Privacy Policy

Zammo Inc. (“Zammo,” “we,” “us,” or “our”) provides AI-powered agent software that enables businesses and organizations (“Customers”) to engage their own users and customers (“End Users”) across chat channels (including website chatbot, Microsoft Teams chatbot, WhatsApp, Slack, Facebook Messenger, and SMS) and voice channels (including IVR via Twilio and IVR via Microsoft Azure Communication Services) (collectively, the “Channels”), and to create generative AI experiences using the Customer’s own data (the “Services”).

Zammo also provides related websites, online resources, administrative dashboards, and account management functionality through which Customers, Authorized Users, prospective customers, and other individuals may interact with Zammo.

This Privacy Policy applies to Personal Information collected through Zammo’s websites, including www.zammo.ai, Zammo’s SaaS platforms (including agents.zammo.ai and supported legacy SaaS environments such as app.zammo.ai), and Zammo’s AI Managed Application distributed through Microsoft Azure Marketplace.

Zammo offers the Services in two configurations:

• “Zammo Agents on SaaS” – a multi-tenant software-as-a-service offering hosted on Zammo’s own Microsoft Azure tenant; and

• “Zammo Agents as an Azure Managed Application” (“ZOT Software”) – software distributed through the Microsoft Marketplace and installed directly on the Customer’s own Azure tenant, such that the Customer’s content and data is stored on and linked to the Customer’s own Azure account.

Except where this Policy expressly distinguishes between the two, “Services” refers to both Zammo Agents on SaaS and the ZOT Software.

This Privacy Policy describes how we collect, use, and disclose information in connection with the Services. By using the Services, you agree to the practices described in this Policy, as well as the Microsoft Marketplace Standard Contract (for the ZOT Software) or Zammo’s applicable terms of service (for Zammo Agents on SaaS), each of which is incorporated by reference. If you do not agree with this Policy, you should not access or use the Services.

This Policy also describes how Zammo processes Personal Information collected from visitors to its websites, prospective customers, business contacts, and other individuals who interact directly with Zammo.

1. DEFINITIONS

“Customer” means the business or organization that contracts with Zammo to use the Services. Customers may include businesses, government entities, educational institutions, healthcare organizations, and other organizations.

“Authorized Users” means the Customer’s employees, contractors, or agents who are authorized to configure, administer, or otherwise access the Services on the Customer’s behalf (e.g., building or managing an AI agent).

“End Users” means the individuals who interact with a Customer’s AI agent through the Channels (for example, a member of the public chatting with a Customer’s website chatbot or calling a Customer’s IVR line). End Users are not Zammo’s customers, and in most cases have no direct relationship with Zammo.

“Personal Information” or “PII” means any information that identifies, relates to, or could reasonably be linked with an identified or identifiable individual. This includes, without limitation: name; email address; postal address; phone number; billing and payment information; device and online identifiers (e.g., IP address, cookie identifiers); approximate geolocation; voice recordings and voice data collected through IVR Channels; and the content of conversations or transcripts exchanged with an AI agent to the extent they contain any of the foregoing. Personal Information may also include professional or employment-related information (such as employer name, job title, or business contact information), account credentials, authentication information, information submitted through support requests, and information provided through forms, demonstrations, webinars, or other interactions with Zammo.

“Usage Data” means information about use of the Services that has been aggregated and/or de-identified such that it does not identify, and cannot reasonably be used to re-identify, any individual. Usage Data is not Personal Information. Usage Data may include information regarding performance, functionality, usage trends, and interactions with the Services.

“Customer Account Data” means Personal Information relating to Authorized Users and other individuals identified in connection with the creation, administration, or billing of a Customer’s account.

“End User Conversation Data” means Personal Information relating to End Users that is collected or generated through their interactions with a Customer’s AI agent via the Channels, including conversation transcripts and voice recordings.

2. OUR ROLE: CONTROLLER VS. PROCESSOR

For Customer Account Data, and for Personal Information we collect for our own marketing, website operations, customer support, security, and business operations, Zammo generally acts as a controller (or “business” under applicable U.S. state privacy laws), meaning Zammo determines the purposes and means of processing such information.

For End User Conversation Data and other Personal Information processed through a Customer’s configuration and use of the Services, Zammo generally acts as a processor (or “service provider”/“processor” under applicable law) on behalf of the Customer. In these circumstances, the Customer determines the purposes and means of processing, including how the AI agent is configured, what information the AI agent collects, and how such information is used.

Our processing of Personal Information on behalf of Customers is governed by applicable agreements with our Customers, which may include a Data Processing Agreement or other data processing terms. To the extent of any conflict between such applicable agreement and this Privacy Policy, the applicable agreement will control.

