Privacy Policy: how SAGARIS handles personal data

We collect the following categories of information:

• •  Account information: your name, company email address, and workspace membership. Authentication uses Google Identity Platform session cookies with company-email confirmation codes.
• •  Workspace content: the CRM records, contact lists, notes, sequences, templates, and files that you or your teammates add to your workspace.
• •  Communications content: emails, call recordings and transcripts, SMS messages, and meeting notes generated when you use the platform's outreach and calling features.
• •  Usage and device data: server logs with request correlation IDs, security and audit events, and product analytics about how the site and the application are used. We use PostHog and Google Analytics, which record the pages you visit, the links and buttons you interact with, your approximate location derived from your IP address, your browser and device, and the campaign or referrer that brought you. PostHog also records a replay of how pages are used; anything typed into a form field is masked out of those recordings.
• •  Billing information: subscription and payment records processed by Stripe. Full card numbers are held by Stripe, not by SAGARIS.

We use personal data to operate, secure, and improve the platform:

• •  Providing the service: running your CRM, sequences, dialer, mailboxes, and integrations you connect.
• •  AI features: workspace content may be sent to our AI providers (Vertex AI Gemini as the primary model; OpenAI and Anthropic as optional fallbacks) to generate drafts, summaries, transcripts, and recommendations for your workspace.
• •  Voice dictation: when you dictate instead of typing, the recording is sent to our own transcription route and handled by the AI providers named above, and the browser's own speech recognition is used only where your browser can run it on your device, except on the dashboard voice surfaces, where a browser without on-device recognition sends that audio to its own vendor (Google in Chrome, Apple in Safari) under that vendor's privacy policy.
• •  Your data is not used to train shared models. Workspace records serve that workspace only. This is a product trust boundary shown to every workspace owner in the product.
• •  Security and compliance: authentication, fraud and abuse prevention, audit trails for exports, imports, and AI-initiated actions, and enforcement of outbound-consent rules.
• •  Support and communication: responding to requests and sending service or billing notices.

Customers upload prospect and contact data into their workspaces. For that data, the customer decides what is collected and how it is used; SAGARIS processes it to provide the service.

The platform is consent-first by design: a per-contact, per-channel consent ledger with regional rule sets (GDPR, CAN-SPAM, TCPA, CCPA/CPRA, CASL, PECR) and non-overridable safeguards such as mandatory unsubscribe links, explicit opt-in for SMS, and do-not-call screening. Opt-outs are honored immediately across all sequences for that channel.

If you believe a SAGARIS customer has contacted you improperly, or you want your data removed from a customer's workspace, contact us and we will route the request to the responsible workspace and apply suppression where required.

We do not sell personal data. We share it only with service providers (subprocessors) that help us run the platform: cloud hosting and AI infrastructure (Google Cloud Platform, Vertex AI Gemini, and optional OpenAI/Anthropic fallbacks), communications providers (Telnyx, Twilio, Resend, ElevenLabs), business services (Stripe, Apollo.io, Perplexity), and the third-party integrations you choose to connect (such as Salesforce, HubSpot, Gmail/Google Calendar, Microsoft Outlook, LinkedIn, X).

Several providers only process data when you enable the relevant feature or integration. A summary is published on our Trust & Security page, and a full subprocessor list with purposes and data categories is available to reviewers on request.

We may also disclose information when required by law, or as part of a corporate transaction, in which case this policy will continue to apply to previously collected data.

We keep personal data for as long as your workspace is active or as needed to provide the service, comply with legal obligations, and resolve disputes.

The right to erasure is implemented in the product: personal data is anonymized, hashed suppression records prevent silent re-import of erased contacts, and a verifiable deletion certificate is produced. Contact and workspace data can be exported in CSV form, and data-subject-request activity is tracked against statutory deadlines.

The platform runs on Google Cloud Platform (Cloud Run and Cloud SQL PostgreSQL) in the us-east4 region. TLS protects data in transit, data at rest uses GCP-managed encryption, and high-value credentials such as OAuth tokens are additionally encrypted with AES-256-GCM at the application layer. Access is workspace-scoped with a least-privilege, fail-closed role model.

We describe our security posture, including what is still in progress, on our Trust & Security page. We do not claim certifications we do not hold.

Depending on where you live, you may have rights to access, correct, export, delete, or restrict the processing of your personal data, and to object to certain processing (including under the GDPR and CCPA/CPRA). You will not be discriminated against for exercising these rights.

To exercise a right, email us at the address below. If your data lives inside a customer's workspace, we may need to refer your request to that customer as the controller, and we will support them in fulfilling it. A dedicated self-service request portal is on our roadmap.

SAGARIS is operated from the United States, and the platform stores data in the us-east4 (Northern Virginia, USA) region by default. If you use the platform from outside the United States, your data will be transferred to and processed in the United States and in the countries where our subprocessors operate.

We use cookies that are necessary to operate the service (primarily secure, httpOnly session cookies for authentication) and product analytics (PostHog and Google Analytics) to understand how the site and the application are used so we can improve them. Analytics run by default. You can turn them off from the notice shown on your first visit, and declining stops all analytics collection with no loss of functionality. If you submit a form, we link the analytics history from your browser to the contact details you gave us, so we can understand what brought you to us. We do not run third-party advertising trackers, and we do not sell this data.

We may update this policy as the product and the law evolve. We will change the “last updated” date above and, for material changes, notify workspace owners through the product or by email.

Questions, privacy requests, and complaints can be sent to support@sagaris.ai. We acknowledge privacy requests promptly and track them against statutory deadlines.