Privacy Policy
Effective Date: October 14, 2026 · Version privacy-2026-11
Big Sister AI Company ("Big Sister AI", "we", "us") is a Delaware corporation. This Privacy Policy explains what personal information we collect through our website at https://www.big-sister.ai and our sales-performance platform at https://app.big-sister.ai (together, the "Services"), how we use and share it, how long we keep it, and the choices you have.
1. Two roles, two sets of rules
We handle personal information in two different capacities, and it matters which one applies to you.
We are the controller for information about website visitors, people who create or use an account, prospects who contact us, and people we correspond with. Sections 2 to 11 describe that processing.
We are a processor for Customer Content: the call and meeting recordings, transcripts, CRM records, call logs (telephone numbers and call metadata, including for calls that were not answered) and derived scores that a Customer connects to the platform so that we can analyze its sales conversations. The Customer decides what to connect and why, and is the controller of that data. We process it only under the Customer's instructions and the Data Processing Agreement, which forms part of our Terms of Service. Section 12 explains what this means if you took part in a call that a Customer recorded.
2. Information we collect as controller
Account information. When a workspace is created or you are invited into one: your name, work email address, password (stored hashed), company name, job title and role in the workspace, and the time zone and settings you choose.
Billing information. Company name, billing contact and billing address. Card details are entered directly into Stripe's checkout and are held by Stripe, never by us. We receive the card brand, last four digits and expiry for display.
Acceptance records. The version of the Terms of Service you accepted, the time you accepted it and the IP address you accepted it from.
Usage and device information. IP address, browser and device type, pages and features used, timestamps, and error reports. In the platform this includes product-analytics events keyed on your email address (see Section 6).
Communications. What you send us by email, through support, or through forms on the website, including the waitlist and demo request forms.
Connected-source credentials. When a Customer connects a notetaker, dialer or CRM, we store the API key or OAuth token needed to read from it, in a managed secrets store. We treat credentials as confidential and delete them when the connection is removed.
We do not collect precise geolocation, biometric identifiers, government identification numbers, health information or financial account numbers, and we ask that you do not send them to us.
3. How we use it
- To create and run your workspace, authenticate you, and deliver the features you use.
- To bill you and keep the records that tax and accounting law require.
- To respond to you, send service notices, and tell you about changes to the Services or these terms.
- To send product updates and marketing email to account holders and people who asked to hear from us. Every such email has an unsubscribe link, and opting out does not affect service notices.
- To monitor performance, find and fix errors, and understand which features are used, so we can improve the Services.
- To protect the Services, prevent fraud and abuse, enforce our agreements, and comply with law.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
4. Artificial intelligence
The platform uses third-party large language models to score and summarize sales conversations. Those models run on infrastructure we contract for (currently Microsoft Azure AI Foundry) on terms under which the inputs are not used to train the vendor's models. We do not use Customer Content, or any personal information, to train, fine-tune or develop artificial intelligence or machine learning models, whether or not aggregated or de-identified. We do not build our own models. The vendors involved are listed on our subprocessor page.
Scores and coaching output are generated automatically and can be wrong. Our Terms of Service require Customers to apply human judgment before acting on them.
5. How we share it
- Service providers (subprocessors). Companies that host, store, monitor or support the Services on our behalf, listed with their locations and purposes at https://www.big-sister.ai/subprocessors. Each is bound by written terms to use the information only to provide its service to us.
- Payment processor. Stripe, Inc. processes payments under its own privacy policy.
- Professional advisers. Lawyers, accountants and auditors, under confidentiality.
- Legal requirements. If required by law, subpoena or court order, or where we believe in good faith that disclosure is necessary to protect the rights, safety or property of Big Sister AI, our Customers or others. If we receive a government request for Customer Content we will tell the Customer unless the law prohibits it.
- Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction. We will notify affected account holders by email before their information becomes subject to a different privacy policy.
- With your direction. When you ask us to share information, for example by connecting a tool.
6. Cookies and analytics
Website (www.big-sister.ai). We use Google Consent Mode v2 with every storage category set to denied until you choose. A banner offers Accept or Decline; your choice is stored in your browser (bs_consent) and can be changed at any time from the footer. Until you accept, Google Tag Manager runs without cookies and Microsoft Clarity is not loaded. If you accept, Google Analytics and Microsoft Clarity set cookies to measure traffic and record anonymized session interactions. Ahrefs Web Analytics runs without cookies and without identifying you, whether or not you accept.
Platform (app.big-sister.ai). We use PostHog for product analytics (which pages and features are used, keyed on your account email) and Sentry for error monitoring (which does not capture personal data beyond a tenant identifier). We use cookies and local storage for sign-in and preferences. There is no advertising tracking in the platform.
You can block cookies in your browser; the platform's sign-in will not work without its own cookies.