Customers are responsible for:

• determining the appropriate purposes and legal bases for their use of the Services;

• configuring their AI agents and Channels appropriately;

• providing any required notices or disclosures to End Users; and

• ensuring that their use of the Services complies with applicable privacy, data protection, and sector-specific laws.

If you interact with a Customer’s AI agent and have questions regarding the Customer’s collection or use of your Personal Information, please contact the applicable Customer directly.

3. INFORMATION WE COLLECT

3.1 Customer Account Data

When an Authorized User creates or manages a Customer account, we collect information necessary to administer and support that account, including information such as name, email address, company name, job title, and phone number.

We may also collect information about other individuals identified by an Authorized User in connection with the Customer account, such as additional authorized contacts, administrators, billing contacts, or other individuals authorized to access or manage the Services.

3.2 Information You Provide to Us

When you interact directly with Zammo, including when you request information about our products, request a demonstration, communicate with our sales or support teams, participate in webinars or events, complete forms, provide feedback, or otherwise contact us, we may collect Personal Information such as:

• contact information, including name, email address, postal address, and telephone number;

• professional information, including employer name, organization, job title, department, and role;

• account credentials and authentication information;

• communications with Zammo, including support requests, feedback, and other correspondence;

• information submitted through forms, demonstrations, surveys, webinars, events, or other interactions with Zammo; and

• billing and payment information, including billing address, shipping address, and payment card information, when purchasing subscriptions or otherwise engaging in transactions with Zammo.

Billing and payment information may be processed by third-party payment processors on Zammo’s behalf. Payment card information is used solely to process transactions, verify financial qualification, and collect payment. Payment processors are not permitted to retain or use payment information except as necessary to provide payment processing services or as required by law.

3.3 End User Conversation Data

When End Users interact with a Customer’s AI agent through the Channels, we process the content of those interactions — including text messages, voice recordings, and any Personal Information an End User chooses to share — solely as necessary to provide the Services to the Customer, and in accordance with the Customer’s instructions and our DPA with that Customer. Zammo does not control what a Customer’s AI agent asks End Users to provide, and Customers are responsible for ensuring their own use of the Services, including any data collected from End Users, complies with applicable law. Customers may have the ability to enable certain privacy-enhancing features, such as Personal Information filtering or obfuscation tools. Customers are responsible for configuring such features based on their own requirements.

3.4 Information Collected Automatically

We may automatically collect limited technical information (such as IP address, browser type, device identifiers, and log data) in connection with use of the Services, our website, and our administrative dashboards, for security, analytics, and product-improvement purposes. We may use third-party analytics providers, including Google Analytics and product analytics providers such as Pendo, to understand usage of our websites and Services.

4. AI PROCESSING AND MODEL PROVIDERS

4.1 How the AI Agent Works

The Services use generative artificial intelligence to interpret End User input and generate responses based on the Customer’s own configured data and content. To generate these responses, conversation content is processed by a third-party large language model provider acting as our subprocessor.

4.2 Current Model Provider

As of the date of this Policy, Zammo uses Microsoft Azure OpenAI Service to provide generative AI functionality within the Services. Depending on Customer configuration and selected Channels, Zammo may also use third-party providers for communications, speech recognition, transcription, or voice processing, including Twilio and Microsoft Azure Communication Services.

Zammo intends to offer additional or alternative AI model providers in the future. When we do, we will update this section to identify the additional provider(s) before making them available.

4.3 No Use of Customer or End User Data to Train AI Models

Zammo does not use Customer Account Data or End User Conversation Data to train, fine-tune, or otherwise improve any AI model (including Azure OpenAI). Zammo may use aggregated or de-identified information to analyze, maintain, secure, and improve the Services.

4.4 AI Transparency

Customers are responsible for providing appropriate disclosures to End Users regarding interactions with AI-powered agents. Zammo provides functionality that enables Customers to disclose that an End User is interacting with an automated AI system rather than a human.

4.5 Automated Decision-Making

Zammo does not independently make decisions regarding End Users using the Services. Customers determine how they configure and use AI agents, including whether an AI agent is used in connection with decisions that may produce legal or similarly significant effects.

Customers are solely responsible for ensuring that their configuration and use of AI Agents comply with applicable laws relating to automated decision-making, including any requirement to provide human review or intervention, disclose the use of automated decision-making to affected individuals, or allow individuals to contest or appeal a decision. The Services do not include a built-in human-review or approval feature; any such mechanism must be implemented by Customer as part of its AI Agent configuration.

