Privacy Policy

This Privacy Policy explains how Primal Sales AI, LLC ("PrimalSales," "we," "us," or "our") collects, uses, shares, and protects information when you use the PrimalSales.ai platform and website (the "Service").

This Policy applies to information collected from customers, their authorized users, website visitors, and prospect data uploaded to the Service. By using the Service, you agree to the practices described here.

1. Information We Collect

1.1 Information You Provide

• Account information: name, email address, phone number, company name, role/title, password (hashed), payment information (handled by our payment processor).
• Configuration data: sales methodology selections, team member information, integration credentials, customizations.
• Customer Data: CRM records, prospect contact information, deal data, call transcripts, recordings, email content, and other materials you upload or sync to the Service.
• Communications: messages you send to support, feedback you submit, content of demo calls.

1.2 Information Collected Automatically

• Usage data: pages visited, features used, actions taken, timestamps, session duration, click patterns.
• Device and connection data: IP address, browser type and version, operating system, device identifiers, language preferences, referrer URL.
• Cookies and similar technologies: see our Cookie Policy for details.

1.3 Information from Third Parties

• CRM and integration data: when you connect HubSpot, Salesforce, GoHighLevel, Gmail, Slack, or other services, we receive data those services share based on your authorization.
• Authentication providers: if you sign in via Google SSO, we receive basic profile information from Google.
• Payment processors: Stripe provides us with subscription status and payment confirmation, but not full payment card details.

2. How We Use Information

We use information to:

• Provide, operate, maintain, and improve the Service;
• Process subscriptions, payments, and communications;
• Authenticate users and protect against fraud, abuse, and security incidents;
• Generate AI-powered coaching, recommendations, training content, and email drafts;
• Train and improve our AI models on de-identified and aggregated data (excluding any data obtained through Google Workspace APIs — see "Google User Data and Limited Use" below);
• Send service-related notifications (account, billing, security, product updates);
• Respond to support inquiries and customer feedback;
• Conduct analytics, research, and product development;
• Comply with legal obligations and enforce our Terms of Service.

3. AI and Automated Processing

The Service uses artificial intelligence to analyze calls, deals, emails, and methodology configurations. We use third-party AI providers (currently including Anthropic and OpenAI) to power these features.

When AI processes Customer Data:

• We have contractual agreements with our AI providers prohibiting them from using your data to train their general-purpose models;
• We may use de-identified and aggregated data to improve the Service and our internal AI models, except that data received through Google Workspace APIs (including Gmail, Google Calendar, and Google Meet) is never used to develop, improve, or train any AI/ML models;
• AI-generated outputs may contain errors and should always be reviewed by you before use;
• You can disable certain AI features in your account settings.

4. Google User Data and Limited Use

Primal Sales Platform is operated by Primal Sales AI, LLC. Google connections are optional and use Google's OAuth authorization process. The permissions requested depend on the features you enable. We receive authorization tokens to access those features; we do not receive your Google password.

4.1 Information We Access and Why

• Google account identity: your connected email address and, when provided through Google sign-in, basic profile information identify your account and link the connection to your workspace.
• Google Calendar: we access calendar and event information such as event identifiers, titles, descriptions, dates, times, attendee names and email addresses, response status, and meeting links. We use it to display appointments, check availability, associate meetings with prospects, prepare call briefs, and support your daily sales workflow. Calendar event permissions also let the Service create or update appointments you schedule; invitations share the event details with the attendees you select.
• Gmail sending: the Gmail connection requests gmail.send to send messages you compose or approve, including sending through workflows you enable. We process recipients, subject, body, and any attachments you choose to send, and record message identifiers and delivery activity. This permission does not let us read or search your Gmail inbox. Email or reply history obtained separately from your connected CRM is governed by that integration's authorization.
• Google Meet, when enabled: we use read access to available conference records, participant names, and transcript entries to import meeting transcripts into your workspace. These support call summaries, scorecards, coaching, and prospect-specific follow-up recommendations. Meet transcript access is requested for the Meet integration; it is not required for a Calendar-only connection.

