Privacy and Data Handling Policy

1. Data Controller

SAMU LLC ("SAMU.AI"), registered in the State of Delaware (Filing Number: 2679071), is the data controller for the personal data we collect and process through our website and application.

‍

2. Scope of This Policy

This Privacy Policy governs the collection, processing and storage of personal data in connection with the use of SAMU.AI's services. We are committed to complying with the privacy and data protection laws in force in the jurisdictions where we operate, as well as to following the Data Protection Principles of the Red Iberoamericana de Protección de Datos (RIPD) (Ibero-American Data Protection Network).

‍

3. Data Protection Officer (DPO)

SAMU.AI has appointed a Data Protection Officer (DPO) to oversee compliance with privacy and data protection regulations, as well as to serve as the point of contact between SAMU.AI, its clients and the data protection authorities. Identity of the DPO: Jonathan Saul Sosin — [email protected]. Duties of the DPO: 1. Compliance Oversight: Monitor SAMU.AI's compliance with local and international data protection regulations. 2. Management of User Requests: Facilitate and coordinate the exercise of data subjects' rights (access, rectification, cancellation, objection, portability and restriction of processing). 3. Advice to SAMU.AI: Provide guidance on best practices and obligations in the handling of personal data. 4. Relationship with Authorities: Act as the point of contact with the data protection authorities in the jurisdictions in which we operate. 5. Security Incident Management: Advise SAMU.AI on the management of data security incidents and ensure that response procedures are effective.

‍

4. Data Classification

SAMU.AI classifies personal data and other types of information according to their level of sensitivity and legal requirements: Confidential Data (highly sensitive data that requires the highest levels of protection, such as personal identification data, financial data, trade secrets and sensitive or special category data under the GDPR), Restricted Data (information that requires significant protection and access limited to employees who need the information to carry out their responsibilities) and Public Data (information intended for public consumption that may be freely distributed outside SAMU.AI).

‍

5. SAMU.AI's Role in Data Processing

SAMU.AI plays different roles in the processing of personal data depending on how such data is obtained and processed. When SAMU.AI is the Data Controller: in situations where SAMU.AI interacts directly with users and obtains their explicit consent to process their personal data. When SAMU.AI is the Data Processor: in situations where SAMU.AI draws on the conversations and data provided by its clients, it acts as Data Processor on behalf of the client. In these cases, the client is the Data Controller and SAMU.AI complies with the processing requirements established in the contract, without using the data for any other purpose. With respect to Google user data and the content that client organizations bring into the application, SAMU.AI acts as Data Processor on behalf of the client organization and is governed by section 10.

‍

6. Clients' Responsibility for Obtaining Consent

When SAMU.AI acts as Data Processor of personal data on behalf of its clients, the clients are responsible for obtaining the informed and explicit consent of their employees, end users or other individuals whose personal data may be processed through our platforms. The consent obtained must be explicit as to the fact that their communications, including calls, emails and other types of information exchange, will be processed and stored on the SAMU.AI platform. This notice must include the specific purpose of the processing, the duration of the storage of this data at SAMU.AI and a clear reference to this privacy policy.

‍

7. Data Handling by Classification

Confidential Data: access limited to authorized employees and roles; use of encryption, multi-factor authentication and strict protection measures. Devices containing this data must be securely wiped at the end of their use. Restricted Data: access restricted to employees who need the information for business functions. Any transfer to third parties must be approved and carried out under contract. Public Data: does not require special protection or handling controls, as it is freely accessible.

‍

8. Data Labeling

All confidential data must be labeled as "Confidential" in documents and printed copies to ensure appropriate handling, as well as its proper storage and secure destruction when it is no longer needed.

‍

9. Storage and Security of Conversations and Emails

SAMU.AI retains the conversations and emails shared by clients solely for the specific purposes defined in the service agreement. This data will be subject to the technical and organizational security measures necessary to protect it against unauthorized access, alteration, loss or disclosure. SAMU.AI will not use this data for any purpose other than those defined in the service agreement, unless required by law. Google user data is further governed by section 10.