5. HOW WE USE INFORMATION

We use Personal Information for the following purposes:

• To provide, operate, maintain, and support the Services, including configuring and managing Customer accounts and AI agents;

• To process transactions, including billing, subscription management, payment processing, and collections;

• To communicate with Customers and Authorized Users regarding the Services, including service updates, security notices, technical notices, and changes to this Policy or our agreements;

• To respond to inquiries, provide customer support, and troubleshoot issues;

• To monitor, analyze, and improve the performance, reliability, security, and functionality of the Services, including through the use of Usage Data and Customer Account Data as necessary to operate and support Customer accounts;

• To develop, maintain, and improve the Services, including through the use of aggregated, de-identified, or otherwise non-identifying information derived from use of the Services; Zammo does not use Customer Account Data or End User Conversation Data to train, fine-tune, or improve artificial intelligence models;

• To detect, investigate, prevent, and address fraud, security incidents, misuse, and violations of our agreements; and

• To comply with applicable legal obligations and enforce our rights and agreements.

6. HOW WE DISCLOSE INFORMATION

We may disclose Personal Information as follows:

Service Providers and Subprocessors. We disclose Personal Information to vendors, contractors, and service providers that process information on our behalf to provide and support the Services. These parties may include:

• cloud infrastructure providers, including Microsoft Azure;

• artificial intelligence and machine learning service providers, including Microsoft Azure OpenAI Service;

• communications providers, including Twilio, Microsoft Teams, WhatsApp, Slack, Facebook Messenger, and SMS providers;

• payment processors;

• analytics and product performance providers; and

• other vendors that provide technical, operational, or business support services.

These providers are contractually required to use Personal Information only as necessary to provide services to Zammo and are subject to confidentiality and data protection obligations.

Customer-Directed Disclosures. When Zammo processes End User Conversation Data on behalf of a Customer, Zammo may disclose such information only as instructed by the Customer or as necessary to provide the Services.

Legal and Safety Reasons. We may disclose Personal Information where we believe disclosure is necessary to comply with applicable law, legal process, governmental requests, protect the rights or safety of Zammo, our Customers, users, or others, or investigate fraud, security incidents, or misuse.

Business Transfers. We may disclose Personal Information in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction involving all or part of Zammo’s business.

With Consent. We may disclose Personal Information where you direct us or provide consent.

Zammo does not sell Personal Information.

Subprocessor List

A current list of subprocessors used by Zammo can be requested through Zammo's Trust Center at https://app.vanta.com/zammo.ai/trust/f6m6n103tjgfhpjlq7uc8x. Customers may also request additional information regarding Zammo's security and privacy practices through the Trust Center or by contacting Zammo's Legal Department.

7. SECURITY

We maintain administrative, technical, and physical safeguards designed to protect Personal Information from unauthorized access, use, disclosure, alteration, or destruction. These safeguards include measures such as encryption of data in transit (including TLS/SSL), access controls, authentication requirements, monitoring, and security practices designed to protect information hosted on Microsoft Azure infrastructure.

No method of transmission or storage is completely secure. While we work to protect Personal Information, we cannot guarantee its absolute security.

8. DATA RETENTION

We retain Personal Information only for as long as reasonably necessary to fulfill the purposes described in this Policy, provide the Services, comply with legal obligations, resolve disputes, enforce agreements, and protect our legitimate business interests.

For Zammo Agents on SaaS, End User Conversation Data is retained according to the Customer’s configuration and instructions, including applicable agreements with the Customer. Unless otherwise agreed, Zammo may retain such data for up to 60 days following termination of the Customer’s subscription to facilitate transition, dispute resolution, backups, or legal obligations, after which the data will be deleted or de-identified.

For the ZOT Software, End User Conversation Data is stored on the Customer’s own Azure tenant and retained in accordance with the Customer’s own configuration and retention practices, not Zammo’s. Deleting the Zammo Managed Application removes the Zammo application and associated Customer-controlled data stored within the Customer’s Azure tenant, subject to any retention mechanisms or backups maintained by the Customer or Azure.

9. INTERNATIONAL DATA TRANSFERS

The Services are primarily operated for Customers and End Users located in the United States and Canada, and Personal Information is generally processed and stored in the United States. Where required, Zammo uses appropriate safeguards for international transfers, such as contractual protections or other mechanisms recognized under applicable law.

10. CHANNELS

Customers may configure their AI agents to interact with End Users through third-party communication channels, including website chat, Microsoft Teams, WhatsApp, Slack, Facebook Messenger, SMS, IVR via Twilio, and IVR via Microsoft Azure Communication Services (collectively, the “Channels”). These Channels are operated by third-party providers that may independently collect, use, retain, or otherwise process information exchanged through their platforms pursuant to their own privacy policies and terms.