4.2 Storage and Service Providers

We store connection information, imported meeting and transcript records, sending activity, and generated outputs in the Service's hosted systems. Vercel provides application hosting and processing, and Supabase provides database and related infrastructure. Connections use HTTPS/TLS, and access to stored workspace records is controlled through authentication and organization-scoped access controls. OAuth tokens are used by the Service to maintain the connections you authorize.

For AI features you enable, relevant Google-derived meeting details or transcript content may be processed by our AI service providers, currently including Anthropic and OpenAI, to produce summaries, coaching, call preparation, and personalized drafts. This is processing to deliver those features, not permission to train general-purpose models. Not every provider receives every record. We share data with service providers only as needed to operate the relevant feature, and with your connected services or intended recipients when required by the actions and workflows you authorize.

4.3 Limited Use and AI Processing

4.4 Disconnecting, Retention, and Deletion

You can disconnect the relevant Google integration in the Service's connection settings. You can also remove Primal Sales Platform's access directly from your Google Account connections. Revoking access prevents further API access under that authorization; reconnecting requires you to authorize access again.

Disconnecting does not automatically delete previously imported meeting records, transcripts, sent-message records, or generated outputs. Those records remain subject to the retention periods in Section 9 and your organization's account settings and instructions. Disconnecting also does not delete messages or calendar events already delivered to Google or other recipients.

To request access to or deletion of Google-derived data held by Primal, email support@primalsales.ai or jared@primalsales.ai with the subject Google Data Privacy Request. Identify the connected account, workspace, and data concerned; do not send passwords or access tokens. We may verify your identity and coordinate with your workspace administrator. We respond within 30 days or as required by applicable law. Deletion includes associated stored records and derived outputs within the request's scope, subject to applicable retention requirements and the backup periods described in Section 9.

5. How We Share Information

We do not sell personal information. We do "share" a limited amount of website-visit information for advertising measurement, in the specific sense California law uses that word — see 5.6 below. We also share information in these limited cases:

5.1 Service Providers

We share information with vendors who help us operate the Service, under contracts requiring them to protect the data and use it only for the agreed purposes. Categories include:

• Cloud hosting and infrastructure (e.g., Vercel, Supabase);
• AI providers (e.g., Anthropic, OpenAI);
• Payment processing (e.g., Stripe);
• Email and notification delivery (e.g., Resend, SendGrid);
• Analytics and error monitoring;
• Customer support tools.

5.2 Integrations You Authorize

When you connect third-party services (HubSpot, Salesforce, GoHighLevel, etc.), data flows between those services and PrimalSales as you configure. Their use of your data is governed by their privacy policies.

5.3 Legal and Safety

We may disclose information when required by law, subpoena, court order, or governmental request; to protect our rights, property, or safety, or those of users or the public; to investigate fraud, security, or technical issues; or to enforce our Terms.

5.4 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before personal information becomes subject to a different privacy policy.

5.5 Aggregated and De-Identified Data

We may share aggregated and de-identified data (which cannot reasonably identify any individual) for any lawful purpose, including marketing, research, and benchmarking.

5.6 Advertising Measurement ("Sharing" under California law)

Our public marketing pages run a Meta (Facebook) advertising pixel that tells Meta which pages a visitor viewed and whether they took an action such as booking a call, so we can measure whether our advertising works. Under the CPRA this counts as "sharing" personal information for cross-context behavioural advertising. It is not a sale — no money changes hands for it. It applies to visitors of our marketing pages, not to data inside a customer's account.

You can turn this off for your browser at any time using the Your Privacy Choices link in the footer of every page. If you are visiting from the EU, the EEA, the UK, Switzerland or Canada, it does not run at all unless you accept it first.

