Privacy Policy

Spearfish Group, Inc. ("Spearfish," "we," "us," or "our") provides an AI platform that helps organizations run their contact centers and customer operations. This Privacy Policy explains how we collect, use, share, and protect personal information when you visit spearfish.ai (the "Site"), interact with us, or use our products and services (the "Services"), and describes the rights and choices available to you. This policy should be read together with our Terms & Conditions, which govern use of the Services.

If you have questions at any point, contact us at privacy@spearfish.ai.

1. Information We Collect

Information you provide to us. When you fill out a contact or demo form, subscribe to updates, email us, or otherwise communicate with us, we collect the information you choose to share — typically your name, work email address, company, phone number, job title, and the contents of your message.

Account information and user identifiers. If your organization gives you access to the Services, we collect the information needed to create and operate your account: your name, username, work email address, role, and organization. Your username and name may be visible to other users within your organization's workspace and may appear alongside your activity in the Services — for example in interaction records, notes, and audit logs. We use these identifiers consistent with this Privacy Policy, as described in our Terms & Conditions.

Information collected automatically. When you visit the Site, we and our service providers automatically collect information about your device and how you interact with the Site: your approximate location and IP address (which we shorten before storing, so it identifies a network rather than a device), browser type, operating system, referring pages, the marketing campaign that brought you to us, the pages you view and when, how long you actively engage with each page, how far you scroll, the sections you spend time reading, and the links you click. We collect this using cookies and similar technologies, as described in Section 5, and only where you have not declined.

Information we process on behalf of our clients ("Service Data"). When organizations use the Spearfish platform, we process customer-interaction data on their behalf — for example call recordings, transcripts, chat messages, and related metadata belonging to our clients and their customers. We process Service Data as a service provider/processor under our agreements with each client; see Section 7.

We do not intentionally collect sensitive personal information through the Site, and we ask that you not submit it through our forms.

2. Customer Content: Ownership and License

You (or the organization you belong to) retain ownership of the content you submit to the Services. As described in our Terms & Conditions, you grant Spearfish a non-exclusive license to use that content only to provide, support, and improve the Services for you, consistent with this Privacy Policy and your privacy preferences. We do not claim ownership of customer content, and we do not use it for our own marketing or sell it. This license ends when your content is deleted or your account is terminated, subject to the limited retention exceptions in Section 6.

3. How We Use Information

We use the information described above to:

• provide, operate, secure, and improve the Site and the Services, under the limited license described in Section 2;
• respond to inquiries, schedule demos, and communicate with you about products, services, and events;
• understand how visitors use the Site so we can improve content and performance;
• understand the interests and business needs of organizations that contact us, so that our follow-up is relevant;
• comply with legal obligations and enforce our agreements, including our Terms & Conditions and acceptable-use rules; and
• detect, investigate, and prevent security incidents, fraud, and abuse.

Where the EU or UK General Data Protection Regulation ("GDPR") applies, our legal bases for processing are: performance of a contract, our legitimate interests (such as operating and securing the Site and marketing our Services), your consent where required (which you may withdraw at any time), and compliance with legal obligations.

4. How We Share Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We share personal information only with:

• Service providers that perform services on our behalf — such as cloud hosting, analytics, email, and scheduling — under contracts that limit their use of the information to providing those services;
• Professional advisors such as lawyers, auditors, and insurers where necessary;
• Authorities or other parties when required by law, or to protect the rights, safety, or property of Spearfish, our clients, or others, including to investigate and enforce our Terms & Conditions and acceptable-use rules (which prohibit unlawful content, spam, privacy violations, and harvesting of user data); and
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

5. Cookies, Analytics, and Your Choices

Essential cookies. The Site uses a small number of cookies needed for it to function — for example to keep you signed in to a customer portal, and to remember your cookie choice so we can honor it. These are always active.

Two analytics systems, with different purposes. Spearfish operates a first-party analytics system within Spearfish-controlled systems. We also use Google Analytics separately to understand aggregate website and marketing performance. They are kept apart:

• Spearfish first-party analytics. We set a cookie containing a random identifier — not your name or email — that lets us recognize the same browser on later visits. Using it we record which pages you view and when, how long you actively spend on each, how far down a page you read, which sections you spend time on, and links you click. This information is held in Spearfish-controlled systems and our approved sales tools. It is not sold, not shared for advertising, and not sent to a data broker.
• Google Analytics. Google sets its own cookies and collects information such as your IP address and the pages you visit, which helps us understand aggregate site and campaign performance. We do not send Google Analytics your name, email address, form contents, or any Spearfish or CRM identifier. You can read how Google uses this data at policies.google.com/technologies/partner-sites and opt out using the Google Analytics opt-out browser add-on.

Where we ask first. If you are in the European Economic Area, the United Kingdom, Switzerland, or Brazil, we ask for your permission before setting any non-essential cookie or starting either analytics system, and nothing is stored on your device until you choose. Elsewhere, including the United States, analytics operate by default and you may decline at any time.

Browser privacy signals. The Site honors the Global Privacy Control (GPC) signal and "Do Not Track" browser settings everywhere, whatever your location. If your browser sends either, we do not set analytics cookies, do not record your visit, do not connect your visit to a contact, and do not ask you to.

