Privacy Policy

This Privacy Policy (“Privacy Policy”) explains how Sesame AI, Inc. and its affiliates (“Sesame”, “Company”, “we”, “our” or “us”) collects, processes, stores, uses and shares information gathered about users of our website, application, products and services, including our virtual conversational agents and AI models (collectively, the “Service(s)”).

We have designed this Privacy Policy to identify how we collect, use, store and share your Personal Information.

This Privacy Policy is provided in conjunction with our Terms of Use, found at www.sesame.com/terms (the “Terms”), which governs your access and use of the Services. By using the Services, you acknowledge our collection, storage, use and disclosure of your information as described in this Privacy Policy.

IF YOU ARE A CALIFORNIA RESIDENT, PLEASE SEE SECTION 13 OF THIS POLICY, A NEVADA RESIDENT OR A RESIDENT OF ANY OTHER STATE, PLEASE SEE SECTION 14 OF THIS POLICY, OR A RESIDENT OF THE EUROPEAN ECONOMIC AREA, PLEASE SEE SECTION 15 OF THIS POLICY FOR ADDITIONAL TERMS THAT MAY APPLY TO YOU.

We obtain and process Personal Information in different capacities. When we collect or process Personal Information for our own purposes, meaning that we determine how and what Personal Information is processed, we are the data controller. This Privacy Policy applies to our collection, use, disclosure, and protection of Personal Information where we are the data controller.

For purposes of this Privacy Policy, “Personal Information” means information that alone or in combination identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

We collect certain categories of Personal Information. The information we collect and process about you depends on how you use and interact with our Services. For example, the information collected will differ based on the content you choose to provide to our Services. A summary of the categories and a description of the types of data collected in each category are as follows:

Sesame obtains the categories of Personal Information listed above from the following categories of sources:

• Directly from you. For example, from forms you complete, information you provide, or the content you submit. We ask that you refrain from providing Personal Information, either of yourself or of third parties, when interacting with our Services, unless otherwise necessary for support purposes.
• Indirectly from you. For example, from observing your actions on our Services or from information your computer or mobile device transmits when interacting with our Services.
• From third-party data sources. If you elect to connect to and interact with third-party services and applications, Sesame may access and use information contained in these third-party services and applications (“Retrieved Content”) to provide our Services. Our use and sharing of Retrieved Content may be restricted by the data policies of the service provider providing access to it. In addition, some integrations may be subject to additional Sesame terms of use specific to that integration; if additional Sesame terms apply (“API Terms”), you will be informed of the applicable API Terms when first enabling that integration, and such API Terms shall constitute part of this Privacy Policy with respect to Retrieved Content accessed via that integration. If you have agreed to share information with one of our third-party providers, they may provide us with that information or from datasets that we obtain through commercial agreements with third-party businesses. We may also receive information from our trusted partners, such as security partners to protect against fraud, abuse, and other security threats to our Services, or analytic partners, who provide us with information about our business and the Services to improve and develop the Services. We may also collect information from other sources, such as information that is publicly available on the internet. Third parties handle data according to their own privacy policies, and Sesame is not responsible for the data practices of third parties. Before enabling an integration or connecting or interacting with a third-party service or application, you should review the third party's privacy policy to confirm how they handle your information.
  
  The information we collect, use and disclose about you, and our lawful basis for doing so, will vary depending on how you interact with Sesame and the Services. Below is a summary describing the purposes for which we collect this Personal Information from you.

We retain Personal Information only as long as we have a legitimate business purpose to do so. These purposes may include retaining Personal Information in order to:

• complete the purpose for which the Personal Information was collected;
• continue our ongoing business relationship with you; and
• resolve disputes, protect rights, maintain safety and security, and comply with legal, regulatory, tax, accounting or reporting requirements.
  
  When the Personal Information collected is no longer required by us, we will perform the necessary procedures for destroying, deleting, erasing, or converting it into an anonymous form as permitted or required under applicable laws. This means, for example, that some data will be deleted or anonymized automatically after a set period of time.
  
  IF YOU ARE AN UNREGISTERED USER OF OUR SERVICES ACCESSING SUCH SERVICES SOLELY VIA OUR WEBSITE, WE WILL NOT USE YOUR USER DATA, INCLUDING PERSONAL INFORMATION, TO TRAIN OUR LANGUAGE LEARNING MODELS WITHOUT YOUR CONSENT AND WE WILL AUTOMATICALLY DELETE YOUR USER DATA, INCLUDING PERSONAL INFORMATION, WITHIN THIRTY (30) DAYS UNLESS WE HAVE A LEGITIMATE BUSINESS PURPOSE TO RETAIN SUCH DATA.
  