6. Your Rights and Choices

Depending on your location, you may have rights including:

• Access: request a copy of personal information we hold about you;
• Correction: request that inaccurate information be corrected;
• Deletion: request that we delete your personal information, subject to legal retention requirements;
• Portability: receive your information in a structured, machine-readable format;
• Opt-out of sale/sharing: we do not sell personal information. We do share website-visit information for advertising measurement (see 5.6), and you can opt out of that on any page using the Your Privacy Choices link in the footer;
• Withdrawal of consent: where processing is based on consent, you may withdraw consent at any time.

To exercise any of these rights, email support@primalsales.ai. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before fulfilling certain requests.

6.1 Authorized Users

If you are an authorized user added to the Service by a customer (your employer), the customer controls your account and decisions about your data. Direct privacy requests to your customer organization first.

6.2 Prospect Data

If your data appears in our Service because a customer (a sales team) uploaded it, that customer is the controller of your data. We act as a processor on their behalf. Direct privacy requests to that customer.

7. California Privacy Rights

California residents have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect, use, and share;
• The right to delete personal information;
• The right to correct inaccurate information;
• The right to opt out of "sale" or "sharing" — we do not sell personal information, and you can opt out of the advertising "sharing" described in 5.6 using the link below;
• The right to limit use of sensitive personal information;
• The right to non-discrimination for exercising these rights.

To opt out of sharing: use the Your Privacy Choices link in the footer of every page. It turns off analytics, session recording and advertising cookies on the browser you are using, and your choice is remembered on that browser. You do not need an account and you do not need to email us. Turning them off changes nothing about the service you receive.

To exercise any of the other rights above, contact support@primalsales.ai. We do not knowingly collect or sell information of consumers under 16.

8. Data Security

We implement reasonable administrative, physical, and technical safeguards to protect personal information, including:

• Encryption in transit (TLS) and at rest;
• Multi-tenant architecture with org-level data isolation;
• Access controls, authentication, and audit logging;
• Regular security reviews and updates;
• Vendor security assessments.

No system is perfectly secure. If we become aware of a security incident affecting your personal information, we will notify you as required by law.

9. Data Retention

We retain personal information as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Specifics:

• Account data: for the duration of your subscription, plus 30 days after termination for export and recovery;
• Customer Data: for the duration of your subscription, plus 30 days after termination, then permanent deletion;
• Payment records: 7 years for tax and accounting purposes;
• Backups: rolling 90 days, with deletion confirmed thereafter;
• Legal hold: longer if required by law, regulation, or active litigation.

10. International Data Transfers

The Service is operated in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. The Service is currently designed for U.S. customers; we do not offer the Service in jurisdictions where transfer of data to the U.S. requires specific safeguards we have not implemented.

11. Children's Privacy

The Service is not intended for individuals under 18. We do not knowingly collect personal information from children under 18. If we learn we have collected such information, we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app notice at least 30 days before they take effect. The "Effective Date" at the top reflects the most recent version.

13. Contact Us

For privacy questions, requests, or concerns, contact:

Primal Sales AI, LLC
Email: support@primalsales.ai
Subject line: Privacy Request

Acceptable Use Policy

This Acceptable Use Policy ("AUP") governs your use of the PrimalSales.ai Service. It is incorporated by reference into our Terms of Service.

You may not use the Service for any unlawful, harmful, or prohibited purpose. We reserve the right to investigate and take action — including suspension or termination — if we believe you have violated this AUP.

1. Prohibited Conduct

You may not, and may not permit your Authorized Users to:

1.1 Illegal Activity

• Violate any applicable federal, state, local, or international law or regulation;
• Engage in fraud, money laundering, or other criminal activity;
• Send communications that violate the CAN-SPAM Act, TCPA, GDPR, or similar laws;
• Process personal data without lawful basis or required consent.

1.2 Harmful Communications

• Send spam, unsolicited bulk email, or messages to recipients who have not opted in;
• Use the Service to harass, threaten, defame, or stalk any person;
• Send messages with deceptive headers, false sender information, or misleading subject lines;
• Engage in phishing, social engineering, or impersonation;
• Distribute content that is obscene, hateful, or promotes violence.

