Privacy Policy
Effective Date: October 18, 2026 · Version privacy-2026-12
Big Sister AI Company ("Big Sister AI", "we", "us") is a Delaware corporation. This Privacy Policy explains what personal information we collect through our website at https://www.big-sister.ai and our sales-performance platform at https://app.big-sister.ai (together, the "Services"), how we use and share it, how long we keep it, and the choices you have.
1. Two roles, two sets of rules
We handle personal information in two different capacities, and it matters which one applies to you.
We are the controller for information about website visitors, people who create or use an account, prospects who contact us, and people we correspond with. Sections 2 to 11 describe that processing.
We are a processor for Customer Content: the call and meeting recordings, transcripts, CRM records, call logs (telephone numbers and call metadata, including for calls that were not answered) and derived scores that a Customer connects to the platform so that we can analyze its sales conversations. The Customer decides what to connect and why, and is the controller of that data. We process it only under the Customer's instructions and the Data Processing Agreement, which forms part of our Terms of Service. Section 12 explains what this means if you took part in a call that a Customer recorded.
2. Information we collect as controller
Account information. When a workspace is created or you are invited into one: your name, work email address, password (stored hashed), company name, job title and role in the workspace, and the time zone and settings you choose.
Billing information. Company name, billing contact and billing address. Card details are entered directly into Stripe's checkout and are held by Stripe, never by us. We receive the card brand, last four digits and expiry for display.
Acceptance records. The version of the Terms of Service you accepted, the time you accepted it and the IP address you accepted it from.
Usage and device information. IP address, browser and device type, pages and features used, timestamps, and error reports. In the platform this includes product-analytics events keyed on your email address (see Section 6).
Communications. What you send us by email, through support, or through forms on the website, including the waitlist and demo request forms.
Website assistant conversations. If you talk to Mila, the AI assistant on our website, by text or by voice: what you type or say, Mila's replies, and, for a voice conversation, a recording of it. Before the conversation starts we tell you that Mila is an AI and that the conversation is recorded. If you ask for a callback through the form Mila shows, the name, email address or phone number, preferred time and note you enter.
Connected-source credentials. When a Customer connects a notetaker, dialer or CRM, we store the API key or OAuth token needed to read from it, in a managed secrets store. We treat credentials as confidential and delete them when the connection is removed.
We do not collect precise geolocation, biometric identifiers, government identification numbers, health information or financial account numbers, and we ask that you do not send them to us.
3. How we use it
- To create and run your workspace, authenticate you, and deliver the features you use.
- To bill you and keep the records that tax and accounting law require.
- To respond to you, send service notices, and tell you about changes to the Services or these terms.
- To send product updates and marketing email to account holders and people who asked to hear from us. Every such email has an unsubscribe link, and opting out does not affect service notices.
- To monitor performance, find and fix errors, and understand which features are used, so we can improve the Services.
- To protect the Services, prevent fraud and abuse, enforce our agreements, and comply with law.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
4. Artificial intelligence
The platform uses third-party large language models to score and summarize sales conversations. Those models run on infrastructure we contract for (currently Microsoft Azure AI Foundry) on terms under which the inputs are not used to train the vendor's models. We do not use Customer Content, or any personal information, to train, fine-tune or develop artificial intelligence or machine learning models, whether or not aggregated or de-identified. We do not build our own models. The vendors involved are listed on our subprocessor page.
Scores and coaching output are generated automatically and can be wrong. Our Terms of Service require Customers to apply human judgment before acting on them.
Mila, the website assistant. Mila is an AI agent that runs on ElevenLabs' conversational platform with a third-party language model, on terms under which the inputs are not used to train the vendor's models. Mila answers from material we approve, does not quote prices, and cannot act on your behalf: a callback request goes through a form you fill in yourself, and nothing is sent to anyone until you submit it. Our team reads conversations with Mila to check her answers, and each conversation is scored by the same system that scores our Customers' sales conversations, so that our own AI is measured the way their representatives are. Mila's answers can be wrong; a person confirms anything that matters before you rely on it.
