Privacy Policy

1. About This Policy

1.1This Privacy Policy explains how Altrivis Management LLC, a Texas limited liability company having its registered office at 5900 Balcones Drive, Suite 100, Austin, Texas 78731, United States ("Altrivis", "we", "us" or "our"), collects, uses, discloses and protects personal information in connection with the SphereOne website at www.sphereone.ai (the "Site") and the SphereOne platform and applications (the "Services").

1.2This Policy consists of a global section (Sections 1 to 15), which applies to everyone, and supplements for residents of certain US states (Supplement A), the European Economic Area, United Kingdom and Switzerland (Supplement B) and India (Supplement C). Where a supplement applies to you, it prevails over the global section to the extent of any inconsistency.

2. Our Role: Controller and Processor

2.1Where we decide. We act as the controller (or "business") of personal information that we collect for our own purposes: information about visitors to our Site, the account and billing information of our customers and their administrators, support and sales communications, marketing, and security and usage information.

2.2Where our customer decides. SphereOne is used by organisations (our "Customers") to communicate and work with their employees, contractors and clients. The messages, files, meeting information, tasks, contacts and other content that Customers and their users put into the Services ("Customer Data") are processed by us on behalf of the Customer, and the Customer is the controller of that information. Our processing of Customer Data is governed by our agreement with the Customer, including our Data Processing Addendum.

2.3If you use SphereOne through your employer or another organisation, that organisation's privacy notice governs its use of your information, and requests to access, correct or delete Customer Data should be directed to that organisation. If you contact us, we will refer your request to the Customer and assist it as required by law.

3. Information We Collect

3.1Information you give us:

• (a)Account information: name, business email address, password (stored in hashed form), job title, organisation name, profile photo and preferences;
• (b)Billing information: billing contact details, billing address, plan and transaction history. Payment card details are collected and processed directly by our payment processor, Stripe, and we do not store full card numbers;
• (c)Communications: information you provide when you contact us for support or sales, respond to surveys, or register for events or webinars;
• (d)Content in the Services: messages, chats, files, comments, tasks, contact and relationship records, meeting titles and invitations, calendar entries, prompts submitted to AI features, and voice recordings sent for transcription (see Section 5.6). This is Customer Data (see Section 2.2).

3.2Information collected automatically:

• (a)Device and log information: IP address, browser type, device type, operating system, app version, time zone, pages and features used, dates and times of access, and error logs;
• (b)Meeting and call information: participants, join and leave times, duration, connection quality data and the device used. The content of audio and video streams is transmitted in real time to enable the call and is not recorded or stored by us. If you turn on live captions, your own speech is transcribed as described in Section 5.6;
• (c)Push notification tokens: identifiers issued by Apple or Google that allow us to send notifications to your device;
• (d)Precise location: only where your organisation's administrator has enabled location-based access controls. In that case the app will request permission to access your device's precise location at sign-in and at intervals during use, to check whether you are within an area approved by your organisation. Where you refuse permission, access to that Workspace may be refused;
• (e)Cookies and similar technologies: as described in our Cookie Policy.

3.3Information from third parties:

• (a)Integrations: if you connect a third party service, such as a calendar provider, we receive the information that service makes available under the permissions you grant, for example calendar events and attendee details;
• (b)Your organisation: your administrator may create your account and supply your name, email address and role;
• (c)Sign-in providers: if you sign in using Google, Microsoft or Apple, we receive your name and email address from that provider;
• (d)Business contact sources: we may receive business contact information about prospective customers from publicly available sources and business partners.

4. How We Use Information

4.1We use personal information to:

• (a)provide, operate and maintain the Services, including delivering messages, hosting meetings, storing files and syncing calendars;
• (b)create and administer accounts, authenticate users and enforce access controls chosen by the Customer;
• (c)provide AI features requested by users, as described in Section 5;
• (d)send service communications, including push notifications, security alerts, and billing and account notices;
• (e)process payments and manage subscriptions;
• (f)provide customer support;
• (g)monitor and improve the performance, reliability and security of the Services, and detect, prevent and respond to fraud, abuse and security incidents;
• (h)send marketing communications to business contacts, where permitted by law, subject to your right to opt out;
• (i)comply with legal obligations, enforce our agreements and establish, exercise or defend legal claims; and
• (j)in connection with a merger, acquisition, financing or sale of assets, subject to confidentiality obligations.

