Privacy Policy

Sarza AI ("Company," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website sarza.ai, use our services, and communicate with us.

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our services. By accessing or using Sarza AI, you acknowledge that you have read, understood, and agree to be bound by all the provisions of this Privacy Policy.

1. Information We Collect

1.1 Information You Provide Directly

We collect information you voluntarily provide when you:

• Contact us: Name, email address, phone number, company name, and message content when you use our contact form, email us, or call us
• Request a consultation: Information submitted through our AI Assessment, Calculator, or booking form, including business details and service preferences
• Subscribe to communications: Email address when you opt in to our newsletter, blog updates, or promotional communications
• Make a payment: Billing information processed through Stripe (payment processor). We do not store full credit card details; Stripe handles all payment processing securely
• Participate in surveys or feedback: Responses to surveys, feedback forms, or user research initiatives

1.2 Information Collected Automatically

When you visit our website or use our services, we automatically collect:

• Device information: IP address, browser type and version, operating system, device type, and unique device identifiers
• Usage data: Pages visited, time spent on each page, links clicked, referring/exit pages, and interaction patterns
• Cookies and tracking technologies: See Section 5 below for details
• Location data: Approximate geographic location based on IP address (not precise GPS)

1.3 Information from Third Parties

We may receive information about you from:

• GoHighLevel: Our customer relationship management and marketing automation platform (as a data processor)
• Stripe: Payment processor providing payment confirmation and transaction details
• Social media: If you interact with us on social platforms (e.g., Facebook, X/Twitter), publicly available profile information
• Analytics providers: Aggregated and anonymized usage data from Google Analytics and similar tools
• Referral sources: Information provided by users who refer you to our services

1.4 SMS and Mobile Communications

If you opt in to receive SMS messages:

• We collect your mobile phone number and carrier information
• You provide explicit consent to receive SMS communications (see Section 3 below)
• Consent is documented and retained for compliance purposes

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Service Delivery

• Processing and fulfilling your requests, consultations, and service agreements
• Providing customer support and responding to your inquiries
• Managing your account and billing
• Delivering AI assessments, calculations, and personalized recommendations
• Integrating third-party services (GoHighLevel, Stripe, etc.) to provide a seamless experience

2.2 Marketing and Communications

• Sending promotional emails, newsletters, and product updates (only if you opt in)
• Communicating about new services, features, or improvements
• Conducting market research and gathering user feedback
• Personalizing your experience and providing relevant content

2.3 Legal and Business Operations

• Complying with legal obligations and regulatory requirements
• Enforcing our Terms of Service and other agreements
• Protecting our legal rights and preventing fraud or misuse
• Maintaining security and detecting cyber threats
• Conducting audits and internal reviews

2.4 Analytics and Improvement

• Analyzing user behavior to improve our website and services
• Understanding which features are most valuable
• Optimizing performance, accessibility, and user experience
• Monitoring website health and troubleshooting technical issues

3. SMS & Communications (A2P 10DLC Compliance)

3.1 SMS Opt-In and Consent

When you opt in to receive SMS messages from Sarza AI, you explicitly agree to receive text messages at the mobile phone number you provide.

• Explicit consent: Your opt-in constitutes written affirmative consent under the Telephone Consumer Protection Act (TCPA) and related regulations
• Documented consent: We maintain a record of your consent, including the date, time, and method of opt-in
• Standard message rates apply: Your wireless carrier's standard SMS rates may apply. Message frequency varies based on your preferences and interactions

3.2 What You May Receive

If you opt in, you may receive:

• Transactional messages (order confirmations, appointment reminders, password resets)
• Appointment and consultation reminders
• Important service notifications and updates
• Promotional and marketing messages (only if separately opted in)
• Responses to your inquiries and requests

3.3 SMS Opt-Out Instructions

You may opt out of SMS communications at any time by:

• Replying to any SMS with the word "STOP" (standard for all text providers)
• Contacting us at hello@sarza.ai or calling (719) 483-1694
• Visiting your account preferences if available through our service portal

Once you opt out, we will cease sending SMS messages within one business day, except as required by law (e.g., critical security alerts).

3.4 Text HELP for Information

Text "HELP" to any of our SMS campaigns to receive additional information about our services and how to manage your preferences.

3.5 SMS Data and Privacy

CRITICAL: Your mobile phone number and SMS consent records are NOT shared with third parties, affiliates, or other marketers for any purpose.

