Privacy Policy

The short version. This policy covers the personal information Pazau decides how to use: information about visitors to pazau.com, people who talk to our sales and support teams, attendees of our events, and the people who log in to Pazau. It does not cover the conversations our customers run through Pazau. For that data we are a processor acting on our customers' instructions under our Data Processing Addendum, and the customer's own privacy notice applies. We do not sell personal information for money. We never train foundation models on Customer Data. You can opt out of advertising cookies at any time, and we honor Global Privacy Control signals automatically. To exercise any right, email privacy@pazau.com.

Who we are and what this policy covers

Pazau provides an AI customer support platform: Pazau Inbox, Pazau Agent, Pazau Voice, and Pazau Insights (together, the "Services"). This Privacy Policy explains how Pazau, Inc. and its affiliates ("Pazau," "we," "us") handle personal information when we act as a controller (under the GDPR and UK GDPR) or a business (under the California Consumer Privacy Act and similar US state laws).

It applies to personal information we collect:

• when you visit pazau.com, docs.pazau.com, status.pazau.com, or any other website that links to this policy (the "Sites");
• when you chat with the Pazau assistant on our Sites, book a demo, download a report, or subscribe to our newsletter;
• when you attend a Pazau webinar, event, or conference booth;
• when you create, administer, or sign in to a Pazau account, including as an agent or administrator invited by your employer ("Account Users");
• when you contact Pazau support, apply for a job, or otherwise interact with us as a business contact, partner, or vendor.

Job applicants receive a separate candidate privacy notice when they apply through our careers page. Where that notice and this policy differ, the candidate notice controls for recruiting data.

Controller or processor: the distinction that matters

Pazau plays two different roles, and the rules differ for each.

We call the data we process for customers "Customer Data." We use Customer Data only to provide and secure the Services under our customer agreements, as described in the Subscription Agreement, the Data Processing Addendum, and the AI Addendum. Pazau never uses Customer Data to train or fine-tune foundation models, and our AI model providers are contractually bound to zero data retention. Our current list of processors for Customer Data is on the Sub-processors page.

Account Users sit in both worlds. Your name, work email, role, and sign-in history are account data that Pazau controls for security, billing, and product operations. The conversations you handle inside the product are Customer Data that belong to your employer.

Notice at collection

This summary is our notice at collection under the CCPA and similar laws. Details follow in the sections below.

• What we collect: identifiers and contact details, professional information, account and security data, commercial information, internet and device activity, coarse location, audio or video recordings of sales calls and webinars (with notice), and inferences about product interest. The only sensitive personal information we collect as a controller is account login credentials, which we use only to authenticate you.
• Why: to operate the Sites and Services, respond to you, market our Services to businesses, secure our systems, meet legal obligations, and improve our products.
• Sale and sharing: we do not sell personal information for money. When you accept advertising cookies, some advertising partners receive device identifiers and browsing activity, which state laws may treat as "sharing" for cross-context behavioral advertising or "targeted advertising." You can opt out at any time. See Your privacy choices.
• How long we keep it: see the retention column in the table below and How long we keep information.

Information we collect

Information you give us

• Contact and professional details: name, work email, phone number, company, job title, team size, country, and the reason you are contacting us.
• Account details: login email, name, role, profile photo, time zone, language, SSO identity, multi-factor authentication settings, and password (stored as a salted hash, never in plain text).
• Billing details: billing contact, billing address, tax ID, and purchase history. Card payments are processed by our payment processor. Pazau does not store full card numbers.
• Communications: emails, chat transcripts with the Pazau assistant on our Sites, support tickets you file about your own Pazau account, survey responses, and feedback.
• Event information: registration details, session attendance, dietary or accessibility requirements you choose to share for in-person events, and badge scans at conference booths.
• Recordings: if you join a sales call or demo, we may record and transcribe it to take notes and train our own sales team. We tell you at the start of the call and you can ask us not to record.

Information we collect automatically

• Device and usage data: IP address, browser type, operating system, referring URL, pages viewed, links clicked, session length, and approximate location derived from IP address (city or region, never precise geolocation).
• Product telemetry for Account Users: feature usage, sign-in times, IP addresses, device identifiers, error logs, and audit events. We use this to secure accounts, provide audit logs to your administrator, and improve the product.
• Cookies and similar technologies: see our Cookie Policy for the complete list, including names, providers, and durations.

Information from other sources

• Your employer or organization: when an administrator invites you to a Pazau workspace or provisions you through SCIM or SSO.
• Business contact data providers and public sources: company firmographics (industry, size, technology in use) and business contact details from providers of professional contact data and from public company websites, used to route and qualify inbound requests.
• Partners and resellers: when a partner refers you or registers an opportunity.
• Event organizers and co-marketing partners: when you register for an event or webinar we sponsor and agree to share your details with sponsors.
• Advertising and analytics partners: aggregated or pseudonymous data about ad performance and site usage.