4.2We do not sell personal information, and we do not use Customer Data for advertising.

5. Artificial Intelligence Features

5.1SphereOne includes AI features, including SphereOne Assist, which can summarise conversations, draft replies and answer questions about content in your Workspace, and semantic search, which helps users find relevant content.

5.2To provide these features, the relevant content and prompts are sent to our AI service providers, currently Google (Gemini API) and OpenAI, which process them to generate a response and return it to us.

5.3To enable semantic search, we create and store a searchable index derived from messages and other content in the Workspace. This index is a copy of Customer Data held in a different form. It is stored with the same protections as the original content and is deleted when the underlying content or Workspace is deleted.

5.4We do not use Customer Data to train AI models, and our agreements with our AI service providers do not permit them to use it to train their models. Our AI service providers may retain inputs and outputs for a limited period, not exceeding ______ days, for abuse monitoring, after which they are deleted.

5.5AI features do not make decisions about individuals that produce legal or similarly significant effects. Outputs are suggestions that users review and choose whether to use. Further information is given in our AI Usage and Disclosure Policy.

5.6Voice input. In the web application you can dictate messages, speak requests to the assistant and turn on live captions in calls. Where your browser can recognise speech itself (for example Chrome, Edge or Safari), it does so: your voice is processed by the browser and its provider under their own terms and does not pass through SphereOne. Where it cannot (for example Firefox), and AI features are switched on for your Workspace, a recording of what you say is sent to our servers and transcribed by OpenAI, and the text is returned to your device. A recording is sent only while you are dictating or have captions on, never while you are muted in a call, and not at all when no speech is detected in it. We do not store the recordings. Caption text is shown only to you and is not stored, and dictated text becomes part of a message only if you send it. Recordings are not used to identify you by your voice. Section 5.4 applies to them as it does to other inputs.

5.7"Only my voice" voiceprints. If you turn on "Hey SphereOne" in the web application, Sphere listens for its name on your device. You can also train it to respond only to your voice: you say "Hey SphereOne" four times, and those recordings are turned into a voiceprint, a set of numbers that describes your voice. A voiceprint is biometric information, and we handle it as follows:

• (a)Consent. A voiceprint is created only after the application has shown you what it is and how it is kept, and you have chosen "I agree, start". We ask again each time you retrain.
• (b)On your device only. The recordings and the voiceprint are processed only in your browser. The recordings are discarded as soon as the voiceprint is made, and the voiceprint is stored only in that browser on that device. It is never sent to us, to our service providers or to anyone else, and we cannot see, access, copy or restore it.
• (c)Purpose. The voiceprint is used only to check that the person saying "Hey SphereOne" is you, so that Sphere does not respond to other people. It is not used to identify anyone, and we do not sell, lease, trade or otherwise profit from it.
• (d)Retention and destruction. The voiceprint is permanently deleted from your device when you delete it in Sphere's settings, when you retrain (the new voiceprint replaces it), when you turn off "Hey SphereOne", when you sign out of SphereOne in that browser, when you refuse functional cookies or clear the browser's data for SphereOne, and in any event automatically after twelve (12) months in which it has not been used.
• (e)What you say after "Hey SphereOne" is handled as voice input under Section 5.6.

6. How We Disclose Information

6.1We disclose personal information only as follows:

• (a)Within your Workspace: content you post is visible to other users in accordance with the Workspace settings. Administrators can access and manage information in their Workspace, including user accounts and content, as permitted by the Customer's settings;
• (b)Service providers (sub-processors): we use trusted providers for hosting, AI processing, email delivery, push notifications, payments, customer support and analytics. They may process personal information only on our instructions and under contractual obligations of confidentiality and security. Our current list is published at www.sphereone.ai/subprocessors;
• (c)Integrations you enable: when you connect a third party service, we exchange information with it as needed for the integration;
• (d)Legal and safety: where we believe in good faith that disclosure is required by law, subpoena or court order, or is necessary to protect the rights, property or safety of Altrivis, our users or others. We handle requests from government authorities in accordance with our Content Moderation and Copyright Policy;
• (e)Business transfers: to a buyer, successor or financing party in connection with a merger, acquisition, reorganisation or sale of assets, subject to this Policy; and
• (f)With consent: where you ask us to or consent to the disclosure.
• (g)Websites linked in messages: when a message contains a link, our servers fetch that page to show a preview, and your device loads the preview image from the linked website, which receives your device's IP address and browser details, as any website you visit does.

