How we handleyour privacy.

1. What information do we collect?

In shortWe collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information we collect may include the following:

• Names
• Phone numbers
• Email addresses
• Usernames
• Passwords
• Contact or authentication data

Sensitive Information. We do not process sensitive information.

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Facebook, Twitter, or other social media account. If you choose to register in this way, we will collect the information described in the section called "How do we handle your social logins" below.

All personal information that you provide to us must be true, complete and accurate, and you must notify us of any changes to such personal information.

2. How do we process your information?

In shortWe process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, including:

• To facilitate account creation and authentication and otherwise manage user accounts.
• To deliver and facilitate delivery of services to the user.
• To respond to user inquiries/offer support to users.
• To fulfill and manage your orders.
• To request feedback.
• To post testimonials.
• To protect our Services.
• To identify usage trends.
• To comply with our legal obligations.

3. What legal bases do we rely on to process your personal information?

In shortWe only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law, like with your consent, to comply with laws, to provide you with services, to protect your rights, or to fulfill our legitimate business interests.

We may process your information if you have given us specific permission (i.e. express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (i.e. implied consent). You can withdraw your consent at any time.

4. When and with whom do we share your personal information?

In shortWe may share information in specific situations described in this section and/or with third-parties.

• Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisitions of all or a portion of our business to another company.
• Affiliates. We may share your information with our affiliates, in which case we will require those affiliates to honor this privacy notice.

5. Do we use cookies and other tracking technologies?

In shortWe may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to access or store information.

6. How do we handle your social logins?

In shortIf you choose to register or log in to our Services using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details. The profile information we receive may vary depending on the social media provider concerned, but often include your name, email address, friends list, and profile picture. We will use information we receive only for the purposes that are described in this privacy notice.

7. How do we use data from Google services?

In shortIf you connect a Google account, we only access the Google data needed for the feature you turned on, we use it only to provide that feature to you, and our use complies with the Google API Services User Data Policy, including the Limited Use requirements.

Some features of Arturito let you connect a Google account. We only request access when you choose to connect one, and we only request the permissions each feature needs:

• Google Calendar (see your calendars and view and edit events): so your AI assistant can check your availability and book or cancel the appointments your customers request in a conversation.
• Google Sheets (read-only access to your spreadsheets): so you can keep your product or service catalog in a spreadsheet you choose. We read the rows and column headers of that spreadsheet to import them as your catalog, we keep it in sync periodically, and your AI assistant uses that information to answer your customers. You can also let your assistant look up rows of a spreadsheet you choose while it answers a customer. We never create, modify or delete your spreadsheets.
• Email address: when a team member connects their own Google Calendar, to show which Google account is connected.

The data we read from Google is stored in our database, which is encrypted at rest, together with the access tokens Google issues to us. It is processed by our servers and by the AI service providers that generate your assistant's responses, only to provide the features described above to you.

Arturito's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements. In particular:

• We only use Google user data to provide and improve the user-facing features described above.
• We do not sell Google user data, and we do not use or transfer it for advertising, including retargeting or personalized ads.
• We do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models.
• We do not transfer Google user data to third parties except as needed to provide the features above, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
• No person reads your Google user data unless you give us permission for specific data (for example, in a support request), it is necessary for security purposes or to comply with applicable law.

You can disconnect your Google account at any time from the same screen where you connected it. When you do, we revoke our access with Google and delete the stored access tokens. You can also revoke access from your Google Account at https://myaccount.google.com/permissions. To request deletion of data we imported from Google, email us at legal@genloyal.com.

8. How do we handle your voice?

In shortIf you create a cloned voice, we process recordings of your voice to review and create it, our voice provider may also use them to improve its own models, we delete our copies once the request is closed, and we keep a record of your consent to be able to prove it.

Arturito lets you create a digital copy of your own voice to generate audio about your listings (see the Cloned Voice section of our Terms). Because a voice can identify a person, we treat these recordings as sensitive personal information and only process them with your express consent, which you give before sending them.