Categories, sources, purposes, and retention

The table below describes the personal information we have collected in the preceding 12 months, using the categories defined by the CCPA.

We do not collect, as a controller, government ID numbers, precise geolocation, biometric identifiers, health data, or financial account numbers. We do not use sensitive personal information to infer characteristics about you.

How we use information

We use personal information to:

1. Provide the Sites and Services: create and secure accounts, authenticate users, process payments, deliver product features, and send service messages such as security alerts, invoices, and incident notices.
2. Respond to you: answer demo requests, support tickets, and questions, including through the Pazau assistant on our Sites.
3. Market to businesses: send newsletters and product updates, invite you to events, and show relevant ads. You can unsubscribe from marketing email with one click.
4. Improve our business: understand how the Sites and the product are used, fix bugs, and plan features. For product analytics we use account and telemetry data, not the content of Customer Data.
5. Protect Pazau, our customers, and the public: detect and prevent fraud, abuse, spam, and security incidents; enforce our Acceptable Use Policy; and maintain audit logs.
6. Comply with law: meet tax, accounting, export control, sanctions, and record-keeping obligations, and respond to lawful requests.
7. Run corporate transactions: evaluate or complete a merger, financing, or sale of assets, subject to confidentiality protections.

The Pazau assistant on our Sites

The chat assistant on pazau.com runs on Pazau Agent. It always identifies itself as an AI assistant and offers a handoff to a person. Transcripts are retained for 12 months to answer follow-up questions and to evaluate the assistant's quality. The assistant is powered by third-party large language models under zero data retention terms. Neither Pazau nor those providers use your chat to train foundation models.

Automated decision-making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you. We use automated scoring to prioritize inbound sales requests, and a person reviews every request before we decline to follow up.

Legal bases for processing (EEA, UK, and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on these legal bases:

Where we rely on legitimate interests, we have balanced our interests against your rights. You can request a copy of that assessment from our Data Protection Officer.

How we share information

We share personal information only as described here:

• Service providers that process data on our behalf under written contracts: hosting, customer relationship management, email delivery, analytics, payment processing, video conferencing, and professional services. They may not use your information for their own purposes.
• Affiliates: Pazau, Inc., Pazau Ireland Limited, and Pazau UK Ltd share information to operate the business globally.
• Your organization: if you are an Account User, your workspace administrators can see your profile, activity, and audit events.
• Advertising partners: only when you accept advertising cookies. See Your privacy choices.
• Partners: if you ask to be connected with a reseller or implementation partner, or if a partner referred you.
• Professional advisers and auditors: lawyers, accountants, and our SOC 2 and ISO auditors, under confidentiality obligations.
• Legal and safety: when we believe in good faith that disclosure is required by law, a subpoena, or a court order, or is necessary to protect the rights, safety, or property of Pazau, our customers, or others. We publish government request statistics in our Trust Center and challenge requests that are overbroad.
• Corporate transactions: to a buyer or successor in a merger, acquisition, or financing, subject to this policy.

We do not sell personal information in exchange for money, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16.

Your privacy choices

You control how we use your personal information. The options below are available to everyone, wherever you live. We don't require you to create an account to exercise them.

Opt out of sale, sharing, and targeted advertising

Pazau does not sell personal information for money. When you accept advertising cookies on our Sites, advertising partners such as LinkedIn and Google receive cookie identifiers and information about pages you visit. California law may treat this as "sharing" for cross-context behavioral advertising, and other state laws may treat it as a "sale" or "targeted advertising." To opt out:

• Use the cookie settings. Select Your privacy choices or Cookie settings in the footer of any page and choose Essential only. This turns off advertising and analytics cookies on that browser.
• Send a Global Privacy Control signal. See below.
• Email us. Write to privacy@pazau.com with the subject line "Do not sell or share." We will apply the opt-out to any personal information we can link to your email address, including our marketing and advertising audiences.

Opting out does not stop us from showing you ads. It stops those ads from being based on your activity on our Sites.

Global Privacy Control

We honor Global Privacy Control (GPC) signals as a valid request to opt out of sale, sharing, and targeted advertising, as required by California, Colorado, Connecticut, Texas, Oregon, Montana, New Jersey, and other state laws. We honor it everywhere, not only in those states.