1.3 Privacy Violations

• Upload or process personal data without lawful authority;
• Record or transcribe calls without required notice or consent of all parties (where applicable under state law);
• Use the Service to surveil or monitor individuals without lawful authority;
• Process special categories of personal data (health, biometric, etc.) without specific authorization.

1.4 Intellectual Property Violations

• Upload content that infringes copyright, trademark, trade secret, or other intellectual property rights;
• Use the Service to misappropriate confidential information from a current or former employer;
• Remove proprietary notices or attempt to claim ownership of PrimalSales content.

1.5 Service Abuse

• Reverse-engineer, decompile, or attempt to extract source code from the Service;
• Probe, scan, or test vulnerabilities without our written authorization;
• Bypass authentication, access controls, rate limits, or usage measurement;
• Use automated tools to scrape or extract data, except via authorized APIs;
• Interfere with or disrupt the Service, servers, or networks;
• Distribute viruses, malware, or other harmful code;
• Attempt to overwhelm the Service through excessive automated requests.

1.6 AI Misuse

• Attempt to manipulate AI features through prompt injection, jailbreaking, or adversarial input;
• Use AI outputs to generate content for purposes prohibited by this AUP;
• Use the Service to create or distribute deepfakes, impersonations, or deceptive content;
• Train competing AI models using PrimalSales-generated content;
• Bypass safety measures designed into AI features.

1.7 Commercial Restrictions

• Resell, sublicense, or redistribute access to the Service;
• Use the Service to build a directly competing product;
• Allow access by users beyond your subscribed seat count;
• Share login credentials with anyone outside your organization;
• Use the Service to provide outsourced services to third parties without our written consent.

2. Reporting Violations

If you become aware of conduct that violates this AUP, report it to support@primalsales.ai with details. We investigate all reports.

3. Enforcement

We reserve the right (but have no obligation) to:

• Investigate any suspected violation;
• Remove, disable, or restrict access to content that violates this AUP;
• Suspend or terminate accounts for violations;
• Cooperate with law enforcement and report illegal activity;
• Take any action we deem appropriate to address violations.

Account termination for AUP violations does not entitle you to a refund.

4. Your Responsibility

You are responsible for the conduct of your Authorized Users and any activity on your account. Train your team on this AUP and ensure compliance.

5. Changes

We may update this AUP. Continued use of the Service after changes are posted constitutes acceptance.

6. Contact

Questions about this AUP: support@primalsales.ai.

Cookie Policy

This Cookie Policy explains what cookies are, how Primal Sales AI, LLC uses them on the PrimalSales.ai website and Service, and how you can control them.

1. What Are Cookies

Cookies are small text files that websites place on your device to store information. Similar technologies include local storage, session storage, web beacons, and tracking pixels (collectively, "Cookies" in this Policy).

Cookies can be:

• Session vs. Persistent: Session cookies expire when you close your browser. Persistent cookies remain until they expire or are deleted.
• First-party vs. Third-party: First-party cookies are set by us. Third-party cookies are set by services we use.

2. Cookies We Use

2.1 Strictly Necessary Cookies

These cookies are essential for the Service to function. They cannot be disabled. Examples:

• Authentication tokens to keep you logged in;
• Session identifiers to maintain your account state;
• CSRF protection tokens to secure form submissions;
• Load balancing cookies to route traffic correctly.

2.2 Functional Cookies

These cookies remember your preferences and improve your experience. Examples:

• Display preferences (e.g., dark mode);
• Language and region settings;
• Recently viewed items.

2.3 Analytics and Session-Recording Cookies

These help us understand how the site and Service are used so we can improve them. On the public website we use:

• Google Analytics (measurement ID G-7T951Z81BH) — pages viewed, referring source, approximate location, device and browser. Set by Google; see Google's own privacy notice.
• Contentsquare — records your session on the website: pages viewed, mouse movement, clicks and scrolling, so we can see where visitors get stuck. This is behavioural analytics, not a video of you, and it does not follow you to other websites.
• HeyCatch — product analytics: pages viewed, clicks, and which marketing link brought you here, so we can see which parts of the site actually work. It does not record your screen and it does not follow you to other websites.
• Levito — A/B testing: shows you one of two versions of a page's wording or layout and records which version you saw and whether you took an action, so we can tell which one works better. It does not record your screen and it does not follow you to other websites.

