AskWisy

Privacy Policy

Version 3.0  |  Effective Date: April 23, 2026

AskWisy, Inc.  ·  A Delaware Corporation  ·  Los Altos, CA  ·  AskWisy.com/privacy

Table of Contents

1. Scope & Applicability

2. Who We Are — Data Controller & Processor

3. Personal Information We Collect

4. How We Use Personal Information

5. AI Interaction Data & Multimodal Processing

6. Legal Bases for Processing

7. How We Share Personal Information

8. Cookies, Tracking Technologies & Analytics

9. Data Retention

10. Data Security

11. Domestic Cross-State Use

12. International Data Transfers & Cross-Border Use

13. Rights of International Users (GDPR, UK GDPR, PIPEDA & Others)

14. Children's Privacy

15. California Privacy Rights (CCPA / CPRA)

16. Other U.S. State Privacy Rights

17. Privacy Rights for End Users of Client-Deployed AI

18. Data Subject Rights — All Users

19. Third-Party Services & Links

20. Changes to This Privacy Policy

21. Governing Law

22. Contact & Data Privacy Requests

1. Scope & Applicability

This Privacy Policy ("Policy") applies to personal information collected, processed, or generated by AskWisy, Inc. (a Delaware corporation with principal offices in Los Altos, CA) in connection with:

• The AskWisy Platform and all associated Services
• The Company's website(s), including AskWisy.com
• All interaction modalities — voice, text, video, image, document, data, and any future formats
• APIs, integrations, and developer tools
• Client and Partner accounts and configuration activity
• End User interactions with AI agents deployed through the platform by Clients

This Policy does not cover information collected by third-party websites, services, or applications linked to our Services but not controlled by us.

1.1 Relationship to Terms of Service

This Policy is incorporated into and forms part of our Terms of Service. In the event of a conflict between this Policy and the Terms of Service regarding data privacy obligations, this Policy governs with respect to privacy matters.

1.2 Industry Coverage

This Policy applies across all industries in which the Company operates, including real estate, property management, healthcare, legal services, automotive, hospitality, home services, financial services, and others. Where industry-specific regulations impose additional requirements, we comply with those requirements and may publish supplemental privacy notices.

2. Who We Are — Data Controller & Processor

2.1 Data Controller

For information collected directly from Clients, Partners, website and web applications visitors, AskWisy, Inc. acts as the data controller — determining the purposes and means of processing that personal information.

2.2 Data Processor

For personal information that End Users share with AI agents deployed by Clients, the Company acts as a data processor on behalf of the Client (the data controller). Clients are responsible for providing required privacy notices to their End Users and for having a lawful basis for processing End User personal data.

2.3 Delaware Corporate Structure

AskWisy, Inc. is incorporated under the Delaware General Corporation Law. Our day-to-day operations, including our privacy compliance program, are based in California and governed by California law.

3. Personal Information We Collect

We collect personal information in the following categories depending on how you interact with us. Not all categories apply to every user type.

3.1 Information We Do Not Collect

We do not knowingly collect: full payment card numbers (handled by our PCI-DSS-compliant payment processor); Social Security or government ID numbers (except where required by specific industry deployments with explicit consent); medical records (except where a Client deploys our platform in a healthcare context under a separate DPA).

3.2 Automatically Collected Information

When you use our Services, we automatically collect technical and usage data through server logs, cookies, and similar technologies. This includes IP addresses, browser types, operating systems, page views, and error logs.

3.3 Information from Third Parties

We may receive personal information from third parties, including Clients who integrate our platform with their own customer databases, Partners, publicly available sources, and identity verification services.

4. How We Use Personal Information

4.1 Providing & Delivering the Services

• Operating and maintaining the platform and all interaction modalities
• Processing and responding to user interactions through AI agents
• Authenticating users and managing account access
• Processing payments and managing Commercial Plan billing
• Providing customer support and responding to inquiries

4.2 AI Model Training & Product Improvement

• Training and improving AI language models, voice recognition, video understanding, and multimodal processing systems
• Developing new features, products, modalities, and industry-specific capabilities
• Generating anonymized, aggregated, or de-identified datasets for research and benchmarking
• Quality assurance, testing, and validation of AI outputs

4.3 Fairness & Non-Discrimination

The Company does not use personal information, including AI Interaction Data, to facilitate unlawful discrimination based on race, color, national origin, religion, sex, familial status, disability, or any other protected characteristic under Applicable Law, including the Fair Housing Act, ADA, or equivalent laws. Clients who deploy the Services in real estate, healthcare, financial services, or other regulated industries are responsible for ensuring their use of AI lead qualification and screening features complies with applicable anti-discrimination laws.