When we detect a GPC signal:

• we don't load advertising cookies or pixels on that browser, and we treat your consent as "Essential only";
• we display "Opt-out preference signal honored" in the cookie settings panel so you can confirm it worked;
• if you're signed in to a Pazau account or we can otherwise associate the browser with you, we apply the opt-out to your account and marketing record, not only the browser.

If your GPC signal conflicts with a setting you previously chose in our cookie settings, we follow the GPC signal. We do not currently respond to "Do Not Track" signals, because no common standard for them exists. GPC is the standard we follow.

Marketing communications

Every marketing email has an unsubscribe link that takes effect within 24 hours. You can also manage topics at any time in your email preferences or by emailing privacy@pazau.com. We will still send service messages about your account, security, and billing.

Your rights

Depending on where you live, you may have the right to:

• Know and access the personal information we hold about you and receive a copy in a portable format.
• Correct inaccurate information.
• Delete your information.
• Opt out of sale, sharing, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects.
• Limit the use of sensitive personal information. We already use it only for permitted purposes, so no separate limit is required, but you may still ask.
• Object to or restrict processing based on legitimate interests.
• Withdraw consent at any time, without affecting processing that happened before.
• Obtain a list of the specific third parties to which we disclosed your personal data (Oregon, Minnesota, and Maryland residents).
• Appeal our decision on your request.
• Complain to a data protection authority or state attorney general.

We will not discriminate against you for exercising any right. We do not offer financial incentives in exchange for personal information.

How to submit a request

1. Send the request. Email privacy@pazau.com or use the privacy request form in the Trust Center. US residents can also call us toll free at +1 (833) 555-0199. Account Users can download their profile data and delete their own account from Settings → Profile in the app.
2. Verify your identity. We will ask you to confirm control of the email address associated with your information. For access or deletion requests involving account data, we may ask you to sign in or ask your workspace administrator to confirm. We ask only for information we need to verify you and delete it once your request is complete.
3. Receive our response. We confirm receipt within 10 business days and respond within 45 days (US) or one month (EEA and UK). We may extend once by 45 more days (US) or two more months (EEA and UK) when a request is complex, and we will tell you why.
4. Appeal if you disagree. If we deny your request in whole or in part, reply to our response with "Appeal" in the subject line, or email privacy@pazau.com. A member of our legal team who did not handle the original request will review it and respond within 45 days (60 days in Colorado). If we deny the appeal, we will tell you how to contact your state attorney general.

Authorized agents. You may use an authorized agent. We will ask the agent for signed permission from you and may ask you to verify your identity directly, unless the agent holds a valid power of attorney.

Requests about Customer Data. If your information is in Pazau because you contacted one of our customers, such as an airline, retailer, or insurer, please contact that company. We are their processor and act on their instructions. If you send the request to us, we will pass it to the right customer within 5 business days and let you know we have done so.

Request metrics

For the calendar year 2025, we received and responded to the following requests from US residents:

We also honored GPC signals from approximately 18% of browser sessions on our Sites during 2025.

US state privacy notice

This section supplements the rest of the policy for residents of US states with comprehensive privacy laws, including California (CCPA as amended by the CPRA), Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Rights and definitions vary by state, and some state laws exempt personal information collected in a business-to-business context. We extend the rights in Your privacy choices to all US residents regardless of those exemptions.

Categories collected, sources, purposes, and recipients. See Categories, sources, purposes, and retention. Each category in that table has been disclosed for a business purpose to the recipients listed there.

Sale, sharing, and targeted advertising. In the preceding 12 months, we have "shared" or "sold" (as those terms are defined under state law, not for money) identifiers and internet or network activity to advertising partners, only where you accepted advertising cookies. We have not sold or shared any other category.

Sensitive data. We do not process sensitive data as defined by Colorado, Connecticut, Virginia, Texas, Oregon, and similar laws, apart from account credentials used for authentication. We do not process consumer health data subject to Washington's My Health My Data Act or Nevada SB 370 as a controller.

Profiling. We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects.

De-identified data. Where we de-identify data, we maintain it in de-identified form, do not attempt to re-identify it, and contractually prohibit recipients from re-identifying it.

California "Shine the Light." We do not disclose personal information to third parties for their own direct marketing purposes.

Nevada. We do not sell covered information as defined by Nevada law. Nevada residents may still submit an opt-out request to privacy@pazau.com.

Texas. Pazau does not sell sensitive personal data. If we ever did, Texas law would require us to tell you: "NOTICE: We may sell your sensitive personal data."