  IF YOU ARE A LOGGED-IN USER, SESAME RESERVES THE RIGHT TO USE ANY OF YOUR INFORMATION AND CONTENT GENERATED DURING SUCH TIME AS YOU ARE LOGGED-IN AND USING THE SERVICES, FOR ANY LEGITIMATE BUSINESS PURPOSE, INCLUDING WITHOUT LIMITATION, TO TRAIN ANY OF OUR LANGUAGE LEARNING MODELS OR OTHERWISE (UNLESS YOU ELECT TO OPT OUT OF TRAINING THROUGH YOUR ACCOUNT SETTINGS). FURTHERMORE, SESAME RESERVES THE RIGHT TO RETAIN YOUR INFORMATION AND CONTENT FOR SO LONG AS IS PERMISSIBLE UNDER APPLICABLE LAW.

As further detailed herein, we may share your Personal Information when required by law, or with third parties that perform functions on our behalf or for whom we perform services. We may also share information to protect the interests of individuals or in connection with a sale of our business or a merger or acquisition. The information we collect, use and disclose about you will vary depending on how you interact with Sesame and Services. Described below is a summary of who we may share your Personal Information with.

We will also collect your Personal Information and deploy cookies and similar technologies, as further described in Section 7 below.

We may use cookies, beacons, tags, pixels, SDKs, session replay and other tracking technologies on our Services (“Cookies”) to operate the Services, to gather analytical data about use of the Services, and to further your use and enjoyment of the Services. We will obtain your consent prior to deploying any cookies that are not “strictly necessary” (e.g. functional, analytical or advertising cookies).

Information collected may include Personal Information, including IP addresses, digital identifiers, information about your web browsing and app usage and how you interact with our Services for a variety of purposes, such as personalization, analytics about how you engage with the Services, supporting the operation, maintenance, and improvement of our Services, and other legitimate business purposes

Further information about Cookies, including how to see what cookies have been set on your computer or mobile device and how to manage and delete them, visit www.allaboutcookies.org.

Google Analytics
We use a tool called “Google Analytics” to collect information about use of the Services across devices to support operation, maintenance, and improvement of our Services. You can learn about Google's practices by going to https://www.google.com/policies/privacy/partners/. You can opt out of Google Analytics without affecting how you visit the Services. For more information on opting out of being tracked by Google Analytics, visit this Google page.

Statements regarding our practices do not apply to the methods for collecting information used by these third parties or the use of the information that such third parties collect. We do however work with third parties to make efforts to have you provided with information on their practices and any available opportunity to exercise choice. We make no representations regarding the policies or practices of third parties.

• Updating your Personal Information. If your Personal Information changes, or if you no longer desire our Services, you can delete your account by following prompts in the user administrative console or you may request to correct, update, amend, or delete/remove it by emailing us at support@sesame.com. We will respond to your request within a reasonable timeframe.
• Disabling Cookies. Most browsers automatically accept Cookies. You can disable this function by changing your browser settings but disabling Cookies may impact your use and enjoyment of the Services. You cannot disable all Cookies, such as Cookies that are essential to the functioning of the Services. You can manually delete persistent Cookies, or Cookies that track your activity across websites, through your browser settings.
• Opt-Out of Email Marketing. If for any reason you would no longer like to receive email marketing messages from us, you may unsubscribe by following the instructions contained within our promotional emails. Please allow up to ten (10) days for us to process your request. Please note, if you opt not to receive marketing emails from us, you may still receive “transactional” email messages regarding your use of the Services. To opt-out of receiving our direct mail, you may send us an email at support@sesame.com
• Do Not Track. Some web browsers incorporate a “Do Not Track” (“DNT”) or similar feature that signals to websites that a user does not want to have the user’s online activity and behavior tracked. If a website that responds to a particular DNT signal receives the DNT signal, the browser can block that website from collecting certain information about that browser’s user. Not all browsers offer a DNT option and DNT signals are not yet uniform. For this reason, the Services may not respond to DNT signals.

When you leave our Services and go to another linked website, we are not responsible for the content or availability of the linked website. Please be advised that we do not represent either the third party or you, if you enter into a transaction on the third-party site. Further, the privacy and security policies of the linked site may differ from ours. We do not accept any responsibility or liability for their websites, features or policies. Please read their privacy policies before you submit any data to them.