Inside the logged-in Service we also use internal product analytics, error monitoring and performance monitoring.

2.4 Marketing and Advertising Cookies

These track visitors across websites so that advertising can be targeted and measured. We use:

• Meta Pixel — tells Meta (Facebook and Instagram) that you visited, which pages, and whether you took an action such as booking a call, so we can measure and target our advertising. Under California law this counts as "sharing" personal information for cross-context behavioural advertising. It is not a sale — we receive no money for it.
• LeadConnector / GoHighLevel — associates your visit with our own customer records so we know which marketing brought you here.
• Reddit Pixel — tells Reddit that you visited and whether you took an action, such as opening our booking calendar or starting a free review, so we can measure and target advertising there. As with the Meta Pixel, under California law this counts as "sharing" personal information for cross-context behavioural advertising, and it is not a sale.
• LinkedIn Insight Tag — tells LinkedIn that you visited and whether you took an action, so we can measure and target advertising there. As with the Meta Pixel, under California law this counts as "sharing" personal information for cross-context behavioural advertising, and it is not a sale.
• Gojiberry — identifies which company a visit comes from, using the visit's network details, so our sales team can see which businesses are looking at Primal and reach out to the right people there. It works from Gojiberry's own business-contact data, not from anything you type on our site. Its script file is fetched on every page so it is ready, but it identifies nothing until it is allowed under 2.5.

2.5 Turning Them Off

Everything in 2.3 and 2.4 is optional and off-switchable:

• If you are in the EU, EEA, UK, Switzerland or Canada: none of these load at all until you accept them. Declining means they never run.
• Everywhere else: they run by default, and the Your Privacy Choices link in the footer of every page turns them off. Your choice is remembered on that browser.

Strictly necessary cookies (2.1) cannot be turned off, because the site cannot function without them.

3. Third-Party Cookies

Some Cookies are set by third-party services rather than by us. On the public website these are Google Analytics, Meta, Contentsquare, HeyCatch, Levito, LeadConnector, LinkedIn, Reddit and Gojiberry, all described in section 2 and all covered by the controls in 2.5. Elsewhere they may include:

• Stripe (for payment processing);
• Google (if you sign in via Google SSO);
• LeadConnector (for demo bookings).

These third parties have their own privacy and cookie policies, which we encourage you to review.

4. Your Choices

4.0 Your Privacy Choices

The quickest control is the Your Privacy Choices link, in the footer of every page. It turns off analytics, session recording and advertising cookies on the browser you are using, and remembers the choice. California residents can use the same link to opt out of the "sharing" of personal information for cross-context behavioural advertising described in 2.4.

4.1 Browser Controls

Most browsers let you block or delete cookies through their settings. Common options:

• Chrome: Settings → Privacy and security → Cookies and other site data
• Firefox: Preferences → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Cookies and site permissions → Cookies

If you block strictly necessary cookies, you will not be able to use the Service.

4.2 Global Privacy Control and Do Not Track

Global Privacy Control (GPC) is a setting some browsers and extensions send on your behalf. We honour it: if your browser sends a GPC signal, we treat it as an instruction not to share your information for advertising, and none of the optional cookies in 2.3 or 2.4 load. You do not have to do anything else, and we will not ask you again on that browser.

The older "Do Not Track" header is different. We do not respond to it, because no industry-standard interpretation of it exists. Use GPC or the Your Privacy Choices link instead.

5. Updates

We may update this Cookie Policy. Changes will be reflected in the Effective Date.

6. Contact

Questions: support@primalsales.ai.

Refund Policy

This Refund Policy applies to all subscriptions to the PrimalSales.ai Service.

