them as a request to opt out of the sale or sharing of personal information for the browser or device sending the signal. Since we do not sell or share personal information, this does not change how the Services work for you.

#18. Children's Privacy

The Services are for businesses and are not directed to children. The Services are not for anyone under 16, and we do not knowingly collect personal information from children under 16. That includes children under 13 as covered by the Children's Online Privacy Protection Act (COPPA).

If we learn that we have collected personal information from a child under 16, we will delete it. If you believe a child has provided us with personal information, please contact privacy@oozie.si.

#19. Healthcare and Dental Beta Notice

During our beta period, Oozie.si for Healthcare and Dental businesses is available only through a waitlist or as a demo.

Customers must not submit, upload, or allow callers, chat visitors, or other contacts to transmit protected health information (PHI) through Oozie.si on our current infrastructure. That includes call recordings, transcripts, messages, leads, knowledge base content, and integration data.

During beta, Oozie.si does not sign Business Associate Agreements (BAAs) and is not offered as a service that complies with the Health Insurance Portability and Accountability Act (HIPAA). Healthcare and Dental businesses should use demos with sample or synthetic information only.

If we later offer a service designed for PHI, we will describe it in updated terms and policies before it becomes available.

#20. Your Communication Choices

#20.1 Email

You can unsubscribe from our marketing emails at any time using the unsubscribe link in the email or by contacting privacy@oozie.si. We will still send service messages, such as security, billing, and account notices, because they are necessary to provide the Services.

#20.2 SMS

If you receive text messages from us, you can reply STOP to opt out and HELP for help. We send SMS only during permitted hours and not between 8 p.m. and 8 a.m. in the recipient's local time.

If you receive a text from a business that uses Oozie.si, you can reply STOP to opt out of that business's messages and HELP for help. Opt-outs are honored for that business's messages sent through Oozie.si.

#20.3 Calls

If you receive a call handled by an Oozie.si AI agent, you will hear a disclosure that you are speaking with an AI agent and that the call may be recorded. You can ask to speak with a staff member, or end the call at any time.

#21. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will change the effective date at the top. If we make material changes, we will notify Customers by email or through the Services before the changes take effect, and where the law requires, we will ask for your consent.

#22. Contact Us

If you have questions, requests, or complaints about this Privacy Policy or our privacy practices, please contact us:

Oozie LLC
5635 Springhouse Dr, Pleasanton, CA 94588
Email: privacy@oozie.si

For general support, contact support@oozie.si.