• What we collect: the voice samples you record or upload, and a phrase you read aloud at the moment of the request, together with its automatic transcription.
• Why: to check that the voice is yours (our team listens to the recordings and may compare them with voice messages you sent through Arturito) and to create your cloned voice. We do not use your voice for any other purpose and we do not sell it, although our voice synthesis provider may use it as described below.
• Who receives it: when a request is approved, the samples are sent to ElevenLabs, the voice synthesis provider that creates and hosts your cloned voice and generates the audio, which may process them outside your country. ElevenLabs may also use the samples, and the audio generated with your voice, to improve its own models, under its own terms and privacy policy. The phrase is transcribed by the AI service providers we use.
• How long: we delete our copies of the recordings when the request is approved, rejected, cancelled or expires (requests expire after 30 days without review). Your cloned voice exists until you delete it from your account settings, until we remove it after a complaint, or until you delete your account, and deleting it also deletes it with the provider. Deleting it does not undo any use the provider has already made of your recordings to improve its models.
• Record of your consent: we keep the text and version you accepted, the date, your IP address and device, the phrase and its transcription (not the recording) and the outcome of the request. We keep this record even if you delete your voice or your account, for up to five years after the request is closed, only to prove your consent and to handle complaints or legal claims; after that we delete it.

You can withdraw your consent at any time by deleting your cloned voice. To exercise your other rights over this information, email us at legal@genloyal.com.

9. How long do we keep your information?

In shortWe keep your information for as long as necessary to fulfill the purposes in this privacy notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or if this is not possible, then we will securely store your personal information and isolate it from any further processing until deletion is possible.

10. How do we keep your information safe?

In shortWe aim to protect your personal information through a system of organizational and technical security measures.

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure.

11. Do we collect information from minors?

In shortWe do not knowingly collect data from or market to children under 18 years of age.

By using the Services, you represent that you are at least 18 years or that you are the parent or guardian of such minor and consent to such minor dependent's use of the Services.

12. What are your privacy rights?

In shortIn some regions, such as Canada, United States and Mexico, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time.

In some regions, you have certain rights under applicable data protection laws. These may include the right (i) to request access and obtain a copy of your personal information (ii) to request rectification or erasure (iii) to restrict the processing of your personal information, and (iv) if applicable, to data portability.

Withdrawing your consent: If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us using the contact details provided below.

13. Controls for Do Not Track

Most web browsers and some mobile operating systems and mobile applications include a Do Not Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals.

14. Do California residents have specific privacy rights?

In shortYes, if you are a resident in California, you are granted specific rights regarding access to your personal information.

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information we disclosed to third parties for direct marketing purposes. GenLoyal LLC has not sold or shared any personal information to third-parties for a business or commercial purpose in the preceding twelve (12) months.

15. Do Mexican residents have specific privacy rights?

In shortYes, if you are a resident in Mexico, you are granted rights to access, rectify, cancel or oppose (the "ARCO Rights") regarding access and treatment to your personal information.

You have the right at all times to access, rectify, cancel or oppose the treatment we give to your personal data, as well as to revoke the consent given for the treatment of the same, which you may exercise through the Special Unit for the Protection of Personal Data of GenLoyal LLC. For any doubt or clarification, as well as for the exercise of your ARCO Rights, please contact us at legal@genloyal.com

16. Do we make updates to this notice?

In shortYes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this privacy notice from time to time. The updated version will be indicated by an updated "Revised" date and the updated version will be effective as soon as it is accessible.

17. How can you contact us about this notice?

If you have questions or comments about this notice, you may email us at legal@genloyal.com or contact us by post at:

GenLoyal LLC
651 N Broad St, Suite 201
Middletown, DE, 19709, USA

18. How can you review, update, or delete the data we collect from you?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, change that information or delete it. To request to review, update, or delete your personal information please email us at legal@genloyal.com