Privacy Policy

1. Scope and who handles your information

Signals and Sensors LLC operates Sigsen.ai. This policy covers our website, accounts, Sigsen-operated demos, and the information we process to deliver our agent platform.

For account administration, billing, website security, and our own assistants, Sigsen determines the purposes of processing. When an organization deploys an assistant, that organization generally determines the purpose, information collected, provider choices, and retention settings. Sigsen processes that conversation information to provide the configured service.

An organization's own notice may therefore apply to a conversation with its assistant. If you want to exercise rights over that organization's data, contact the organization. We will assist with requests relating to data we process for it, subject to authorization and applicable law.

This policy does not replace a required data processing agreement or a third-party provider's policy. It does not promise a particular hosting region, certification, or provider retention setting.

2. Information we process

Account, organization, and support information

We process information you provide when creating an account, joining an organization, configuring an assistant, or contacting us. This may include your name, email, profile, organization membership and role, authentication records, preferences, and support messages.

If you use social sign-in or a passkey, the information needed for that authentication is handled through the configured sign-in mechanism. Do not include API keys, passwords, or sensitive customer records in support messages.

Billing information

Where billing is enabled, our payment provider processes payment details. Sigsen may store customer and subscription identifiers, plan and invoice information, billing status, and related transaction metadata. Our normal payment flow does not require Sigsen to store your full card number or card security code.

Assistant configuration and uploaded knowledge

We process assistant instructions, guardrails, provider selections, tools, contact-collection fields, uploaded files, approved source versions, extracted text, source metadata, and retrieval indexes. Indexing can create embeddings, which are numerical representations of text. Relevant source passages can be sent to a model to produce or check an answer.

Uploaded knowledge may contain personal information. The uploading organization is responsible for deciding what is appropriate to include, obtaining the necessary rights, and reviewing documents before approving them.

Conversations and actions

Depending on the channel and enabled features, we process:

• Audio needed for speech recognition and voice responses, and text messages or voice notes.
• Transcribed words, assistant replies, conversation context, and information the assistant is instructed to collect.
• Phone or WhatsApp identifiers supplied through the channel, and delivery or call-status information.
• Tool requests and results, confirmations, handoffs, and webhook payloads.
• Saved recordings or transcripts when enabled and the applicable consent requirements are met.
• Configured summaries, structured outcomes, knowledge evidence records, and review information.

Audio may be transmitted for real-time processing even when saving a recording is disabled. Declining recording or memory does not prevent processing necessary to deliver the conversation or maintain essential operational records.

Credentials and integration information

We process provider API keys, integration credentials, configuration, and associated account identifiers supplied by an authorized administrator. Saved credentials use server-side encryption and are used to authenticate configured requests. They are not intentionally exposed to website visitors as part of normal assistant operation.

Device, security, and usage information

We process information needed to operate and protect the service, such as request and session identifiers, IP-related information, browser or user-agent information, timestamps, authentication events, errors, duration, usage, and provider/model identifiers.

For public browser calls, IP and browser information can contribute to a keyed abuse-limit identifier. This is separate from the browser identifier used for optional memory. We do not treat an IP address as proof of a person's identity.

Model comparison and cost views may use operational measurements such as latency, request outcomes, tokens, audio duration, and available costs. A missing measurement is not evidence of zero usage. Those measurements do not require publishing private prompts or recordings in the catalog.

3. Why we use information

We use information to:

• Authenticate people, manage organizations, apply permissions, and operate the website.
• Deliver the conversation, retrieve relevant knowledge, produce responses, and execute authorized actions.
• Maintain consent choices and optional memory where enabled.
• Provide billing, support, troubleshooting, and service communications.
• Detect abuse, investigate incidents, maintain audit records, and enforce our terms.
• Measure and improve reliability and the performance of configured features.
• Meet legal obligations and protect the rights of users, customers, and others.

We do not sell personal information or use it for cross-context behavioral advertising. We do not use Customer Content to train a general-purpose AI model for Sigsen. Provider processing and any provider training or retention practices depend on the provider, account, and settings used.