International data transfers

Pazau, Inc. is based in the United States. Pazau Ireland Limited is based in Ireland and Pazau UK Ltd in the United Kingdom. Our service providers operate in the United States, the EEA, the UK, and other countries. When personal information moves across borders, we protect it with the following mechanisms:

• EU-U.S. Data Privacy Framework. Pazau, Inc. participates in the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework, as administered by the U.S. Department of Commerce. We comply with the DPF Principles for personal data received from the EEA, the UK, and Switzerland in reliance on the DPF. Pazau is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission. If there is a conflict between this policy and the DPF Principles, the Principles govern. You can view our certification at dataprivacyframework.gov. If we transfer DPF data to a third party acting as our agent, we remain liable under the Principles if that agent processes it in a manner inconsistent with them, unless we are not responsible for the event giving rise to the damage.
• Standard Contractual Clauses. For transfers not covered by the DPF, we use the European Commission's Standard Contractual Clauses (Decision 2021/914), the UK International Data Transfer Addendum, and the Swiss adaptations, together with transfer impact assessments and supplementary measures such as encryption in transit and at rest.
• Adequacy decisions. Transfers between the EEA and the UK, and to other countries with an adequacy decision, rely on that decision.

DPF recourse. If you have a complaint about our DPF compliance, contact us first at privacy@pazau.com. We will respond within 45 days. If we don't resolve it, you can refer it at no cost to our independent recourse mechanism, the International Centre for Dispute Resolution of the American Arbitration Association (ICDR-AAA). For human resources data, we cooperate with the EU data protection authorities, the UK Information Commissioner's Office, and the Swiss Federal Data Protection and Information Commissioner. Under certain conditions, you may invoke binding arbitration under Annex I of the DPF Principles.

Customer Data residency. Enterprise customers can choose to host Customer Data in our EU region (AWS Ireland and Frankfurt). Transfers of Customer Data are governed by the Data Processing Addendum and are listed by provider on the Sub-processors page.

How we protect information

Our security program is independently audited against SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27701 (privacy information management), and ISO/IEC 42001 (AI management). Controls include:

• encryption in transit (TLS 1.2 or higher) and at rest (AES-256), with keys managed in AWS KMS;
• single sign-on, hardware-key multi-factor authentication, and least-privilege access for all Pazau personnel;
• logging and 24/7 monitoring of production systems;
• annual third-party penetration testing and a public Vulnerability Disclosure Policy;
• background checks and annual security and privacy training for employees.

No system is perfectly secure. If we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by law. Details of our program are in our Trust Center.

How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, then delete or de-identify it. Specific periods are in the table above. In summary:

• Prospect and marketing data: 36 months from your last meaningful interaction, such as opening an email, attending an event, or talking to our team.
• Account data: for the life of your account, plus 24 months to handle disputes and security investigations.
• Billing and contract records: 7 years, to meet tax and audit requirements.
• Security logs: 13 months.
• Site chat transcripts: 12 months.

We may keep information longer when required by law or to establish, exercise, or defend legal claims. For Customer Data, customers control retention settings, and after termination we make Customer Data available for export for 30 days and delete it within 90 days, as set out in the Data Processing Addendum.

Children's privacy

Our Sites and Services are designed for businesses and are not directed to children. We do not knowingly collect personal information from children under 16 as a controller, and Account Users must be at least 18. If you believe a child has given us personal information, contact privacy@pazau.com and we will delete it.

Our customers may use Pazau to talk with their own customers, who could include minors. In that case the customer is the controller and is responsible for any notices and consents required by laws such as COPPA and the GDPR. Our Acceptable Use Policy prohibits customers from using Pazau to knowingly collect data from children under 13 without verifiable parental consent.

Third-party links and integrations

Our Sites link to third-party websites, and the Services integrate with more than 120 third-party systems such as CRMs, commerce platforms, and telephony providers. When your organization connects an integration, data flows under your organization's instructions. Third-party sites and services have their own privacy policies, and we are not responsible for their practices.

Changes to this policy

We update this policy when our practices or the law change. We post the new version here with a new "Last updated" date. For material changes, we notify Account Users by email or in-app message at least 30 days before the change takes effect, unless the change is required by law sooner. Previous versions are available on request.

Contact us

Privacy team: privacy@pazau.com

Data Protection Officer: Aoife Brennan, dpo@pazau.com, Pazau Ireland Limited, 14 Hanover Quay, Dublin 2, D02 X5C4, Ireland

Toll-free privacy line (US): +1 (833) 555-0199

Supervisory authorities. Our lead supervisory authority in the EU is the Irish Data Protection Commission (dataprotection.ie), 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. You may also complain to the authority where you live or work. In the UK, contact the Information Commissioner's Office (ico.org.uk). In Switzerland, contact the Federal Data Protection and Information Commissioner (edoeb.admin.ch). We would appreciate the chance to address your concern first.