‍

10. Google User Data

SAMU.AI accesses Google user data only when the user connects their Google account and grants the corresponding permissions on Google's consent screen. This section governs the access, use, storage, protection, transfer and deletion of such data and prevails over any other section of this Policy with respect to it. 1. Data Accessed by SAMU.AI: Basic Account Information (name, email address and profile picture, obtained through the openid, email and profile permissions, to sign the user in and identify them within their organization), Google Calendar (event title, date and time, attendees, video call link and description, and the calendar time zone, obtained through the calendar.events permission, to identify the sales meetings that SAMU.AI must record and transcribe, and to create or update the events the user schedules from the application) and Gmail in read-only mode (obtained through the gmail.readonly permission and only if the user enables email sync: the mailbox labels or folders and, for messages, the sender, recipients, subject, date, thread identifiers, message body and the name, type and size of attachments). SAMU.AI does not download the content of attachments and does not send, modify or delete emails. Sync starts at the time of connection and keeps only business emails: for messages received in the folders selected by the user, it discards drafts and bulk or automated mailings, and the organization may limit it to messages with external participants or with contacts from its CRM; for sent messages, it keeps only replies to conversations already synced. If the user expressly requests it, sync also includes the seven days prior to the connection, limited to email exchanged with the contacts of their open deals. 2. Use of Data: SAMU.AI uses Google user data exclusively to provide and improve the user-facing features of the application: displaying the user's sales email conversations and meetings, linking them to contacts and deals, generating summaries, tasks and indicators for the user and their team, and answering the user's questions to the SAMU.AI assistant. SAMU.AI will not use Google user data for advertising, including personalized, targeted or interest-based advertising; will not sell it or transfer it to data brokers or advertising platforms; will not use it to determine creditworthiness or for lending purposes; and will not use it to develop, improve or train generalized or non-personalized artificial intelligence or machine learning models. No person at SAMU.AI will read this data, except with the user's explicit consent for specific messages, when necessary for security purposes, to comply with applicable law, or when the data is aggregated and anonymized for internal operations. 3. Transfer and Disclosure: SAMU.AI does not sell Google user data and only shares, transfers or discloses it to provide or improve the features described above, in the following cases: User's Organization (synced conversations and meetings are visible to users of the same SAMU.AI account according to the roles and permissions defined by the organization, and are never shared between different organizations), Service Providers (cloud infrastructure providers that host the application's databases, search indexes and file storage, and artificial intelligence language processing providers that generate summaries, tasks, indicators and assistant answers; all of them act under contract and on behalf of SAMU.AI, solely to provide these features, with confidentiality and security obligations equivalent to those in this section, and without using the data to train their own models), Client's CRM (when the organization connects its CRM and expressly enables contact creation from email, SAMU.AI sends the name and email address of the new contact) and Legal Requirements (when required by law or a competent authority, or in connection with a merger or acquisition, with prior notice to the user and under the same commitments set out in this section). 4. Data Protection: SAMU.AI protects Google user data through encryption in transit (TLS 1.2 or higher), encryption at rest of databases and storage (AES-256), logical isolation of each client's data, access to production environments restricted to authorized personnel with multi-factor authentication and audit logging, cryptographic validation of notifications received from Google, security monitoring and incident response procedures. SAMU.AI requests only the permissions required for each feature. 5. Retention and Deletion: We retain synced Google user data until the user or their organization requests its deletion or the organization's service agreement ends. The user may stop the sync at any time from Settings › Integrations and revoke access from their Google account settings (myaccount.google.com/permissions); from that moment on, SAMU.AI stops accessing new data. The user or their organization may request the deletion of already synced data and access tokens by writing to [email protected]; SAMU.AI will delete it within a maximum of 30 days, and from backups within a maximum of 90 days. The same periods apply upon termination of the organization's agreement. 6. Limited Use: SAMU.AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

‍

11. Data Retention and Deletion

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected. Once the data is no longer needed, it will be securely deleted. Data in physical format will be destroyed by shredding or other secure methods.

‍

12. Legal Requirements and Exceptions

In certain cases, SAMU.AI may be subject to legal proceedings that require the retention of data beyond the established periods. These records will be exempt from any other requirement specified within this policy and will be retained in accordance with the requirements identified by legal counsel.

‍

13. Rights of Data Subjects

In compliance with local regulations, SAMU.AI guarantees users the exercise of the following rights: Access (the right to know what personal data we hold), Rectification (to request the update or correction of inaccurate or incomplete data), Cancellation and Objection (the right to request the deletion or suspension of the processing of their data), Portability (the right to receive the data in a structured, commonly used format) and Restriction of Processing (the right to restrict the processing of data under certain circumstances). To exercise these rights: [email protected]

‍

14. International Data Transfers

SAMU.AI will ensure that any transfer of personal data to third countries is carried out in accordance with the required levels of protection, applying contractual clauses or agreements that ensure the confidentiality and security of the data. The categories of providers that receive Google user data are described in section 10.

‍

15. Use of Cookies and Similar Technologies

SAMU.AI uses cookies and similar technologies on its website to improve the user experience, analyze traffic and understand how users interact with our content. Types of cookies we use: Essential (necessary for the basic functioning of the site), Performance (help us understand how users interact with the site), Functionality (allow user preferences to be remembered) and Marketing (used to deliver relevant ads to the user and measure the effectiveness of advertising campaigns). These cookies are used exclusively on the SAMU.AI website and are never combined with Google user data or with application content. Users may manage their cookie preferences at any time through their browser settings.

‍

16. SAMU.AI's Commitment

SAMU.AI is committed to maintaining the confidentiality and security of personal data and to handling all habeas data requests with the utmost respect and diligence. This commitment extends to all company processes that involve the handling of personal data.

‍

17. Data Security

We implement appropriate technical and organizational security measures to protect personal data against unauthorized access, alteration, loss or improper disclosure. The measures applicable to Google user data are detailed in section 10.

‍

18. Changes to This Policy

This Policy may be amended to reflect updates to our services or regulatory changes. Users will be notified of any significant modification through our usual communication channels.

‍

19. Contact

For questions or concerns about this Policy or about the processing of your personal data, contact us at: [email protected]