What we know, and what we do with it.

Sermo Labs, Inc. builds voice and chat agents for enterprise support teams. This policy explains what we do with personal data across our website and the Sermo product. Where we decide why and how data is handled, Sermo Labs, Inc. is the controller.

Account data you give us: your name, work email, company and role. Product data your workspace generates: conversation transcripts, call audio, resolutions and the metadata attached to them. Usage data we observe: pages visited, features used, browser, device and IP address. Correspondence when you email support or fill in a form.

To run the service, keep it secure and bill for it. To train the agent that belongs to your workspace, and only that workspace. To answer your questions and tell you about changes that affect you. To understand product usage in aggregate so we know what to build next. We do not sell personal data, and we do not use your conversations to improve a shared model.

For transcripts, audio and anything else processed inside a customer workspace, the customer is the controller and Sermo is the processor. We act on that customer’s documented instructions under our Data Processing Agreement. If you are an end user who spoke to an agent powered by Sermo, the company you contacted decides how that conversation is handled.

We rely on performance of a contract to provide the service, legitimate interests to secure and improve it, consent where we ask for it such as marketing email, and legal obligation where the law requires us to keep or disclose records.

Only the subprocessors we publish on our security page, each under a written agreement. We disclose data when the law compels us to, and we tell you unless we are legally barred from doing so. If Sermo is acquired or merged, data moves with the business and this policy continues to apply until it is replaced.

Account data for as long as the account is open and twelve months after it closes. Conversation data for the retention window your workspace sets, which can be as short as seven days. Deleted data leaves our primary systems within twenty four hours and our backups within thirty five days.

Encryption in transit and at rest, role-based access, single sign-on, logged internal access and annual independent audits. Our security overview describes the controls, certifications and subprocessors in full.

We operate in the United States, the European Union and Asia Pacific. You can pin a workspace to a region so conversation data never leaves it. Where data does cross a border we rely on Standard Contractual Clauses and equivalent safeguards.

Depending on where you live you may ask us for a copy of your data, correct it, delete it, take it elsewhere, or object to how we use it. Write to privacy@sermolabs.com and we will answer within thirty days. If your data sits inside a customer workspace we will pass your request to that customer and help them respond. You can also complain to your local supervisory authority.

We use essential cookies to keep you signed in and analytics cookies to understand which pages are useful. We do not run cross-site advertising trackers. You can change your preferences at any time from the banner or your browser settings.

Sermo is a product for businesses. It is not directed at children and we do not knowingly collect data from anyone under sixteen. If you believe we have, contact us and we will remove it.

When this policy changes we post the new version here and update the date above. If a change materially affects how we handle your data we email workspace administrators before it takes effect.

Write to privacy@sermolabs.com for anything covered by this policy, or post to Sermo Labs, Inc., 2 Ridgeline Way, Portland, Oregon 97204, United States.