1. The Delivery Guarantee

The Guarantee Window is the first 30 days after your first subscription payment. Within it we deliver: (a) a written sales playbook for each type of sales call your team runs, built from your team’s own recorded won calls; and (b) a score, against that playbook, for every sales call your reps record during the Guarantee Window (a call recorded in the final hour of the window is scored after it closes).

If either is not delivered by the end of the Guarantee Window and the conditions in section 2 are met, we will, on approving your claim, (i) refund your first monthly payment to your original payment method and (ii) pay you an additional amount equal to that first monthly payment by ACH transfer, both within 10 business days of that approval. Your subscription is cancelled when a claim is approved.

How to Claim

1. Submit a claim within 7 days after the Guarantee Window closes, from your Billing page or by email to support@primalsales.ai from the email address associated with your account.
2. Include “Guarantee claim” in the subject line.

We review every claim against the delivery record the platform keeps — what was built, what was scored, and when — and we show you that record with our decision.

What It Is Not

The Delivery Guarantee is a promise about work we produce. It is not a promise about your sales results, revenue, or close rates, and Section 5 of the Terms of Service continues to apply.

2. Conditions

The Delivery Guarantee applies when, throughout the Guarantee Window:

• Your reps record their sales calls on a supported call recorder connected to Primal;
• At least 20 sales calls are recorded;
• Those calls come from at least 3 of your reps; and
• Your CRM and recorder remain connected.

It also requires that, at setup, your recorder’s history holds at least 5 recorded sales calls on deals your CRM marks as won. We confirm this with you before your first payment, because the playbook is built from them.

Calls answered by an automated receptionist, voicemails, and calls with no identified rep count toward neither the 20 calls nor the 3 reps.

If the conditions are not met, the Delivery Guarantee does not apply. You may still cancel at any time under section 3.

3. Cancellation (No Refund Required)

You may cancel your subscription at any time without needing a refund. Cancellation prevents future billing but does not refund the current billing period. To cancel:

• Use the cancel option in your account settings, or
• Email support@primalsales.ai with "Cancel Subscription" in the subject line.

Your access continues through the end of the current billing period.

4. After the Guarantee Window

Refunds after the Guarantee Window are at our discretion. We may consider refunds in cases of:

• Service outages affecting your ability to use the Service for extended periods;
• Billing errors on our end;
• Other exceptional circumstances reviewed case-by-case.

Submit such requests to support@primalsales.ai with detailed circumstances.

5. Founding Member Subscriptions

Founding member subscriptions carry the same Delivery Guarantee on the same terms; the additional payment equals your founding first monthly payment. Founding member rates are locked for the life of your subscription, but cancellation rules apply normally.

If you cancel a founding member subscription and later re-subscribe, founding member pricing does not apply to the new subscription.

6. Chargebacks

We ask that you contact us before initiating a chargeback with your bank or card issuer. Chargebacks are expensive and disruptive, and most refund requests can be resolved faster directly. Accounts with unresolved chargebacks may be suspended.

7. Contact

Refund questions: support@primalsales.ai.

Data Processing Addendum

This Data Processing Addendum ("DPA") supplements and forms part of the Terms of Service between Primal Sales AI, LLC ("Processor," "we," "us") and the Customer ("Controller," "you") who has subscribed to the PrimalSales.ai Service.

This DPA applies when you upload, sync, or otherwise transmit personal information of your prospects, customers, or other individuals to the Service.

1. Definitions

• "Personal Information" means any information relating to an identified or identifiable natural person processed via the Service.
• "Processing" means any operation performed on Personal Information, including collection, storage, use, transmission, and deletion.
• "Sub-processor" means any third party we engage to process Personal Information on our behalf.
• "Security Incident" means a confirmed unauthorized access to or disclosure of Personal Information.

2. Roles

You are the Controller and determine the purposes and means of Processing Personal Information through the Service. We are the Processor and process Personal Information only as instructed by you (including via configuration of your account) and as necessary to provide the Service.