We use reasonable technical, administrative, and physical safeguards to maintain the security and privacy of Personal Information we collect and use. When disclosing Personal Information, you should remain mindful that there is always risk in sending Personal Information using the internet.

Sesame does not undertake, and it is not feasible, to review all Content, though we reserve the right and may choose to monitor or review Content to, among other things, address user and third-party safety and data security. However, to maintain the integrity and security of your data, and for fraud prevention purposes, Sesame reserves the right to moderate all voice and text data input into Sesame’s tools and voice or other outputs. In certain circumstances, Sesame may share your Input or other Content, which may include Personal Data, with third parties or submit your Content to moderation tools (such as a third-party application programming interface) to support our content moderation and safety initiatives. Users found to have engaged in activity that violates prohibited uses as provided in the Terms of Use or otherwise may be subject to termination or suspension.

We may aggregate or de-identify Personal Information we collect through our Services and when operating our business so that it no longer identifies you. For example, we may aggregate Personal Information to calculate the percentage of users in a particular zip code or de-identify (or fully remove) data included in a dataset that could identify you with your audio or related content. Once information or data has been de-identified and/or aggregated, such information is no longer Personal Information. This means we may share it with third parties and may use this de-identified / aggregated data for our legitimate business purposes, such as for the purposes described above, to analyze the way our Services are being used, improve and add features to them, to train our models and to conduct research. We will maintain and use de-identified information in de-identified form and not attempt to reidentify the information, unless required by law.

Our Services are operated in the United States and intended for users located in the United States. Like almost every website, our website can be accessed by an international audience. If you are located outside of the United States, please be aware that information we collect, including personal information, will be transferred to, processed, stored and used in the United States. The data protection laws in the United States may differ from those of the country in which you are located, and your personal information may be subject to access requests from governments, courts, or law enforcement in the United States according to laws of the United States. In addition, such data may be stored on servers located outside your resident jurisdiction and in jurisdictions that may have less stringent privacy practices than your own.

If you are a California resident, you have the rights outlined in this section, and in accordance with the California Consumer Privacy Act (“CCPA”), as amended. Please see the “Exercising Your Rights” sub-section below for instructions regarding how to exercise these rights. If there are any conflicts between this section and any other provision of this Privacy Policy and you are a California resident, the portion that is more protective of your Personal Information shall control.

Right to Access
You have the right to request certain information about our collection and use of your Personal Information over the past twelve (12) months. Assuming verification of your identity, we will provide you with the following information:

• The categories of Personal Information that we have collected about you.
• The categories of sources from which that Personal Information was collected.
• The business or commercial purpose for collecting, selling, or sharing your Personal Information.
• The categories of third-parties with whom we have shared your Personal Information.
• The specific pieces of Personal Information that we have collected about you.
• If we have disclosed your Personal Information for a business purpose over the past twelve (12) months, we will identify the categories of Personal Information shared with each category of third-party recipient.

If we have sold your Personal Information over the past twelve (12) months, we will identify the categories of Personal Information purchased by each category of third-party recipient.

Right to Deletion
You have the right to request that we delete the Personal Information that we have collected from you (or your household). Note that this deletion right does not include Personal Information we have collected from third-party sources. Furthermore, under the CCPA, this deletion right is subject to certain exceptions: for example, we may need to retain your Personal Information to provide you with services or complete a transaction or other action you have requested. If your deletion request is subject to one of these exceptions, we may deny your deletion request.

Exercising Right To Access and/or Right to Deletion
If you are a California resident, and to exercise the rights described above, you (or someone acting under your express authorization) must send us a request that (a) provides sufficient information to allow us to verify that you are the person about whom we have collected Personal Information, and (b) describes your request in sufficient detail to allow us to understand, evaluate, and respond to it. If someone is submitting a request on your behalf, they must further (c) provide proof that they are authorized to act for you in this regard. In some cases, we may request additional information (such as your phone number or email address) in order to verify your request. If we cannot verify your identity, we will be unable to process your request to know/access, correct or delete.

Each request that meets both of these criteria will be considered a “Valid Request”. We may not respond to requests that do not meet these criteria. We will only use Personal Information provided in a Valid Request to verify you and complete your request. You do not need an account to submit a Valid Request.

We will work to respond to your Valid Request within forty-five (45) days of receipt. If we are not able to respond to your request within forty-five (45) days, we will let you know that we may need additional time to respond, up to ninety (90) total days. We will not charge you a fee for making a Valid Request unless your Valid Request(s) is excessive, repetitive, or manifestly unfounded. If we determine that your Valid Request warrants a fee, we will notify you of the fee and explain that decision before completing your request.