The Claude connector. A Customer's users can connect their Big Sister AI account to Claude, a service of Anthropic, PBC, through a connector we operate at mcp.big-sister.ai. The connector is read-only. It retrieves the scores, calls, transcripts and reports that the user can already see in the platform, and it cannot change anything. The user signs in with their own account through OAuth, and every request carries that user's own access, so the connector shows no one more than the platform would. We receive the parameters of each request (for example a rep or a date range), not the user's Claude conversation, and the connector does not read Claude's memory, chat history or files. When the user asks a question, the connector returns the relevant Customer Content to Claude, and from that point Anthropic handles it under the user's own agreement with Anthropic and not as our subprocessor. Customer Content returned through the connector remains Customer Content under the Data Processing Agreement. A user can disconnect at any time in Claude's connector settings, which ends access immediately. Setup and usage are described in the connector guide.
5. How we share it
- Service providers (subprocessors). Companies that host, store, monitor or support the Services on our behalf, listed with their locations and purposes at https://www.big-sister.ai/subprocessors. Each is bound by written terms to use the information only to provide its service to us.
- Payment processor. Stripe, Inc. processes payments under its own privacy policy.
- Professional advisers. Lawyers, accountants and auditors, under confidentiality.
- Legal requirements. If required by law, subpoena or court order, or where we believe in good faith that disclosure is necessary to protect the rights, safety or property of Big Sister AI, our Customers or others. If we receive a government request for Customer Content we will tell the Customer unless the law prohibits it.
- Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction. We will notify affected account holders by email before their information becomes subject to a different privacy policy.
- With your direction. When you ask us to share information, for example by connecting a tool.
6. Cookies and analytics
Website (www.big-sister.ai). We use Google Consent Mode v2 with every storage category set to denied until you choose. A banner offers Accept or Decline; your choice is stored in your browser (bs_consent) and can be changed at any time from the footer. Until you accept, Google Tag Manager runs without cookies and Microsoft Clarity is not loaded. If you accept, Google Analytics and Microsoft Clarity set cookies to measure traffic and record anonymized session interactions. Ahrefs Web Analytics runs without cookies and without identifying you, whether or not you accept. The website assistant stores your consent to talk to it in your browser's local storage (bs_mila_consent) and sets no cookie.
Platform (app.big-sister.ai). We use PostHog for product analytics (which pages and features are used, keyed on your account email) and Sentry for error monitoring (which does not capture personal data beyond a tenant identifier). We use cookies and local storage for sign-in and preferences. There is no advertising tracking in the platform.
You can block cookies in your browser; the platform's sign-in will not work without its own cookies.
7. How long we keep it
| Information | Retention |
|---|---|
| Account and workspace information | For the life of the workspace, then deleted within 30 days after the workspace is closed |
| Acceptance records | For the life of the workspace plus the period needed to defend legal claims |
| Billing records and invoices | As long as tax and accounting law require |
| Usage and product-analytics events | 12 months |
| Support and other correspondence | 24 months after the thread closes |
| Website assistant conversations (text, voice, callback requests) | Recordings and transcripts: 30 days at the voice vendor. The transcript and its score that we keep: as for Customer Content below. Callback requests: as for support correspondence |
| Customer Content (recordings, transcripts, CRM records, call logs, scores) | As set out in the Data Processing Agreement: deleted 24 months after collection, or within 30 days after the Customer's subscription ends, whichever comes first. The automated lifecycle rules that enforce the 24-month limit are being deployed; until they are in operation, deletion on that timetable is carried out by documented operational process |
| Encrypted backups | Rolled off no later than 35 days after the primary copy is deleted |
8. Security
We protect information with encryption in transit (TLS 1.2 or above) and at rest, individual named accounts with least-privilege access, multi-factor authentication for administrative access to our cloud environment, central logging of infrastructure and administrative activity, automated threat detection, encrypted backups with tested restores, and continuous dependency monitoring. The full list of measures, and their current state, is in Annex 2 of the Data Processing Agreement. No system is perfectly secure; if a security incident affects your information we will notify you as the law and our agreements require.