4.4 Security, Fraud Prevention & Legal Compliance

• Detecting, preventing, and investigating fraud, abuse, unauthorized access, and security incidents
• Complying with applicable laws, regulations, court orders, and legal process
• Exercising and defending legal rights and claims

4.5 Business Operations & Communications

• Sending transactional communications (account notices, billing statements, security alerts)
• Sending service updates, product announcements, and marketing communications (where you have opted in)
• Internal business analytics, planning, and reporting
• Carrying out business transactions such as mergers, acquisitions, or asset sales

4.6 Aggregated & De-Identified Data

We may aggregate or de-identify personal information so that it no longer identifies you individually, and use such data for any purpose, including commercial purposes such as industry benchmarking, research publication, and product marketing. De-identified data is not subject to this Policy.

5. AI Interaction Data & Multimodal Processing

5.1 What We Capture

When an End User interacts with an AI agent deployed through our platform — regardless of the modality — we capture and process:

• Voice: Audio recordings, spoken text, voice characteristics (for transcription purposes only, not identity verification), and metadata
• Text / In-App Messaging: Full text of messages exchanged, session metadata, and conversation context
• Video: Video recordings of interactions where video modality is enabled; subject to applicable state and international video recording consent laws
• Images: Images submitted by users in connection with a query or interaction
• Documents: Files and documents uploaded through the Services
• Derived Signals: Query-response pairs, behavioral patterns, and other data derived from the interaction

5.2 Recording Consent & Disclosure

End Users are notified of recording at or before the commencement of an AI interaction. Where applicable state law requires all-party consent (e.g., California Penal Code § 632), appropriate disclosure is provided. By initiating an interaction through any modality, End Users consent to recording, transcription, and processing as described herein. For users accessing the Services from jurisdictions outside the United States, additional consent may be obtained as required by local law. The platform defaults to all-party consent disclosure when the user's jurisdiction cannot be determined.

5.3 AI Training Use

AI Interaction Data is used to train, improve, and develop the Company's AI models, as described in Sections 4.2 and the Terms of Service (Sections 7–9). This use is: (a) royalty-free and fee-free; (b) perpetual; (c) irrevocable with respect to data already incorporated into model improvements; and (d) subject to enterprise opt-out as described in Section 4.2. Sensitive Personal Information is excluded from AI training without explicit consent.

5.4 Transcript & Summary Access

AI interaction transcripts and summaries are made available to the Client who deployed the AI agent. The Company may retain copies for security, legal compliance, quality assurance, and AI improvement purposes per Section 9.

5.5 Right of Publicity

The Company does not use voice recordings, video recordings, or images of identifiable individuals to train AI models that simulate or replicate those individuals' voices, likenesses, or identities without their explicit consent. Clients may not configure AI agents to simulate the voice or likeness of any specific individual without that individual's written consent.

6. Legal Bases for Processing

7. How We Share Personal Information

We do not sell your personal information for money. We may share personal information in the following circumstances:

7.1 With Clients (As Data Processor)

We share End User AI Interaction Data — including transcripts, summaries, and interaction records — with the Client who deployed the AI agent through which the End User interacted. This sharing is inherent to the service. Clients are responsible for their own compliance with applicable privacy law.

7.2 With Service Providers & Subprocessors

We share personal information with trusted third-party service providers under written contracts requiring confidentiality and data protection obligations. Categories include:

• Cloud infrastructure providers (hosting, storage, compute)
• Payment processors (billing data only; do not receive full interaction data)
• AI and machine learning infrastructure providers
• Analytics and monitoring tools
• Customer support platforms
• Email and communication delivery services
• Identity verification and fraud prevention services
• Legal, audit, and professional advisory services

7.3 With Partners

We may share appropriate data with Partners under written partnership agreements, subject to this Policy.