Zammo provides integrations with these Channels solely to enable the functionality of the Services. Zammo does not control the privacy practices or data processing activities of third-party Channel providers. Customers and End Users should review the applicable privacy policies and terms of the relevant Channel providers to understand how those providers process information. To the extent Zammo processes information exchanged through these Channels on behalf of a Customer, such processing is governed by Zammo’s agreement with that Customer, including any applicable Data Processing Agreement.

11. CHILDREN AND AGE REQUIREMENTS

The Services are intended for use by Customers and Authorized Users who are at least 18 years old. Zammo does not knowingly collect Customer Account Data directly from individuals under 18.

End Users may interact with Customer-configured AI agents through public-facing Channels, such as a website chatbot, messaging platform, or voice channel. Because Customers control how their AI agents are configured and deployed, Zammo generally does not determine whether an End User is permitted to interact with a Customer’s AI agent or what information a Customer’s AI agent collects from End Users.

Customers are responsible for ensuring that their use of the Services, including their collection and use of End User information, complies with applicable laws relating to children’s privacy, including the Children’s Online Privacy Protection Act (“COPPA”) and similar applicable laws.

If Zammo becomes aware that it has directly collected Personal Information from a child under 13 in a manner that violates applicable law, Zammo will take reasonable steps to delete such information. Parents or guardians who believe that a child has provided Personal Information directly to Zammo may contact us using the information provided in Section 17.

12. USE BY DEVELOPERS AND AGENTS ON BEHALF OF THIRD PARTIES

If an Authorized User accesses or uses the Services on behalf of another person or organization (for example, as a developer, consultant, or agency building an AI agent for a Customer or third party), such Authorized User represents and warrants that it has all necessary rights and authority to provide information to Zammo and configure or use the Services on behalf of that Customer or third party.

Zammo processes information provided through such use in accordance with this Policy, applicable agreements with the Customer, and any applicable Data Processing Agreement.

If Zammo becomes aware that an Authorized User is not authorized to act on behalf of a Customer or third party, Zammo may suspend or terminate access to the Services and take reasonable steps to address the unauthorized use.

13. PRIVACY RIGHTS FOR US RESIDENTS

Depending on where you live, you may have certain rights regarding the Personal Information we collect and process about you under applicable U.S. state privacy laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA/CPRA”), and similar laws in other states.

These rights may apply differently depending on the nature of our relationship with you. For example, Zammo generally acts as a controller/business with respect to Customer Account Data and Personal Information collected through our websites, sales activities, and business operations. For End User Conversation Data processed on behalf of a Customer, Zammo generally acts as a processor/service provider, and the applicable Customer is responsible for responding to privacy requests regarding such information.

Subject to certain exceptions and limitations under applicable law, you may have the right to:

• Right to Know and Access: Request information about the Personal Information we have collected about you, including the categories of Personal Information collected, the purposes for which it was collected, the sources from which it was obtained, and the categories of third parties to whom it was disclosed.

• Right to Request a Copy: Request access to and a copy of the Personal Information we maintain about you.

• Right to Correct: Request correction of inaccurate Personal Information that we maintain about you.

• Right to Delete: Request deletion of Personal Information we have collected from you, subject to certain exceptions permitted by law.

• Right to Opt Out of Sale or Sharing: Request to opt out of the sale or sharing of Personal Information, or the use of Personal Information for certain targeted advertising purposes, where applicable.

·       Right to Opt-Out Preference Signals: Where required by applicable law, we will treat an opt-out preference signal, such as the Global Privacy Control (GPC), sent by or on behalf of your browser or device as a valid request to opt out of the sale or sharing of your Personal Information.

• Right to Limit Use of Sensitive Personal Information: Request limitations on the use or disclosure of Sensitive Personal Information where applicable under applicable law.

• Right to Non-Discrimination: Not receive discriminatory treatment for exercising your privacy rights.

You may also have additional rights depending on your state of residence, including rights to data portability, restriction of processing, objection to certain processing activities, withdrawal of consent where processing is based on consent, or the right to appeal our decision regarding a privacy request.

To exercise your privacy rights, please contact us using the information provided in Section 17. We may need to verify your identity before responding to your request, which may include requesting information such as your email address or other identifying information. We will use Personal Information provided for verification purposes only as necessary to process your request.

You may designate an authorized agent to submit a request on your behalf where permitted by applicable law. We may require documentation verifying the agent’s authority and may require you to verify your identity directly with us.

We will not discriminate against you for exercising your privacy rights. We will respond to requests within the timeframes required by applicable law. If we deny your request, you may have the right to appeal our decision by contacting us using the information provided in Section 17.

13.1 Notice for California Residents

This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”).

In the preceding twelve (12) months, Zammo may have collected the following categories of Personal Information: