Privacy Policy

This Privacy Policy explains how Primal Sales AI, LLC ("PrimalSales," "we," "us," or "our") collects, uses, shares, and protects information when you use the PrimalSales.ai platform and website (the "Service").

This Policy applies to information collected from customers, their authorized users, website visitors, and prospect data uploaded to the Service. By using the Service, you agree to the practices described here.

1. Information We Collect

1.1 Information You Provide

• Account information: name, email address, phone number, company name, role/title, password (hashed), payment information (handled by our payment processor).
• Configuration data: sales methodology selections, team member information, integration credentials, customizations.
• Customer Data: CRM records, prospect contact information, deal data, call transcripts, recordings, email content, and other materials you upload or sync to the Service.
• Communications: messages you send to support, feedback you submit, content of demo calls.

1.2 Information Collected Automatically

• Usage data: pages visited, features used, actions taken, timestamps, session duration, click patterns.
• Device and connection data: IP address, browser type and version, operating system, device identifiers, language preferences, referrer URL.
• Cookies and similar technologies: see our Cookie Policy for details.

1.3 Information from Third Parties

• CRM and integration data: when you connect HubSpot, Salesforce, GoHighLevel, Gmail, Slack, or other services, we receive data those services share based on your authorization.
• Authentication providers: if you sign in via Google SSO, we receive basic profile information from Google.
• Payment processors: Stripe provides us with subscription status and payment confirmation, but not full payment card details.

2. How We Use Information

We use information to:

• Provide, operate, maintain, and improve the Service;
• Process subscriptions, payments, and communications;
• Authenticate users and protect against fraud, abuse, and security incidents;
• Generate AI-powered coaching, recommendations, training content, and email drafts;
• Train and improve our AI models on de-identified and aggregated data (excluding any data obtained through Google Workspace APIs — see "Google User Data and Limited Use" below);
• Send service-related notifications (account, billing, security, product updates);
• Respond to support inquiries and customer feedback;
• Conduct analytics, research, and product development;
• Comply with legal obligations and enforce our Terms of Service.

3. AI and Automated Processing

The Service uses artificial intelligence to analyze calls, deals, emails, and methodology configurations. We use third-party AI providers (currently including Anthropic and OpenAI) to power these features.

When AI processes Customer Data:

• We have contractual agreements with our AI providers prohibiting them from using your data to train their general-purpose models;
• We may use de-identified and aggregated data to improve the Service and our internal AI models, except that data received through Google Workspace APIs (including Gmail, Google Calendar, and Google Meet) is never used to develop, improve, or train any AI/ML models;
• AI-generated outputs may contain errors and should always be reviewed by you before use;
• You can disable certain AI features in your account settings.

4. Google User Data and Limited Use

Primal Sales Platform is operated by Primal Sales AI, LLC. Google connections are optional and use Google's OAuth authorization process. The permissions requested depend on the features you enable. We receive authorization tokens to access those features; we do not receive your Google password.

4.1 Information We Access and Why

• Google account identity: your connected email address and, when provided through Google sign-in, basic profile information identify your account and link the connection to your workspace.
• Google Calendar: we access calendar and event information such as event identifiers, titles, descriptions, dates, times, attendee names and email addresses, response status, and meeting links. We use it to display appointments, check availability, associate meetings with prospects, prepare call briefs, and support your daily sales workflow. Calendar event permissions also let the Service create or update appointments you schedule; invitations share the event details with the attendees you select.
• Gmail sending: the Gmail connection requests gmail.send to send messages you compose or approve, including sending through workflows you enable. We process recipients, subject, body, and any attachments you choose to send, and record message identifiers and delivery activity. This permission does not let us read or search your Gmail inbox. Email or reply history obtained separately from your connected CRM is governed by that integration's authorization.
• Google Meet, when enabled: we use read access to available conference records, participant names, and transcript entries to import meeting transcripts into your workspace. These support call summaries, scorecards, coaching, and prospect-specific follow-up recommendations. Meet transcript access is requested for the Meet integration; it is not required for a Calendar-only connection.

4.2 Storage and Service Providers

We store connection information, imported meeting and transcript records, sending activity, and generated outputs in the Service's hosted systems. Vercel provides application hosting and processing, and Supabase provides database and related infrastructure. Connections use HTTPS/TLS, and access to stored workspace records is controlled through authentication and organization-scoped access controls. OAuth tokens are used by the Service to maintain the connections you authorize.

For AI features you enable, relevant Google-derived meeting details or transcript content may be processed by our AI service providers, currently including Anthropic and OpenAI, to produce summaries, coaching, call preparation, and personalized drafts. This is processing to deliver those features, not permission to train general-purpose models. Not every provider receives every record. We share data with service providers only as needed to operate the relevant feature, and with your connected services or intended recipients when required by the actions and workflows you authorize.

4.3 Limited Use and AI Processing

4.4 Disconnecting, Retention, and Deletion

You can disconnect the relevant Google integration in the Service's connection settings. You can also remove Primal Sales Platform's access directly from your Google Account connections. Revoking access prevents further API access under that authorization; reconnecting requires you to authorize access again.

Disconnecting does not automatically delete previously imported meeting records, transcripts, sent-message records, or generated outputs. Those records remain subject to the retention periods in Section 9 and your organization's account settings and instructions. Disconnecting also does not delete messages or calendar events already delivered to Google or other recipients.

To request access to or deletion of Google-derived data held by Primal, email support@primalsales.ai or jared@primalsales.ai with the subject Google Data Privacy Request. Identify the connected account, workspace, and data concerned; do not send passwords or access tokens. We may verify your identity and coordinate with your workspace administrator. We respond within 30 days or as required by applicable law. Deletion includes associated stored records and derived outputs within the request's scope, subject to applicable retention requirements and the backup periods described in Section 9.

5. How We Share Information

We do not sell personal information. We do "share" a limited amount of website-visit information for advertising measurement, in the specific sense California law uses that word — see 5.6 below. We also share information in these limited cases:

5.1 Service Providers

We share information with vendors who help us operate the Service, under contracts requiring them to protect the data and use it only for the agreed purposes. Categories include:

• Cloud hosting and infrastructure (e.g., Vercel, Supabase);
• AI providers (e.g., Anthropic, OpenAI);
• Payment processing (e.g., Stripe);
• Email and notification delivery (e.g., Resend, SendGrid);
• Analytics and error monitoring;
• Customer support tools.

5.2 Integrations You Authorize

When you connect third-party services (HubSpot, Salesforce, GoHighLevel, etc.), data flows between those services and PrimalSales as you configure. Their use of your data is governed by their privacy policies.

5.3 Legal and Safety

We may disclose information when required by law, subpoena, court order, or governmental request; to protect our rights, property, or safety, or those of users or the public; to investigate fraud, security, or technical issues; or to enforce our Terms.

5.4 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before personal information becomes subject to a different privacy policy.

5.5 Aggregated and De-Identified Data

We may share aggregated and de-identified data (which cannot reasonably identify any individual) for any lawful purpose, including marketing, research, and benchmarking.

5.6 Advertising Measurement ("Sharing" under California law)

Our public marketing pages run a Meta (Facebook) advertising pixel that tells Meta which pages a visitor viewed and whether they took an action such as booking a call, so we can measure whether our advertising works. When you book a call with us, submit a sales call for a free review, or start a trial from that review, we also send Meta a scrambled (hashed) version of your email address so they can tell us which advertisement led to it — Meta cannot read your address from it, and we never send your name, your company, or anything from the call itself. We also run LinkedIn and Reddit advertising tags that tell those platforms which pages you viewed and whether you took an action, for the same purpose; they receive no email address from us. We also run Gojiberry, which identifies which company a visit comes from so our sales team can reach out to that business; it receives no email address from us either. Under the CPRA this counts as "sharing" personal information for cross-context behavioural advertising. It is not a sale — no money changes hands for it. It applies to visitors of our marketing pages, not to data inside a customer's account.

You can turn this off for your browser at any time using the Your Privacy Choices link in the footer of every page. If you are visiting from the EU, the EEA, the UK, Switzerland or Canada, it does not run at all unless you accept it first.

6. Your Rights and Choices

Depending on your location, you may have rights including:

• Access: request a copy of personal information we hold about you;
• Correction: request that inaccurate information be corrected;
• Deletion: request that we delete your personal information, subject to legal retention requirements;
• Portability: receive your information in a structured, machine-readable format;
• Opt-out of sale/sharing: we do not sell personal information. We do share website-visit information for advertising measurement (see 5.6), and you can opt out of that on any page using the Your Privacy Choices link in the footer;
• Withdrawal of consent: where processing is based on consent, you may withdraw consent at any time.

To exercise any of these rights, email support@primalsales.ai. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before fulfilling certain requests.

6.1 Authorized Users

If you are an authorized user added to the Service by a customer (your employer), the customer controls your account and decisions about your data. Direct privacy requests to your customer organization first.

6.2 Prospect Data

If your data appears in our Service because a customer (a sales team) uploaded it, that customer is the controller of your data. We act as a processor on their behalf. Direct privacy requests to that customer.

7. California Privacy Rights

California residents have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect, use, and share;
• The right to delete personal information;
• The right to correct inaccurate information;
• The right to opt out of "sale" or "sharing" — we do not sell personal information, and you can opt out of the advertising "sharing" described in 5.6 using the link below;
• The right to limit use of sensitive personal information;
• The right to non-discrimination for exercising these rights.

To opt out of sharing: use the Your Privacy Choices link in the footer of every page. It turns off analytics, session recording and advertising cookies on the browser you are using, and your choice is remembered on that browser. You do not need an account and you do not need to email us. Turning them off changes nothing about the service you receive.

To exercise any of the other rights above, contact support@primalsales.ai. We do not knowingly collect or sell information of consumers under 16.

8. Data Security

We implement reasonable administrative, physical, and technical safeguards to protect personal information, including:

• Encryption in transit (TLS) and at rest;
• Multi-tenant architecture with org-level data isolation;
• Access controls, authentication, and audit logging;
• Regular security reviews and updates;
• Vendor security assessments.

No system is perfectly secure. If we become aware of a security incident affecting your personal information, we will notify you as required by law.

9. Data Retention

We retain personal information as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements. Specifics:

• Account data: for the duration of your subscription, plus 30 days after termination for export and recovery;
• Customer Data: for the duration of your subscription, plus 30 days after termination, then permanent deletion;
• Payment records: 7 years for tax and accounting purposes;
• Backups: rolling 90 days, with deletion confirmed thereafter;
• Legal hold: longer if required by law, regulation, or active litigation.

10. International Data Transfers

The Service is operated in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S. The Service is currently designed for U.S. customers; we do not offer the Service in jurisdictions where transfer of data to the U.S. requires specific safeguards we have not implemented.

11. Children's Privacy

The Service is not intended for individuals under 18. We do not knowingly collect personal information from children under 18. If we learn we have collected such information, we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app notice at least 30 days before they take effect. The "Effective Date" at the top reflects the most recent version.

13. Contact Us

For privacy questions, requests, or concerns, contact:

Primal Sales AI, LLC
Email: support@primalsales.ai
Subject line: Privacy Request

Primal Sales AI, LLC · A Florida Limited Liability Company · View all legal documents