3. Scope and Purpose

3.1 Categories of Data Subjects

Personal Information processed via the Service may relate to:

• Your sales prospects and leads;
• Your customers (existing and former);
• Your team members (Authorized Users);
• Other individuals whose data you upload (e.g., call participants).

3.2 Categories of Personal Information

Categories may include: name, email, phone number, company, role, deal information, communication content (calls, emails, messages), CRM records, and any other data you upload or sync.

3.3 Purposes of Processing

We process Personal Information solely to:

• Provide the Service to you;
• Generate AI-powered analyses, recommendations, and content;
• Maintain security, integrity, and availability of the Service;
• Comply with our legal obligations.

4. Our Obligations

4.1 Processing Instructions

We will process Personal Information only on your documented instructions, which include the Terms of Service, this DPA, your account configuration, and additional instructions you provide in writing.

4.2 Confidentiality

We require our personnel and authorized contractors to maintain confidentiality of Personal Information through written agreements or equivalent legal duties.

4.3 Security Measures

We implement and maintain technical and organizational security measures designed to protect Personal Information, including:

• Encryption of data in transit (TLS) and at rest;
• Multi-tenant architecture with org-level data isolation;
• Access controls based on least-privilege principle;
• Authentication, including options for multi-factor authentication;
• Audit logging of administrative actions;
• Regular security reviews of our codebase and infrastructure;
• Vendor security assessments before engaging Sub-processors;
• Incident response procedures.

4.4 Sub-processors

We engage Sub-processors to help deliver the Service. By accepting this DPA, you authorize our use of Sub-processors. Current categories include:

• Cloud hosting and database providers;
• AI service providers;
• Payment processors;
• Email delivery services;
• Customer support tools;
• Analytics and monitoring providers.

We require Sub-processors to commit, in writing, to data protection obligations no less protective than those in this DPA. We remain responsible for Sub-processor performance.

You may request a current list of Sub-processors by emailing support@primalsales.ai.

4.5 Assistance with Data Subject Rights

To the extent legally required and where you cannot fulfill requests directly through the Service, we will provide reasonable assistance in responding to data subject access, correction, deletion, and portability requests.

4.6 Security Incidents

If we become aware of a Security Incident affecting your Personal Information, we will notify you without undue delay (and within 72 hours where reasonably possible). Our notification will include the nature of the incident, categories of data affected, likely consequences, and measures we are taking. We will cooperate reasonably with your investigation and any required notifications to data subjects or authorities.

4.7 Audit Rights

Upon reasonable advance written request (no more than once per year, except after a Security Incident or as required by law), we will make available information necessary to demonstrate compliance with this DPA, including third-party audit reports (e.g., SOC 2) where available. On-site audits may be conducted under reasonable conditions including reasonable scope, scheduling, and confidentiality protections.

4.8 Return or Deletion

Upon termination of your subscription, we will return or delete Personal Information as described in the Terms of Service (typically within 30 days of termination, with backups deleted within 90 days), except where retention is required by law.

5. Your Obligations

You represent and warrant that:

• You have all required legal authority to process and transmit Personal Information to the Service;
• You have provided required notices and obtained required consents from data subjects;
• Your processing instructions comply with applicable law;
• Your collection of call participant data complies with applicable wiretap and recording laws (which vary by state and country).

6. International Transfers

Currently, the Service is hosted in the United States. If you are located outside the U.S. and applicable law requires specific safeguards for international transfers, the Service may not currently meet those requirements. Contact us before subscribing if your jurisdiction requires Standard Contractual Clauses or equivalent mechanisms.

7. Limitation of Liability

The limitation of liability provisions in the Terms of Service apply to claims under this DPA. The total liability of either party for all claims under this DPA is subject to the cap stated in the Terms of Service.

8. Conflict

If there is any conflict between this DPA and the Terms of Service, this DPA prevails for matters concerning Personal Information.

9. Governing Law

This DPA is governed by the laws of the State of Florida, USA, consistent with the Terms of Service.

10. Contact

For questions about this DPA: support@primalsales.ai.

Primal Sales AI, LLC · A Florida Limited Liability Company