7.4 For Legal & Safety Purposes

We may disclose personal information to: (a) comply with applicable law, regulation, legal process, or governmental request; (b) enforce our Terms of Service; (c) protect the rights, property, or safety of the Company, Clients, End Users, or the public; or (d) respond to emergency situations.

7.5 Business Transfers

In connection with a merger, acquisition, reorganization, or sale of assets, personal information may be transferred to a successor or acquirer. We will notify you via email or prominent notice if personal information becomes subject to a materially different privacy policy.

7.6 With Your Consent

We may share personal information for other purposes with your express consent.

7.7 Aggregated or De-Identified Data

We may share aggregated or de-identified data — which cannot reasonably be used to identify you — with any third party for any purpose, including research, marketing, and commercial purposes.

8. Cookies, Tracking Technologies & Analytics

8.1 Your Cookie Choices

You can manage cookie preferences through your browser settings or our cookie preference center (where available). Disabling strictly necessary cookies may prevent you from using the Services.

8.2 Do Not Track & Global Privacy Control

Our Services honor Global Privacy Control (GPC) browser signals as opt-out of sale/sharing instructions from California residents, as required by CPRA and CPPA regulations. Our Services do not otherwise respond to browser "Do Not Track" signals. We will update this Policy if our practices change.

9. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements.

We may retain anonymized or de-identified data for longer periods or indefinitely, as such data does not constitute personal information for the purposes of this Policy.

10. Data Security

10.1 Security Measures

We implement commercially reasonable administrative, technical, and physical security measures:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256 or equivalent)
• Access controls, role-based permissions, and multi-factor authentication
• Regular security assessments, penetration testing, and vulnerability management
• Employee security training and confidentiality obligations
• Incident response planning and breach notification procedures
• Vendor security assessments for subprocessors handling personal information

10.2 Limitations

No method of transmission over the Internet or electronic storage is 100% secure. If you believe your account security has been compromised, notify us immediately at security@AskWisy.com.

10.3 Breach Notification

In the event of a personal data breach that creates a material risk to affected individuals, we will notify affected parties and relevant authorities as required by applicable law, including: California's data breach notification law (Cal. Civ. Code §§ 1798.29 and 1798.82); other applicable state breach notification statutes; and, where applicable, GDPR Article 33–34 (72-hour notification to the applicable supervisory authority for breaches involving EU/EEA personal data).

10.4 Subprocessor Transparency

The Company maintains a list of third-party subprocessors that process personal data on its behalf. This list is available upon request to privacy@AskWisy.com.

11. Domestic Cross-State Use

11.1 State Privacy Rights Travel With You

Your state-based privacy rights generally follow your state of residence, not the state from which you are physically accessing the Services. For example, if you are a California resident traveling to Texas and using the Services, your CCPA/CPRA rights still apply. The Company will honor verified state privacy rights regardless of where you physically access the Services.

11.2 Recording Consent Laws Vary

Recording consent requirements vary significantly by state. The following states require all-party consent for recording confidential communications: California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Oregon, Pennsylvania, and Washington, among others. When the user's state cannot be determined from account profile or platform context, the Company defaults to all-party consent disclosures.

11.3 Industry-Specific State Regulations

Clients who use the Services in connection with regulated industries (real estate, healthcare, financial services, legal services) are responsible for compliance with state-specific professional and regulatory requirements applicable to their industry in each jurisdiction where they operate.

12. International Data Transfers & Cross-Border Use

12.1 U.S.-Based Services

Our Services are operated from the United States. If you are accessing our Services from outside the United States, please be aware that your personal information will be transferred to, stored, and processed in the United States.

12.2 Users Traveling Internationally

If you are a U.S.-based user accessing the Services while traveling internationally, your personal data processing remains subject to U.S. law and these Terms. If you travel to a jurisdiction whose local privacy laws apply to our processing of your personal data (e.g., the EU/EEA under GDPR), you may request additional data protection safeguards by contacting privacy@AskWisy.com.

12.3 Clients Operating Internationally

Clients who deploy the Services to End Users outside the United States are solely responsible for compliance with applicable data protection and privacy laws in each jurisdiction. The Company will cooperate with Clients by offering Data Processing Agreements (DPAs) and EU Standard Contractual Clauses (2021 SCCs), UK International Data Transfer Agreements (IDTAs), or equivalent transfer mechanisms.