• SMS data is processed exclusively by Sarza AI for the purposes described above
• GoHighLevel (our platform provider) processes SMS data only as a data processor under our direction
• We do not sell, lease, trade, or license SMS subscriber data
• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes
• SMS data is retained only as long as necessary to fulfill the purposes described or as required by law

3.6 Age Restriction

SMS communications are only intended for individuals 18 years of age or older. If you are under 18, do not opt in to SMS communications.

4. Data Sharing and Disclosure

4.1 Who We Share Information With

We only share your information in the following circumstances:

Service Providers and Data Processors

• GoHighLevel: Our customer relationship management platform. GoHighLevel processes data under a Data Processing Agreement (DPA) and acts only on our instructions. They assist with email, SMS, CRM, and automation services
• Stripe: Our payment processor. Stripe processes billing information under their own privacy policy and PCI DSS compliance standards
• Google Analytics: Provides aggregated, anonymized analytics about website traffic and user behavior

Legal Compliance

• When required by law, court order, subpoena, or government request
• To protect our legal rights and enforce our Terms of Service
• To prevent fraud, abuse, or other illegal activity
• To protect the safety and security of our users and service

Business Transfers

If Sarza AI is acquired, merges with another company, or undergoes bankruptcy, your information may be transferred as part of that transaction. We will provide notice if this occurs.

4.2 Third-Party Links and Services

Our website may contain links to third-party websites and services that are not operated by us. This Privacy Policy does not apply to third-party services, and we are not responsible for their privacy practices. We encourage you to review their privacy policies before providing any personal information.

4.3 No Marketing Sharing of SMS Data

We explicitly do NOT:

• Share your phone number with affiliates, partners, or resellers for marketing purposes
• Allow third parties to contact you using your SMS information
• Combine your SMS data with other services for cross-marketing
• Sell, trade, or license SMS subscriber lists

5. Cookies and Tracking Technologies

5.1 What Are Cookies?

Cookies are small text files stored on your device that contain information about your browsing activity. We use cookies and similar technologies to improve your experience and understand how you use our website.

5.2 Types of Cookies We Use

• Essential cookies: Required for website functionality (e.g., authentication, security)
• Performance cookies: Help us understand how you use our site (e.g., Google Analytics)
• Marketing cookies: Track your interactions for targeted content and retargeting ads

5.3 Third-Party Tracking

We may allow third-party analytics and advertising partners to place cookies on our website. These include:

• Google Analytics for usage analytics
• Facebook Pixel for conversion tracking and retargeting
• Other standard marketing and analytics tools

5.4 Your Cookie Preferences

Most browsers allow you to refuse cookies or alert you when a cookie is being sent. You can manage cookie preferences through your browser settings. Note that blocking essential cookies may affect website functionality.

6. Data Security

6.1 Security Measures

We implement industry-standard security measures to protect your information, including:

• SSL/TLS encryption for data in transit
• Secure server infrastructure and firewalls
• Access controls and authentication protocols
• Regular security audits and vulnerability assessments
• Employee training on data protection and privacy

6.2 Payment Security

All payment processing is handled by Stripe, which complies with PCI DSS (Payment Card Industry Data Security Standard). We do not store credit card information on our servers.

6.3 Data Breach Notification

If we discover a security breach affecting your personal information, we will notify affected users without unreasonable delay and as required by applicable law. Notifications will include details about the breach, what information was affected, and steps you can take to protect yourself.

6.4 Limitations

While we implement strong security measures, no system is 100% secure. We cannot guarantee absolute security of your information. Your use of our services is at your own risk.

7. Third-Party Services and Data Processors

7.1 GoHighLevel as Data Processor

GoHighLevel is our primary data processor for:

• Customer relationship management (CRM)
• Email and SMS communications
• Marketing automation
• Lead management and tracking

Data Processing Agreement: We maintain a Data Processing Agreement (DPA) with GoHighLevel that ensures:

• GoHighLevel processes data only on our instructions
• GoHighLevel implements appropriate security measures
• GoHighLevel does not use your data for their own marketing purposes
• Data is deleted or returned upon termination of services

7.2 Stripe Payment Processing

Stripe processes all payment information. Stripe maintains its own privacy policy and complies with PCI DSS standards. For details, visit stripe.com/privacy.