Where a legal basis is required, it may include providing a requested service under a contract, complying with a legal obligation, a legitimate operational or security interest subject to applicable protections, or consent for processing that requires it. An organization deploying an assistant must establish its own lawful basis and instructions.

4. Optional recognition and memory

Browser recognition uses a random, pseudonymous browser identifier, rather than a fingerprint designed to identify you across unrelated websites. A verified account can be used for account-linked memory when that option is selected.

The identifier is scoped to the organization when stored for agent use. Depending on the assistant's memory settings, remembered information can be limited to an assistant or shared within that organization. It is not intended to be shared across unrelated tenant organizations.

Persistent memory is consent-based and can retain configured facts such as a name, language, preferences, project details, or next steps.

Where an assistant enables optional voice recognition, signed-in users with verified accounts can separately consent to enrollment and comparison. We derive an encrypted speaker embedding from an enrollment recording and compare it with a short segment of speech during an opted-in browser call. Voice profiles are biometric information and are scoped to your account, organization, and assistant. Enrollment audio is discarded after processing; the encrypted profile expires after the configured period (at most 90 days) and can be deleted using "Delete my voice profile". Profile deletion revokes future comparisons and memory eligibility tied to that profile. Independently configured call recordings have their own consent and retention.

Voice recognition is a fallible personalization hint, never a login credential or proof of identity. We do not identify anonymous callers from a directory of voices. Where voice-gated history is configured, historical memory additionally requires your verified account, memory permission, and a valid matching profile. You can use an ordinary call without consenting to voice recognition; historical memory may then be unavailable. "Forget history" deletes the selected conversation memory; deleting your voice profile is a separate control. Contact us at admin@sigsen.ai if you need help withdrawing consent or deleting a profile you can no longer access.

Where offered, you can decline memory, turn it off for future interactions, or use the "Forget history" control. Turning off memory and deleting previous memories are distinct actions. Clearing a browser cookie can stop that browser from linking to its previous identifier, but does not by itself delete stored records or memory linked to a verified account.

5. Recordings, transcripts, and consent

Saved call audio and transcripts are controlled separately from real-time processing and optional memory. In the current assistant settings, saving call audio and transcripts is off by default. Enabling it still requires the applicable consent.

An organization must provide appropriate notices and obtain legally valid permission for its use case. The browser's microphone permission prompt alone is not a recording-consent notice.

Sigsen's homepage demos display a notice before you start: calls are transcribed and analysed to assess demo quality, caller feedback, and task completion. Starting a demo accepts that processing. Demo transcripts and their structured feedback are retained for up to 30 days; usage, duration, latency, and call-status statistics have separate operational retention. Demo audio is processed for speech recognition and responses, but saving audio recordings is disabled.

Optional memory and voice recognition have separate choices. Stop a demo at any time using End call, and contact admin@sigsen.ai to request deletion of a retained demo transcript. Withdrawal does not undo processing that was already lawful, remove necessary operational or billing records, or automatically delete copies held by independent providers.

6. Who receives information

Information may be disclosed to the following recipients, as necessary for the feature or purpose:

• Your organization: authorized workspace members can access data within their role and organization scope.
• Configured model and speech providers: relevant prompts, conversation context, audio, source passages, and other request data are sent to the selected providers.
• Communications providers: phone, SIP, and WhatsApp services process channel identifiers, media, messages, and delivery information.
• Tools, MCP servers, and webhooks: the configured destination receives the arguments, records, or results needed for the requested action.
• Infrastructure and support services: hosting, databases, storage, email, security, and payment services process information needed to run the service.
• Authorized Sigsen personnel: access may be needed for administration, support, reliability, security, or compliance.
• Legal or business recipients: we may disclose information where required by law, to protect rights and safety, or in a merger, financing, or business transfer subject to applicable protections.

Using your own API key changes the provider account used; it does not eliminate Sigsen's processing or the provider's receipt of request data. Optional fallbacks and post-call analysis can involve additional configured providers.

The service does not use every supported provider for every conversation. The actual recipients depend on the organization's configuration and the processing path used. Contact us for the currently applicable infrastructure and processor information. A supported integration list is not a verified list of processors active in your workspace.

