Privacy Policy

1. Introduction and Our Role

Slothful LLC ("Company", "we", "our", or "us") operates the Iris Assistant service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our voice assistant and call management services.

Data Controller/Processor Roles: For business customers' caller data, we act as a processor; for our own analytics, service improvement, and marketing activities, we act as a controller.

By using our services, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use our services.

2. Call Recording & Consent

All inbound calls to our numbers are recorded for quality assurance and service improvement. Prior to connection we provide:

• • A prerecorded disclosure: "This call may be recorded for quality and training purposes."
• • A beep tone every 15 seconds during recording (as required by Connecticut law).

By continuing the call, you consent to recording. If you do not consent, please hang up or email us at privacy@slothful.ai for an alternative communication channel.

3. Information We Collect and Legal Basis

3.1 Information You Provide Directly

• • Account registration information (name, email, phone number, billing address)
• • Business information (company name, industry, operating hours)
• • Communication preferences and service configuration settings
• • Customer service interactions and support requests
• • Payment and billing information (processed by third-party processors)

3.2 Call and Communication Data

• • Call recordings and transcriptions for quality assurance and service improvement
• • Call metadata (phone numbers, duration, time stamps, call outcomes)
• • Text messages and SMS communications
• • Calendar and appointment data for scheduling purposes

3.3 Technical and Usage Information

• • Device information and browser data
• • IP addresses, location data, and network information
• • Service usage patterns and performance metrics
• • Cookies and similar tracking technologies

4. How We Use Your Information

4.1 Service Provision

• • Operating and maintaining the Iris Assistant service
• • Processing and routing incoming calls
• • Scheduling appointments and managing calendars
• • Providing customer support and technical assistance

4.2 Service Improvement and Analytics

• • Analyzing usage patterns to enhance service quality
• • Training and improving our voice recognition and response systems
• • Developing new features and capabilities
• • Conducting research and analytics for business purposes

4.3 Legal and Business Operations

• • Complying with legal obligations and regulatory requirements
• • Protecting against fraud, abuse, and security threats
• • Enforcing our terms of service and other agreements
• • Processing payments and managing billing

5. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties except as described below:

5.1 Service Providers

We may share information with trusted third-party service providers who assist us in operating our platform, including:

• • Cloud infrastructure and hosting providers
• • Payment processing companies
• • Communication and telephony service providers
• • Analytics and monitoring services

5.2 Legal Requirements

We may disclose information when required by law, including:

• • In response to valid legal process (subpoenas, court orders, etc.)
• • To comply with regulatory requirements
• • To protect the rights, property, or safety of our company, users, or others
• • In connection with fraud prevention or security investigations

5.3 Business Transfers

Information may be transferred in connection with mergers, acquisitions, or sales of business assets, with appropriate notice to affected users.

6. Data Security and Protection

We implement comprehensive security measures to protect your information:

• • End-to-end encryption for call data transmission
• • Secure data storage with enterprise-grade access controls
• • Regular security audits and penetration testing
• • Employee training on data protection and privacy practices
• • Incident response procedures for security breaches
• • Compliance with industry-standard security frameworks (SOC 2, ISO 27001)

7. Data Retention and Deletion

We retain information only as long as necessary for legitimate business purposes:

• • Call recordings: Retained for 12 months to investigate call disputes and improve speech models
• • Account information: Retained while your account is active and for 3 years after closure for customer service and legal compliance
• • Billing records: Retained for 7 years as required by tax and accounting regulations
• • Marketing communications: Until you unsubscribe or object to processing

You may request deletion of your personal information subject to legal and operational requirements.

8. Connecticut Consumer Privacy Rights

Connecticut residents may exercise the following rights under the Connecticut Data Privacy Act ("CTDPA"), regardless of whether we currently meet statutory thresholds:

We will respond within 45 days and will honor Global Privacy Control (GPC) signals starting January 1, 2025.

If you are unsatisfied with our response, you may appeal within 60 days by emailing privacy@slothful.ai with "Appeal" in the subject line.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place for international transfers, including Standard Contractual Clauses approved by relevant authorities and adequacy decisions where applicable.

10. Children's Privacy

Children Under 13: Our services are not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13 (COPPA compliance).

Teens 13-16: Under Connecticut law, we require opt-in consent from parents/guardians before selling personal information of teens aged 13-16.

If we become aware that we have collected information from children under 13, we will take steps to delete it promptly.

11. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• • Maintain user sessions and preferences (essential cookies)
• • Analyze website usage and performance (analytics cookies)
• • Provide personalized experiences (preference cookies)
• • Ensure security and prevent fraud (security cookies)

You can control cookie settings through your browser preferences. We honor Global Privacy Control (GPC) signals for non-essential cookies starting January 1, 2025.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable laws. We will notify you of material changes by email or through our service interface at least 30 days before they take effect. Your continued use of our services after such changes constitutes acceptance of the updated policy.

We maintain a changelog of policy updates available upon request.

13. Contact Information

For questions about this Privacy Policy or to exercise your privacy rights, contact us at:

For EU residents: If you believe we have not adequately resolved your privacy concerns, you have the right to lodge a complaint with your local data protection authority.