9. Where we process it
Our Services are hosted in the United States. Our personnel who support and maintain the Services are located in the United States and Ukraine and access information under the controls in Section 8. If you use the Services from outside the United States, your information is transferred to and processed in the United States. Where the GDPR or UK GDPR applies to Customer Content, the Data Processing Agreement provides for Standard Contractual Clauses.
10. Your rights and choices
Depending on where you live, you may have the right to know what personal information we hold about you, to receive a copy, to correct it, to delete it, to restrict or object to certain processing, to receive it in a portable form, and to not be discriminated against for exercising these rights.
California (CCPA/CPRA). You have the rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit. You may use an authorized agent; we will ask for proof of authorization.
Texas (TDPSA), Virginia, Colorado, Connecticut and other US states with comprehensive privacy laws. You have the rights to access, correct, delete, obtain a copy, and opt out of targeted advertising, sale and profiling in furtherance of decisions that produce legal or similarly significant effects. We do none of those three. If we deny a request you may appeal by replying to our response; we will answer the appeal within 60 days and tell you how to contact your state attorney general if you disagree.
European Economic Area, United Kingdom and Switzerland (if applicable). Our lawful bases are performance of a contract (account and billing), legitimate interests (security, analytics, improving the Services, business-to-business marketing) and consent (website cookies, marketing to non-customers). You may withdraw consent at any time and you may complain to your supervisory authority.
How to exercise a right. Email notices@big-sister.ai from the address on your account, or write to the address in Section 14. We verify requests by matching them to the account and, where needed, by asking you to confirm from that email address. We respond within 45 days, and will tell you if we need more time. Requests are free unless they are manifestly unfounded or excessive.
Marketing. Use the unsubscribe link in any marketing email, or email us.
11. Children
The Services are for businesses and are not directed to anyone under 16. We do not knowingly collect personal information from children. If you believe a child has given us personal information, email notices@big-sister.ai and we will delete it.
12. If you were on a call, or called a Customer
Our Customers use the platform to analyze their own sales conversations. If you spoke with one of our Customers on a recorded call or meeting, that recording, its transcript and any scores derived from it are Customer Content. The Customer is responsible under our Terms of Service for obtaining any consent the law requires before recording, and is the controller of that data. We process it only on the Customer's instructions, do not use it for our own purposes, do not use it to train models, and delete it on the schedule in Section 7. To access, correct or delete your data in a recording, contact the company you spoke with. If you contact us instead, we will forward your request to that Customer and help them respond.
If you called one of our Customers, or one of them called you, and the call was not answered or not recorded, the telephone number and call details (time, direction, duration, outcome) held by the platform are Customer Content too. The same rules apply: the Customer is the controller, we process them only on its instructions, and we delete them on the schedule in Section 7. To access, correct or delete them, contact the company you called.
13. Changes to this policy
We may update this policy. We will post the new version at https://www.big-sister.ai/privacy-policy with a new effective date and version identifier. For a change that materially reduces your rights, we will email account holders at least 30 days before it takes effect.
14. Contact
Big Sister AI Company 2810 N Church St., PMB 74428 Wilmington, Delaware 19802-4447, USA Email: notices@big-sister.ai
Change log
| Version | Date | Change |
|---|---|---|
privacy-2026-12 | 2026-10-18 | Added the Claude connector to Section 4: what it retrieves, that it is read-only, and how Customer Content returned through it is treated. No other change. |
privacy-2026-11 | 2026-10-14 | Customer Content now names call logs (telephone numbers and call metadata, including for calls that were not answered) in Section 1 and in the Section 7 retention table. Section 12 now also covers people who called a Customer and were not answered, and says whom to contact. Added Mila, the AI assistant on the website: what it collects (Section 2), how it works and that it is reviewed and scored (Section 4), its consent flag (Section 6) and its retention (Section 7). No other change. |
privacy-2026-10 | 2026-10-01 | Rewritten. Added controller/processor roles; recordings and transcripts as a named category; the no-training commitment; named subprocessors by link; a retention schedule with the 24-month call-content rule stated as a commitment; the actual cookie behavior of the site and app; CCPA/CPRA, Texas TDPSA and GDPR rights with an appeal path; the section for call participants; 30-day notice for material changes. |
privacy-2025-04 | 2025-04-11 | First version. |