7. Push Notifications

7.1Notifications sent to your mobile device are delivered through Apple Push Notification service or Google Firebase Cloud Messaging. By default, a notification may include the sender's name and a preview of the message text. You can turn off message previews or notifications in the app settings or in your device settings.

8. International Transfers

8.1We are based in the United States, and our Services are hosted on Amazon Web Services in the United States (region: US East (N. Virginia), us-east-1). Our team and service providers may access information from other countries, including India. Where we transfer personal information across borders, we use appropriate safeguards required by applicable law, as described in the supplements below.

9. Retention

9.1We keep personal information only for as long as needed for the purposes described in this Policy, including to meet legal, accounting and reporting requirements.

9.2Customer Data is retained for the duration of the Customer's subscription, subject to retention settings chosen by the Customer, and is deleted within thirty (30) days after the end of the post-termination export period, except where retention is required by law. Backup copies are overwritten within fourteen (14) days.

9.3Account and billing records are kept for seven (7) years after the end of the relationship for tax and legal purposes. Security logs are kept for ninety (90) days. Precise location data used for access checks is kept only where location-based access controls are enabled, only on the current session and only as the most recent check; it is removed when the controls are switched off, when the session ends, and in any case after thirty (30) days without a check.

9.4When you delete your account, or a workspace administrator deletes it, we delete your sign-in credentials and your profile — your name, email address, photo and contact details — straight away. Messages, files and meetings you shared in a workspace are Customer Data that belongs to that workspace: they stay in it, shown as "Deleted user", until the Customer deletes them or the workspace itself is deleted. If you are the only member of a workspace when you delete your account, the workspace and everything in it are deleted with it.

10. Security

10.1We use administrative, technical and physical safeguards designed to protect personal information, including encryption of data in transit, access controls limited to personnel who need access, and monitoring for security events. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your Choices and Rights

11.1You may update your account information in your profile settings. You may opt out of marketing emails at any time by using the unsubscribe link in the email or by writing to support@sphereone.ai. We will still send you service communications.

11.2Depending on where you live, you may have rights to access, correct, delete or obtain a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. These rights are explained in the supplements below. You may exercise them by writing to support@sphereone.ai. We will verify your identity before acting on a request, and we will not discriminate against you for exercising your rights.

12. Children

12.1The Services are intended for business use by persons aged 18 and above. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 13 (or a higher age where local law so provides), we will delete it.

13. Do Not Track and Global Privacy Control

13.1Our Site does not respond to "Do Not Track" browser signals, as there is no common industry standard for them. We do honour the Global Privacy Control signal as a valid request to opt out of any sale or sharing of personal information, where such an opt-out is available under applicable law.

14. Changes to This Policy

14.1We may update this Policy from time to time. We will post the updated Policy with a new "Last updated" date, and, where the changes are material, notify Customers by email or through the Services before they take effect.

15. Contact Us

15.1Questions or complaints about this Policy may be sent to support@sphereone.ai or by post to Altrivis Management LLC, Attention: Privacy, 5900 Balcones Drive, Suite 100, Austin, Texas 78731, United States.

Supplement A: United States State Privacy Rights

A.1Application. This Supplement applies to residents of California and of other US states with comprehensive consumer privacy laws, including Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia, to the extent those laws apply to us. It does not apply to Customer Data, which we process as a service provider or processor for our Customers.

A.2Notice at collection. In the preceding twelve months, we have collected the following categories of personal information, for the purposes described in Section 4, from the sources described in Section 3, and disclosed them for business purposes to the categories of recipients described in Section 6:

A.3Sensitive personal information. We use sensitive personal information only for purposes permitted without an opt-out right under California law, namely to provide the Services, to ensure security and integrity, and to carry out the location-based access controls chosen by the Customer. Where a state law requires consent for processing sensitive data, the location permission request in the app is used to obtain that consent. We do not collect biometric information: a voiceprint you create with "Only my voice" (Section 5.7) is kept only on your device and never reaches us.