7.3 Analytics Providers

We use Google Analytics to collect anonymized, aggregated usage data. Google Analytics does not identify individuals; data is used solely for understanding user trends and optimizing our website.

8. Your Privacy Rights

8.1 General Rights

You have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your information (subject to legal exceptions)
• Opt out of marketing communications at any time
• Port your data to another service (where applicable)

8.2 GDPR Rights (European Residents)

If you are located in the European Union or European Economic Area, you have additional rights under the General Data Protection Regulation (GDPR):

• Right to access: Request a copy of your personal data
• Right to rectification: Correct inaccurate data
• Right to erasure: Request deletion of your data ("right to be forgotten")
• Right to restrict processing: Limit how we use your data
• Right to data portability: Receive your data in a portable format
• Right to object: Object to marketing, profiling, or automated decision-making
• Right to lodge a complaint: File a complaint with your local data protection authority

8.3 CCPA Rights (California Residents)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know: Request what personal information we collect and how we use it
• Right to delete: Request deletion of personal information we have collected (with exceptions)
• Right to opt-out: Opt out of the sale or sharing of personal information
• Right to correct: Request correction of inaccurate personal information
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights

8.4 How to Exercise Your Rights

To exercise any of the rights above, contact us at:

Email: hello@sarza.ai
Mail: Sarza AI, Sarza AI, 5535 South Elmwood St, Littleton, CO 80120

We will respond to verified requests within 30 days (or as required by applicable law). We may request additional information to verify your identity before processing your request.

8.5 Authorized Representatives

If you are a California resident, you may authorize another person or business to submit a privacy request on your behalf. We will require written authorization and verification of the authorized representative's identity.

9. Data Retention

9.1 How Long We Keep Your Data

We retain your information only for as long as necessary to provide our services or comply with legal obligations:

• Account information: Retained for the duration of our business relationship and for 3 years after termination, unless required by law
• SMS consent records: Retained for at least 4 years (TCPA requirement) or longer if required by law
• Marketing communications: Retained until you opt out, then deleted within 30 days
• Payment information: Not retained by us; handled and retained by Stripe per their policies
• Analytics data: Aggregated and anonymized data retained for 26 months (Google Analytics default)

9.2 Deletion and Anonymization

Upon request, we will delete or anonymize your personal information, except where we are required to retain it by law or for legitimate business purposes (e.g., fraud prevention, legal compliance).

10. International Data Transfers

Sarza AI is based in the United States. If you are located outside the United States, your information may be transferred to, processed in, and stored in the United States, which may have different data protection laws than your country of residence.

By using our services, you consent to the transfer of your information to the United States and other countries where we or our service providers operate. We implement safeguards such as Standard Contractual Clauses to protect international data transfers.

11. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have collected information from a child under 18, we will delete such information promptly.

If you believe we have collected information from a child under 18, please contact us immediately at hello@sarza.ai.

12. Contact Information

12.1 Privacy Questions

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Sarza AI
Email: hello@sarza.ai
Website: sarza.ai
Mailing Address: Sarza AI, 5535 South Elmwood St, Littleton, CO 80120

12.2 Data Protection Officer (DPO)

For GDPR-related inquiries, you may contact our Data Protection Officer at hello@sarza.ai.

12.3 Regulatory Complaints

EU residents: You have the right to lodge a complaint with your local data protection authority (DPA).

California residents: You may file a complaint with the California Attorney General's office.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated Privacy Policy on our website with an updated "Last Updated" date
• Sending you an email notification if the changes affect how we handle your information
• Requiring your explicit consent if required by law

Your continued use of our services after changes are posted constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically to stay informed about how we protect your information.

14. Acknowledgment and Consent

By accessing Sarza AI and providing your information, you acknowledge that:

• You have read and understood this Privacy Policy
• You consent to the collection, use, and disclosure of your information as described herein
• You agree to comply with all applicable laws and regulations
• You understand the risks of online communication and assume responsibility for maintaining the confidentiality of your account credentials

If you do not agree with this Privacy Policy, please do not use our services.

⚠️ Legal Disclaimer: This Privacy Policy is provided for informational purposes and should not be considered legal advice. Laws regarding data protection, privacy, and SMS communications vary by jurisdiction and change frequently. We recommend having a qualified attorney review this policy to ensure it complies with all applicable laws in your jurisdiction before publication. Sarza AI is not responsible for any legal consequences resulting from the use of this policy without proper legal review.