7. How long we keep it
| Information | Retention |
|---|---|
| Account and workspace information | For the life of the workspace, then deleted within 30 days after the workspace is closed |
| Acceptance records | For the life of the workspace plus the period needed to defend legal claims |
| Billing records and invoices | As long as tax and accounting law require |
| Usage and product-analytics events | 12 months |
| Support and other correspondence | 24 months after the thread closes |
| Customer Content (recordings, transcripts, CRM records, call logs, scores) | As set out in the Data Processing Agreement: deleted 24 months after collection, or within 30 days after the Customer's subscription ends, whichever comes first. The automated lifecycle rules that enforce the 24-month limit are being deployed; until they are in operation, deletion on that timetable is carried out by documented operational process |
| Encrypted backups | Rolled off no later than 35 days after the primary copy is deleted |
8. Security
We protect information with encryption in transit (TLS 1.2 or above) and at rest, individual named accounts with least-privilege access, multi-factor authentication for administrative access to our cloud environment, central logging of infrastructure and administrative activity, automated threat detection, encrypted backups with tested restores, and continuous dependency monitoring. The full list of measures, and their current state, is in Annex 2 of the Data Processing Agreement. No system is perfectly secure; if a security incident affects your information we will notify you as the law and our agreements require.
9. Where we process it
Our Services are hosted in the United States. Our personnel who support and maintain the Services are located in the United States and Ukraine and access information under the controls in Section 8. If you use the Services from outside the United States, your information is transferred to and processed in the United States. Where the GDPR or UK GDPR applies to Customer Content, the Data Processing Agreement provides for Standard Contractual Clauses.
10. Your rights and choices
Depending on where you live, you may have the right to know what personal information we hold about you, to receive a copy, to correct it, to delete it, to restrict or object to certain processing, to receive it in a portable form, and to not be discriminated against for exercising these rights.
California (CCPA/CPRA). You have the rights to know, delete, correct, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use or disclose sensitive personal information for purposes that would give rise to a right to limit. You may use an authorized agent; we will ask for proof of authorization.
Texas (TDPSA), Virginia, Colorado, Connecticut and other US states with comprehensive privacy laws. You have the rights to access, correct, delete, obtain a copy, and opt out of targeted advertising, sale and profiling in furtherance of decisions that produce legal or similarly significant effects. We do none of those three. If we deny a request you may appeal by replying to our response; we will answer the appeal within 60 days and tell you how to contact your state attorney general if you disagree.
European Economic Area, United Kingdom and Switzerland (if applicable). Our lawful bases are performance of a contract (account and billing), legitimate interests (security, analytics, improving the Services, business-to-business marketing) and consent (website cookies, marketing to non-customers). You may withdraw consent at any time and you may complain to your supervisory authority.
How to exercise a right. Email notices@big-sister.ai from the address on your account, or write to the address in Section 14. We verify requests by matching them to the account and, where needed, by asking you to confirm from that email address. We respond within 45 days, and will tell you if we need more time. Requests are free unless they are manifestly unfounded or excessive.
Marketing. Use the unsubscribe link in any marketing email, or email us.
11. Children
The Services are for businesses and are not directed to anyone under 16. We do not knowingly collect personal information from children. If you believe a child has given us personal information, email notices@big-sister.ai and we will delete it.
12. If you were on a call, or called a Customer
Our Customers use the platform to analyze their own sales conversations. If you spoke with one of our Customers on a recorded call or meeting, that recording, its transcript and any scores derived from it are Customer Content. The Customer is responsible under our Terms of Service for obtaining any consent the law requires before recording, and is the controller of that data. We process it only on the Customer's instructions, do not use it for our own purposes, do not use it to train models, and delete it on the schedule in Section 7. To access, correct or delete your data in a recording, contact the company you spoke with. If you contact us instead, we will forward your request to that Customer and help them respond.
If you called one of our Customers, or one of them called you, and the call was not answered or not recorded, the telephone number and call details (time, direction, duration, outcome) held by the platform are Customer Content too. The same rules apply: the Customer is the controller, we process them only on its instructions, and we delete them on the schedule in Section 7. To access, correct or delete them, contact the company you called.
13. Changes to this policy
We may update this policy. We will post the new version at https://www.big-sister.ai/privacy-policy with a new effective date and version identifier. For a change that materially reduces your rights, we will email account holders at least 30 days before it takes effect.
14. Contact
Big Sister AI Company 2810 N Church St., PMB 74428 Wilmington, Delaware 19802-4447, USA Email: notices@big-sister.ai
Change log
| Version | Date | Change |
|---|---|---|
privacy-2026-11 | 2026-10-14 | Customer Content now names call logs (telephone numbers and call metadata, including for calls that were not answered) in Section 1 and in the Section 7 retention table. Section 12 now also covers people who called a Customer and were not answered, and says whom to contact. No other change. |
privacy-2026-10 | 2026-10-01 | Rewritten. Added controller/processor roles; recordings and transcripts as a named category; the no-training commitment; named subprocessors by link; a retention schedule with the 24-month call-content rule stated as a commitment; the actual cookie behavior of the site and app; CCPA/CPRA, Texas TDPSA and GDPR rights with an appeal path; the section for call participants; 30-day notice for material changes. |
privacy-2025-04 | 2025-04-11 | First version. |