7. International processing

Sigsen's US mailing address does not mean all processing or storage occurs in the United States. Organizations, callers, hosting services, and configured providers can be in different countries.

Where applicable law requires an international-transfer mechanism, the appropriate safeguards and agreements must be in place for the covered processing. Contact us before enabling a workflow that requires a particular transfer mechanism or data residency commitment. This policy does not assert that any unconfirmed arrangement already exists.

8. Retention and deletion

We retain information for the relevant service purpose, your configuration and instructions, and applicable legal requirements. Different record types have different retention rules.

• Saved call artifacts: the current configurable retention range is 1–365 days, with a 30-day default when saving is enabled. Expired artifacts are excluded from normal access and are eligible for cleanup. Temporary transcripts used for configured outcome analysis can have a shorter processing lifetime.
• Persistent memory: retention is configurable from 1–365 days, with a 30-day default. Memory expiry is independent of saved call recordings.
• WhatsApp content: message retention follows the configured channel policy and does not automatically use the browser-call artifact period.
• Knowledge: source files, versions, chunks, and indexes can persist while used by the organization, subject to deletion and source-management controls.
• Account, billing, support, operational, and audit records: these do not all share the artifact expiry setting. They can be retained for administration, fraud prevention, dispute handling, and legal obligations.

Expiry is not a promise of simultaneous deletion from every database, queue, log, provider, or backup. Backups, where maintained, may retain copies until rotation. Provider copies follow that provider's terms and controls.

For a broader deletion request, contact the assistant's organization or Sigsen as appropriate. We may need to verify your identity and authority, retain legally required records, or explain a technical limitation. If a request cannot be fully completed, we will explain the applicable reason rather than representing incomplete deletion as complete.

9. Security

The application includes organization-scoped authorization, server-side encryption for saved provider credentials and selected sensitive artifacts, scoped call tokens, consent controls, and operational safeguards. See Security & Trust for the scope and limitations of these controls.

No security measure eliminates every risk. We do not describe the application as end-to-end encrypted: configured services need to process conversation information. Do not send highly sensitive information until the organization and Sigsen have confirmed that the complete workflow is suitable for it.

10. Your choices and privacy rights

Depending on your location and the applicable law, you may have rights to request access, a copy or portability, correction, deletion, restriction, or objection to certain processing, and to withdraw consent. California residents may also have applicable rights concerning information categories, purposes, disclosures, sale or sharing, and certain uses of sensitive information. These rights are subject to the law's scope and exceptions.

We do not sell personal information or share it for cross-context behavioral advertising. You can nevertheless contact us about a privacy concern or an applicable opt-out request. We will not discriminate against you for exercising a right protected by law.

To make a request, use the contact details below. Identify whether it concerns your Sigsen account, a Sigsen demo, or another organization's assistant. Do not send identity documents unless they are reasonably necessary and we have provided a suitable method. An authorized agent may submit a request subject to appropriate verification.

We will respond within the applicable legal timeframe and explain any permitted refusal or limitation. You may have a right to appeal a decision or complain to a supervisory authority, depending on the law that applies.

11. Cookies and local storage

We use cookies and browser storage for authentication, security, preferences, and browser recognition where needed. Our current marketing implementation has no configured advertising or marketing-analytics cookies. Third-party sign-in, payment, or anti-abuse services may apply their own practices when used.

The cookie banner records an optional-cookie preference. It does not replace recording or memory consent. See our Cookie Policy for storage details and controls.

12. Children

Workspace accounts are intended for adults. Sigsen is not directed to children under 13. Organizations must not deploy child-directed services or knowingly submit children's information without the legal basis, notices, permissions, and safeguards required for that use.

If you believe a child has provided information inappropriately, contact us and the relevant assistant's organization so the information can be reviewed and handled under applicable law.

13. Changes and contact

We may update this policy as the service or our practices change. We will update the date and provide additional notice or seek consent where required for a material change. The operator and contact details below apply to privacy enquiries and rights requests.