12.4 Transfer Safeguards

For transfers of personal data from the EEA, UK, or Switzerland to the United States, the Company implements appropriate safeguards including: (a) EU Standard Contractual Clauses (2021 EU SCCs); (b) UK International Data Transfer Agreements (IDTAs) where applicable; (c) Supplementary technical and organizational measures as recommended by applicable supervisory authorities. These mechanisms are available upon request by contacting privacy@AskWisy.com.

13. Rights of International Users (GDPR, UK GDPR, PIPEDA & Others)

13.1 EU/EEA & UK Users (GDPR / UK GDPR)

To the extent our processing of your personal data falls within the scope of the EU GDPR or UK GDPR, you have the following rights:

• Right of Access (Article 15): Request access to the personal data we hold about you.
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete personal data.
• Right to Erasure / 'Right to be Forgotten' (Article 17): Request deletion of your personal data, subject to limitations described in Section 18.
• Right to Restriction of Processing (Article 18): Request restriction of processing in certain circumstances.
• Right to Data Portability (Article 20): Receive your personal data in a structured, machine-readable format.
• Right to Object (Article 21): Object to processing based on legitimate interests, including profiling.
• Right Not to Be Subject to Automated Decision-Making (Article 22): Not to be subject to solely automated decisions with significant legal effects.
• Right to Lodge a Complaint: Lodge a complaint with your local supervisory authority.

We do not specifically target or solicit users in the EU/EEA and do not currently maintain a formal EU establishment. However, we voluntarily apply GDPR-equivalent principles and will honor verifiable GDPR rights requests from EU/EEA residents.

13.2 Canadian Users (PIPEDA / Provincial Privacy Laws)

Users in Canada have rights under PIPEDA or applicable provincial privacy laws, including the right to access personal information held about them and to challenge its accuracy. To exercise these rights, contact privacy@AskWisy.com.

13.3 Brazilian Users (LGPD)

Users in Brazil have rights under the Lei Geral de Proteção de Dados (LGPD), including rights to access, correction, anonymization, portability, deletion, information about sharing, and opposition. Contact privacy@AskWisy.com.

13.4 Other Jurisdictions

Users in other jurisdictions with comprehensive privacy laws (including Australia, Japan, Singapore, India, and others) may have equivalent rights under applicable local law. We will endeavor to honor verified privacy rights requests from users in any jurisdiction. Contact privacy@AskWisy.com with your jurisdiction and request type.

13.5 Response Timeframes for International Requests

We respond to verifiable international privacy rights requests within: 45 days (U.S. law standard); 30 days for GDPR and UK GDPR requests (extendable to 90 days for complex requests with notice). Submit requests to privacy@AskWisy.com with subject "International Privacy Request — [Country/Jurisdiction]."

14. Children's Privacy

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent, as required by COPPA (15 U.S.C. §§ 6501–6506). In jurisdictions where a higher age threshold applies (e.g., age 16 under GDPR for certain processing activities), we comply with the applicable local standard. The Company also complies with the California Age-Appropriate Design Code (AB 2273) to the extent its requirements apply to our Services.

If you believe a child under the applicable age limit has provided personal information without required consent, contact us at privacy@AskWisy.com. We will promptly investigate and delete that information.

15. California Privacy Rights (CCPA / CPRA)

15.1 Categories of Personal Information Collected

15.2 Sale & Sharing

We do not sell personal information for monetary consideration. We do not engage in sharing personal information for cross-context behavioral advertising. We share AI Interaction Data with Clients as described in Section 7.1, which constitutes a business purpose disclosure, not a "sale" or "share" for advertising.

15.3 California Consumer Rights

• Right to Know: Request disclosure of categories and specific pieces of personal information collected about you, categories of sources, business purpose, and categories of third parties.
• Right to Access: Request a copy of the specific personal information we hold about you.
• Right to Deletion: Request deletion of your personal information, subject to exceptions described in Section 18.
• Right to Correction: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: Opt out of sale or sharing for advertising purposes (we do not currently engage in such activities).
• Right to Limit Use of Sensitive PI: Request that we limit use of your Sensitive Personal Information to CPRA-specified purposes.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

15.4 How to Exercise California Rights

Submit a verifiable consumer request by: (a) emailing privacy@AskWisy.com with subject "CCPA Privacy Request"; or (b) using the privacy request form at AskWisy.com/privacy-request. We will verify your identity and respond within 45 days (extendable by 45 days with notice).