Changing your mind. The Cookie preferences link in the Site footer is available on every page, in every region. Declining stops future collection and removes the analytics identifier from your browser. Declining does not by itself erase records we have already stored — to request that, see Section 9.

5a. Connecting Website Activity With Business Contacts

If you are outside the European Economic Area, the United Kingdom, Switzerland, and Brazil, and you have not declined analytics or sent a browser privacy signal, then when you voluntarily submit a form we may connect the activity associated with your browser's first-party identifier to the information you provide.

This may include the pages you viewed, the sequence and timing of your visits, how you engaged with content, the calls to action you clicked, the campaign or referrer that brought you to us, your approximate geography, and information you supply about your industry, the systems you use, and your business needs — including through a chatbot or guided intake experience.

We do this to understand your organization's interests, identify the industries and systems relevant to you, understand your stated and inferred business needs, improve our sales follow-up, and make our communications more relevant. This association stays within Spearfish-controlled systems and our approved sales and CRM tools. It is never sent to Google Analytics.

If you are in the European Economic Area, the United Kingdom, Switzerland, or Brazil, we do not make this connection. Your form submission is handled as an ordinary business inquiry; it is not joined to your previous browsing history on the Site.

Email engagement. When we send business or marketing emails, our email service provider may tell us whether an email was opened or a link was clicked. In some cases, subsequent activity on our website may be associated with the business contact who received the email. We use this information to measure our communications and personalize appropriate business follow-up.

6. Data Retention, Account Deletion, and Termination

We retain pseudonymous website analytics for a limited period that allows us to evaluate website and campaign performance. When website activity is associated with a known business contact, we generally retain the detailed browsing activity for a shorter period and may retain summarized business interests as part of the contact's ordinary business relationship with Spearfish. We retain information only as long as reasonably necessary for the purposes described in this policy, legal requirements, security, and the establishment or defense of legal claims.

When you delete your account or content. You may delete your content or terminate your account as described in our Terms & Conditions, which ends the license in Section 2. When an account is deleted or an agreement terminates, we delete or de-identify the associated content and account information within 30 days, and it is purged from routine backups within 90 days thereafter.

Limited exceptions. We may retain specific information after deletion where reasonably necessary to: comply with legal, tax, or accounting obligations; resolve disputes; investigate or enforce our Terms & Conditions and acceptable-use rules; maintain security records of a violation or incident; or complete transactions you requested. Information retained under these exceptions is kept only as long as the underlying need exists and remains protected under this policy.

Service Data is retained according to each client's agreement and instructions, and is deleted or returned as those agreements require.

7. Our Role in Processing Client Data

Our clients — the organizations that use the Spearfish platform — are the controllers (or "businesses") of the Service Data we process for them. Spearfish processes Service Data only under each client's instructions and agreement, does not use it to market to anyone, and does not sell it. If you have interacted with an organization that uses Spearfish and want to exercise privacy rights over those interactions, please contact that organization directly; we support our clients in responding to such requests as their agreements require.

8. Security

We maintain an information security program with administrative, technical, and physical safeguards designed to protect personal information — including encryption of data in transit, access controls, personnel screening, and security policies our team is required to follow. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; if we learn of a breach affecting your personal information, we will notify you and regulators as required by law.

9. Your Rights and Choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct inaccurate personal information;
• delete your personal information (see Section 6 for what happens after deletion);
• object to or restrict certain processing, or withdraw consent where processing is based on consent; and
• portability — receive certain information in a usable format.

There are two distinct controls, and they do different things:

• Declining analytics — through the Cookie preferences link in the Site footer, or by sending a browser privacy signal — stops future collection and removes the analytics identifier and related cookies from your browser. It does not, by itself, erase records already stored in our systems.
• Requesting deletion — by emailing us — asks us to remove eligible records we already hold.

To exercise any of these rights, email privacy@spearfish.ai. We will verify your request and respond within the timeframe required by applicable law, and we will not discriminate against you for exercising your rights. You may also opt out of marketing emails at any time using the unsubscribe link in the email or by contacting us.

California and other U.S. state residents. State privacy laws, including the California Consumer Privacy Act (CCPA/CPRA), may give you the rights listed above. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We honor the Global Privacy Control signal as an opt-out. You may designate an authorized agent to submit requests on your behalf.

EEA, UK, and Switzerland residents. In addition to the rights above, you may lodge a complaint with your local supervisory authority, though we would welcome the chance to address your concerns first.

10. International Transfers

Spearfish is based in the United States, and the information we collect is processed in the United States, where privacy laws may differ from those in your jurisdiction. Where we transfer personal information from the EEA, UK, or Switzerland, we use appropriate safeguards such as standard contractual clauses.

11. Children's Privacy

The Site and Services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children; if you believe a child has provided us personal information, contact us and we will delete it.

12. Third-Party Sites

The Site may link to third-party websites and services we do not control. Their privacy practices are governed by their own policies, which we encourage you to review.

13. Changes to This Policy

We review this policy at least annually and update it when our practices change. When we make changes, we will post the updated policy here and revise the "Last reviewed" date at the top of this page; for material changes, we will provide additional notice where required.

14. Contact Us

Spearfish Group, Inc.
330 Rush Alley #220
Columbus, OH 43215
privacy@spearfish.ai