A.4No sale or sharing. We do not sell personal information and do not share it for cross-context behavioural advertising. We do not use third party advertising cookies or pixels on the Site. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

A.5Retention. Retention periods are described in Section 9.

A.6Your rights. Subject to exceptions under applicable law, you may request: (a) to know the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes, and the categories of recipients; (b) deletion of your personal information; (c) correction of inaccurate personal information; (d) a portable copy of your personal information; and (e) to opt out of sale, sharing, targeted advertising or profiling in furtherance of decisions producing legal or similarly significant effects (we do not engage in these activities).

A.7How to submit a request. Write to support@sphereone.ai with the subject line "Privacy Rights Request". We will confirm receipt within ten (10) business days and respond within forty-five (45) days, which may be extended by a further forty-five (45) days where reasonably necessary. We will verify your identity by matching information you provide with information we hold. An authorised agent may submit a request on your behalf with your signed permission, and we may ask you to verify your identity directly.

A.8Appeals. If we decline your request, you may appeal by writing to support@sphereone.ai with the subject line "Privacy Request Appeal" within a reasonable time. We will respond within the period required by your state's law. If your appeal is denied, you may contact the Attorney General of your state.

A.9Non-discrimination. We will not discriminate against you for exercising your privacy rights.

A.10California Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes.

Supplement B: European Economic Area, United Kingdom and Switzerland

This Supplement takes effect when the Services are offered to users in the EEA, the UK or Switzerland.

B.1Controller. Altrivis Management LLC is the controller for the processing described in Section 2.1. For Customer Data, the Customer is the controller and Altrivis is the processor.

B.2Representatives. Our representative in the European Union under Article 27 of the General Data Protection Regulation ("GDPR") is __________, and our representative in the United Kingdom under Article 27 of the UK GDPR is __________.

B.3Legal bases. We rely on the following legal bases:

B.4Your rights. You have the right to access, rectify, erase, restrict and receive a portable copy of your personal data, and to object to processing based on legitimate interests, including profiling, and at any time to direct marketing. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing. To exercise your rights, write to support@sphereone.ai. We will respond within one month, which may be extended by two further months for complex requests.

B.5Automated decisions. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Where a Customer enables location-based access controls, the Customer is the controller of that processing and is responsible for any assessment and safeguards required by law.

B.6International transfers. Where we transfer personal data outside the EEA, the UK or Switzerland to a country without an adequacy decision, we use the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and equivalent Swiss safeguards. You may request a copy of the relevant safeguards by writing to us.

B.7Complaints. You have the right to lodge a complaint with the data protection supervisory authority in the country where you live or work, or where an alleged infringement took place. In the UK, this is the Information Commissioner's Office.

Supplement C: India

This Supplement takes effect when the Services are offered to users in India.

C.1Application. This Supplement applies to the processing of digital personal data of data principals in India under the Digital Personal Data Protection Act, 2023 (the "DPDP Act") where we act as a data fiduciary.

C.2Notice. The personal data we collect, and the purposes for which we process it, are itemised in Sections 3 and 4. Where we rely on your consent, we will request it through a clear notice in plain language, and you may give, manage, review or withdraw your consent at any time through your account settings, by writing to us, or through a registered consent manager. Withdrawal of consent does not affect processing carried out before withdrawal. Where you use SphereOne through your employer or another organisation, that organisation is the data fiduciary for Customer Data.

C.3Your rights. Subject to the DPDP Act, you have the right to obtain a summary of your personal data and of the processing activities undertaken, and the identities of other data fiduciaries and processors with whom it has been shared; to correct, complete, update and erase your personal data; to grievance redressal; and to nominate another person to exercise your rights in the event of your death or incapacity.

C.4Grievance Officer. You may contact our Grievance Officer: Name: __________; Email: support@sphereone.ai; Address: __________, India. We will respond to your grievance within ninety (90) days.

C.5Data Protection Board. If you are not satisfied with our response, you may file a complaint with the Data Protection Board of India after exhausting the grievance redressal process.

C.6Children. We do not knowingly process the personal data of any person under 18 years of age.