15.5 Authorized Agent

California residents may use an authorized agent to exercise rights. We require written authorization and may verify the consumer's identity directly.

15.6 Shine the Light

California Civil Code § 1798.83 permits California residents to request information about disclosures for direct marketing. We do not share personal information for third-party direct marketing purposes.

15.7 Global Privacy Control (GPC)

The Company honors Global Privacy Control (GPC) browser signals as opt-out of sale/sharing instructions from California residents, as required by CPRA and California Privacy Protection Agency (CPPA) regulations.

16. Other U.S. State Privacy Rights

In addition to California, several U.S. states have enacted comprehensive privacy laws. Your state-based rights follow your state of residence, not your physical location when accessing the Services.

To exercise rights under any applicable state law, contact privacy@AskWisy.com with the subject "State Privacy Request — [State]."

17. Privacy Rights for End Users of Client-Deployed AI

17.1 Who Controls Your Data

When you interact with an AI agent on a Client's platform, the Client is the data controller for your personal information in that interaction. The Company acts as a data processor on behalf of the Client. The Client is primarily responsible for how your data is used, retained, and protected.

17.2 Company's Use of End User Interaction Data

Notwithstanding the Client's role as data controller, the Company retains a license to use AI Interaction Data for AI training, model improvement, product development, and commercial purposes, as described in Sections 4.2 and 5.3. This license is perpetual, royalty-free, and irrevocable with respect to data already incorporated into model improvements.

17.3 How to Exercise Rights as an End User

Contact the Client directly, as they are the data controller. You may also contact the Company at privacy@AskWisy.com and we will direct your request appropriately. Where the Company is independently obligated to honor your request (e.g., as required by CCPA), we will do so.

17.4 Recording Disclosure

If you interacted with an AI agent without being aware it was recording and believe this was done without required consent disclosures, please contact us immediately at privacy@AskWisy.com. We require all Clients to implement legally required disclosures before capturing interaction data.

18. Data Subject Rights — All Users

Regardless of your location, you may have the following rights with respect to your personal information, subject to applicable law:

Contact: privacy@AskWisy.com | Subject: "Data Subject Request — [Request Type]" | Response within 45 days (30 days for GDPR requests).

18.1 Limitations on Deletion Rights

Your right to deletion is subject to: (a) data needed to complete pending transactions or provide Services you have requested; (b) data required by applicable law or legal hold; (c) AI Interaction Data that has been de-identified, anonymized, or incorporated into AI model weights cannot practically be removed without retraining our models — under applicable U.S. law, we are not obligated to retrain models upon deletion requests; (d) data covered by our content license may be retained per Terms of Service Section 8 even after account deletion. We will honor deletion requests for all identified, non-anonymized personal data to the extent technically feasible, and provide written confirmation of actions taken.

19. Third-Party Services & Links

Our Services may contain links to or integrations with third-party websites, services, and applications not controlled by us. This Policy does not apply to such third-party services. We encourage you to review the privacy policies of any third-party service you use.

20. Changes to This Privacy Policy

We may update this Policy from time to time. When we make material changes, we will: (a) update the "Effective Date"; (b) provide notice via email or a prominent banner on our website at least 14 days before changes take effect; and (c) for changes that materially expand our use of personal information, seek your consent where required by applicable law. Your continued use after the effective date constitutes acceptance.

21. Governing Law

This Privacy Policy is governed by the laws of the State of California. AskWisy, Inc. is incorporated in Delaware; its day-to-day operations and privacy compliance program are based in California. To the extent any dispute arises in connection with this Policy, it is subject to the jurisdiction, dispute resolution, and arbitration provisions in our Terms of Service Sections 22–23.

22. Contact & Data Privacy Requests

AskWisy, Inc.  ·  A Delaware Corporation  ·  Los Altos, CA  ·  AskWisy.com/privacy

© 2026 AskWisy, Inc.. All Rights Reserved.