Right to Opt-Out of “Sale” or “Sharing” of Personal Information
The CCPA defines “sale” to include sharing or disclosing of Personal Information with a third-party for monetary or other valuable consideration. The California Privacy Rights Act (CPRA) further defines “sharing” as disclosing, making available, transferring, or communicating a consumer’s Personal Information to a third party for “cross-context behavioral advertising”, whether or not for monetary or other valuable consideration.

There are circumstances where disclosure of Personal Information with third-parties is not considered to be a sale. For example, we may disclose Personal Information with service providers who work on our behalf if the service provider agrees not to use that Personal Information for other purposes. In addition, you may intentionally direct us to disclose information to a third-party, which is also not a sale

We do not “sell” or “share” (as those terms are defined under the CCPA and CPRA) Personal Information, nor have we done so in the preceding 12 months. Further, we do not have actual knowledge that we “sell” or “share” Personal Information of residents under 16 years of age.

Right to Correct Inaccurate Personal Information
The CCPA provides California residents with the right to request the correction of inaccurate Personal Information kept by businesses. Upon submission of a valid request by a California resident, and verification by us of the same, we shall use commercially reasonable efforts to correct inaccurate Personal Information identified by you.

No Discrimination For Exercising Your Rights
We will not discriminate against you for exercising your rights under the CCPA. We will not deny you our goods or services, charge you different prices or rates, or provide you a lower quality of goods and services if you exercise your rights under the CCPA. However, we may offer different tiers of our services as allowed by applicable data privacy laws (including the CCPA) with varying prices, rates, or levels of quality of the goods or services you receive related to the value of persona data that we receive from you.

Authorized Agents
Authorized agents may also submit requests to us in the same way that individuals can submit requests. We may request that any authorized agents verify their identity, including by providing information about themselves, such as their name, email, phone number, and address. We may also contact consumers directly to confirm the authority of the authorized agent.

California Shine the Light Act
California Civil Code Section 1798.83 permits customers of a company who are California residents to request and obtain from us once a year, free of charge, information about the personal information (if any) we disclosed to third parties for the third parties’ direct marketing purposes in the preceding calendar year. If applicable, this information would include a list of the categories of Personal Information that was shared and the names and addresses of all third parties with which we shared information in the immediately preceding twelve (12) calendar months.

California Invasion of Privacy Act
By using or accessing the Services, you hereby consent to our collection, use, and disclosure of your information consistent with this Privacy Policy, to the extent such information falls under any provision of the California Invasion of Privacy Act.

If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Information to third-parties who intend to license or sell that Personal Information. You can exercise this right by contacting us at support@sesame.com with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your Personal Information.

Please note we will take reasonable steps to verify your identity and the authenticity of the request. Once verified, we will maintain your request in the event our practices change.

We will respond to verified requests within sixty (60) days after we receive the request and may need to extend our response by up to thirty (30) days.

If you are a resident of a state in the United States not otherwise mentioned in this Privacy Policy, we shall use our best efforts to honor your request to either delete, restrict the use of your Personal Information and opt-out of the sharing of your Personal Information with third parties.

If you are a resident in the European Economic Area (“EEA”), Switzerland or the United Kingdom (collectively, “Europe” and each such user, a “Data Subject”), you may have the following rights under the EU General Data Protection Regulation, the UK General Data Protection Regulation, UK Data Protection Act 2018, and related data protection laws in Europe (collectively, the “GDPR”) in relation to your Personal Information:

• Request access to your Personal Information;
• Request correction of the Personal Information that we hold about you;
• Request erasure of your Personal Information;
• Object to processing of your Personal Information;
• Request restriction of processing of your Personal Information;
• Request the transfer of your Personal Information to you or to a third party; and
• Withdraw consent at any time where we are relying on consent to process your Personal Information.

We do not direct or target our Services to children under the age of 13. If we learn that we have collected the Personal Information of anyone under the age of 13, we will take appropriate steps to delete this information. If you are a parent or guardian of someone under the age of 13 and discover that your child has submitted Personal Information to us, please contact us at support@sesame.com. We will make reasonable efforts to remove such information from our databases.

We may revise this Privacy Policy from time to time. If we decide to change our Privacy Policy, we will post the revised policy here. If we make any material changes, we will notify you by email (to the extent we have your email) or by means of a notice on the top of this Policy or the top of the website or within the Services.

If you have any questions about the Privacy Policy or how we process Personal Information, please contact us at support@sesame.com.

We will periodically review and update this Privacy Policy and reserve the right to change or update it.