Privacy Policy

Spearfish Group, Inc. ("Spearfish," "we," "us," or "our") provides an AI platform that helps organizations run their contact centers and customer operations. This Privacy Policy explains how we collect, use, share, and protect personal information when you visit spearfish.ai (the "Site"), interact with us, or use our products and services (the "Services"), and describes the rights and choices available to you. This policy should be read together with our Terms & Conditions, which govern use of the Services.

If you have questions at any point, contact us at privacy@spearfish.ai.

1. Information We Collect

Information you provide to us. When you fill out a contact or demo form, subscribe to updates, email us, or otherwise communicate with us, we collect the information you choose to share — typically your name, work email address, company, phone number, job title, and the contents of your message.

Account information and user identifiers. If your organization gives you access to the Services, we collect the information needed to create and operate your account: your name, username, work email address, role, and organization. Your username and name may be visible to other users within your organization's workspace and may appear alongside your activity in the Services — for example in interaction records, notes, and audit logs. We use these identifiers consistent with this Privacy Policy, as described in our Terms & Conditions.

Information collected automatically. When you visit the Site, we and our service providers automatically collect certain information about your device and how you interact with the Site, such as IP address, browser type, operating system, referring pages, pages viewed, and the dates and times of visits. We collect this information using cookies and similar technologies, including Google Analytics (see Section 5).

Information we process on behalf of our clients ("Service Data"). When organizations use the Spearfish platform, we process customer-interaction data on their behalf — for example call recordings, transcripts, chat messages, and related metadata belonging to our clients and their customers. We process Service Data as a service provider/processor under our agreements with each client; see Section 7.

We do not intentionally collect sensitive personal information through the Site, and we ask that you not submit it through our forms.

2. Customer Content: Ownership and License

You (or the organization you belong to) retain ownership of the content you submit to the Services. As described in our Terms & Conditions, you grant Spearfish a non-exclusive license to use that content only to provide, support, and improve the Services for you, consistent with this Privacy Policy and your privacy preferences. We do not claim ownership of customer content, and we do not use it for our own marketing or sell it. This license ends when your content is deleted or your account is terminated, subject to the limited retention exceptions in Section 6.

3. How We Use Information

We use the information described above to:

• provide, operate, secure, and improve the Site and the Services, under the limited license described in Section 2;
• respond to inquiries, schedule demos, and communicate with you about products, services, and events;
• understand how visitors use the Site so we can improve content and performance;
• comply with legal obligations and enforce our agreements, including our Terms & Conditions and acceptable-use rules; and
• detect, investigate, and prevent security incidents, fraud, and abuse.

Where the EU or UK General Data Protection Regulation ("GDPR") applies, our legal bases for processing are: performance of a contract, our legitimate interests (such as operating and securing the Site and marketing our Services), your consent where required (which you may withdraw at any time), and compliance with legal obligations.

4. How We Share Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We share personal information only with:

• Service providers that perform services on our behalf — such as cloud hosting, analytics, email, and scheduling — under contracts that limit their use of the information to providing those services;
• Professional advisors such as lawyers, auditors, and insurers where necessary;
• Authorities or other parties when required by law, or to protect the rights, safety, or property of Spearfish, our clients, or others, including to investigate and enforce our Terms & Conditions and acceptable-use rules (which prohibit unlawful content, spam, privacy violations, and harvesting of user data); and
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to this Privacy Policy.

5. Cookies and Analytics

The Site uses essential cookies needed for it to function, and analytics cookies via Google Analytics, which helps us understand aggregate Site usage. Google Analytics sets cookies that collect information such as your IP address and pages visited. You can learn how Google uses this data at policies.google.com/technologies/partner-sites, and opt out using the Google Analytics opt-out browser add-on.

You can also control cookies through your browser settings, including blocking or deleting them. The Site does not currently respond to "Do Not Track" browser signals.

6. Data Retention, Account Deletion, and Termination

We keep personal information only as long as needed for the purposes described in this policy — for example, for as long as we have an active relationship or conversation with you, and afterward as required to meet legal, accounting, or reporting obligations.

When you delete your account or content. You may delete your content or terminate your account as described in our Terms & Conditions, which ends the license in Section 2. When an account is deleted or an agreement terminates, we delete or de-identify the associated content and account information within 30 days, and it is purged from routine backups within 90 days thereafter.

Limited exceptions. We may retain specific information after deletion where reasonably necessary to: comply with legal, tax, or accounting obligations; resolve disputes; investigate or enforce our Terms & Conditions and acceptable-use rules; maintain security records of a violation or incident; or complete transactions you requested. Information retained under these exceptions is kept only as long as the underlying need exists and remains protected under this policy.

Service Data is retained according to each client's agreement and instructions, and is deleted or returned as those agreements require.

7. Our Role in Processing Client Data

Our clients — the organizations that use the Spearfish platform — are the controllers (or "businesses") of the Service Data we process for them. Spearfish processes Service Data only under each client's instructions and agreement, does not use it to market to anyone, and does not sell it. If you have interacted with an organization that uses Spearfish and want to exercise privacy rights over those interactions, please contact that organization directly; we support our clients in responding to such requests as their agreements require.

8. Security

We maintain an information security program with administrative, technical, and physical safeguards designed to protect personal information — including encryption of data in transit, access controls, personnel screening, and security policies our team is required to follow. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; if we learn of a breach affecting your personal information, we will notify you and regulators as required by law.

9. Your Rights and Choices

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy;
• correct inaccurate personal information;
• delete your personal information (see Section 6 for what happens after deletion);
• object to or restrict certain processing, or withdraw consent where processing is based on consent; and
• portability — receive certain information in a usable format.

To exercise any of these rights, email privacy@spearfish.ai. We will verify your request and respond within the timeframe required by applicable law, and we will not discriminate against you for exercising your rights. You may also opt out of marketing emails at any time using the unsubscribe link in the email or by contacting us.

California and other U.S. state residents. State privacy laws, including the California Consumer Privacy Act (CCPA/CPRA), may give you the rights listed above. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. You may designate an authorized agent to submit requests on your behalf.

EEA, UK, and Switzerland residents. In addition to the rights above, you may lodge a complaint with your local supervisory authority, though we would welcome the chance to address your concerns first.

10. International Transfers

Spearfish is based in the United States, and the information we collect is processed in the United States, where privacy laws may differ from those in your jurisdiction. Where we transfer personal information from the EEA, UK, or Switzerland, we use appropriate safeguards such as standard contractual clauses.

11. Children's Privacy

The Site and Services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal information from children; if you believe a child has provided us personal information, contact us and we will delete it.

12. Third-Party Sites

The Site may link to third-party websites and services we do not control. Their privacy practices are governed by their own policies, which we encourage you to review.

13. Changes to This Policy

We review this policy at least annually and update it when our practices change. When we make changes, we will post the updated policy here and revise the "Last reviewed" date at the top of this page; for material changes, we will provide additional notice where required.

14. Contact Us

Spearfish Group, Inc.
330 Rush Alley #220
Columbus, OH 43215
privacy@spearfish.ai