Download this document (Markdown) · Use your browser’s Print command to save a PDF.

Autonomized Privacy Notice

Version AUT-PRIVACY-2026-09-15.1. Published September 15, 2026 (UTC). This notice explains the purposes, categories and choices relevant to Autonomized. Feature-specific processing depends on the services a business selects. Required processing schedules and transfer arrangements must be established before the affected UK/EU processing begins.

1. Who we are and how this notice applies

Autonomized LLC, a Wyoming limited liability company, operates Autonomized.io. This notice explains personal information processed for our website, business accounts, demonstrations, billing, support, security, and related services. It also explains our role when a business uses the Autonomized CRM or Anna to handle information about its contacts, staff, and customers.

For account administration, our own marketing, billing, fraud prevention, and decisions about operating our business, Autonomized generally acts as the organization determining the purposes and means of processing. For personal information that a business instructs us to process in its CRM, we generally act as its processor or service provider under a Data Processing Addendum. In an agency arrangement, the business, agency, and Autonomized may occupy different roles. Actual activities determine those roles.

If you are communicating with one of our customers, that business's privacy notice also applies. It ordinarily decides why your information is collected and how its relationship with you is managed. We will help route a request to the appropriate business and comply with our own obligations. This notice does not allow a customer to waive your rights for you.

2. Contact details

Privacy questions and requests: support@autonomized.io.

Legal correspondence: support@autonomized.io.

Registered-agent address: 30 N Gould St, Ste N, Sheridan, WY 82801, United States. This is the registered-agent address, not our operating office. Use support@autonomized.io for privacy requests and ordinary legal correspondence.

Support: Autonomized support.

For UK/EU deployments requiring a local representative, the deployment notice identifies that representative before the affected processing begins. Our Wyoming registered agent is not a UK or EU data-protection representative. Contact support@autonomized.io for the applicable deployment notice and processing terms.

3. Information we collect

Business and account information. Names, work contact details, business names and addresses, industry, account identifiers, role and permission information, workspace membership, authentication events, and preferences. We collect organization and signer details needed to establish authority and manage the contract.

Agreement and transaction evidence. The agreement versions and copies presented and accepted, acceptance times, signer name and title, business-authority statements, authenticated account and workspace identifiers, receipt identifiers, and reasonably necessary technical metadata such as IP address and user agent. We also retain records of amendments, cancellations, billing authorizations, and arbitration opt-outs where applicable. These records are used to establish the transaction and administer or defend legal rights, not to create recipient marketing consent.

CRM and business workflow information. Contact records, communications, appointments, tasks, quotes, invoices and payment status, uploaded documents, business knowledge, instructions, approval decisions, and integration records supplied by a customer. The actual fields depend on that customer's authorized configuration. A customer must have an appropriate basis to provide personal information about other people.

AI interactions and recordings. Prompts, responses, voice inputs, call metadata, audio recordings where enabled lawfully, transcripts, summaries, tool requests, action results, and feedback. These can contain personal information. Recording and transcription choices depend on the service and the business operating the interaction. Necessary notices and consents must be provided before recording where required. An AI disclosure is separate from permission to record.

Connection information. Information made available through authorized email, calendar, CRM, file, payment, and other integrations, limited by the granted scopes and the selected workflow. This can include message content, metadata, contact details, and calendar entries. We may hold protected access tokens needed to maintain a connection. Disconnecting access stops future authorized retrieval, subject to provider behavior; it does not automatically erase records already lawfully imported.

Payments and support. Billing contact information, subscription and invoice details, payment status and processor references, support tickets, troubleshooting information, and correspondence. Payment providers process payment credentials under their own notices. Do not send full card details, security codes, passwords, or one-time verification codes to Anna or ordinary support. A caller or uploader can inadvertently include payment information in content; if that happens, notify us so it can be handled appropriately.

Device and usage information. IP address, browser and device information, operating system, requested pages, timestamps, approximate location inferred from IP where used, service errors, and security and performance events. Cookie and similar-technology collection depends on the choices and controls explained below. We do not describe every technical log as anonymous; identifiers can make it personal information.

4. Sources of information

We receive information from the individual, the business or agency managing the workspace, authorized users, connected services, lawful communications with the business, payment and service providers, and operation of our website and Services. If an optional enrichment source is enabled, the customer must be told the source category, purpose, and applicable rights before use. A public record, enrichment result, or publicly listed business contact does not by itself establish consent to automated marketing.

We require customers to minimize unnecessary information. The standard service is not intended to process protected health information requiring a business associate agreement, biometric identification templates, sensitive information about children, or other restricted data without a separately approved arrangement. This restriction does not eliminate duties concerning sensitive information received unexpectedly.

5. Why information is used

We use account and business information to establish and manage accounts, verify access and signing authority, provide support, communicate about the Services, and administer subscriptions and agreements. We use transaction records to process payments through the selected provider, reconcile authorized charges, investigate billing problems, and maintain records required by law.

We process customer-controlled CRM information to carry out the customer's lawful documented instructions, such as managing contacts, preparing a response, arranging an appointment, maintaining records, or executing an authorized workflow. Customer-configured automation may generate recommendations or perform actions; those actions must remain within the accepted authority and controls.

We use necessary logs and relevant content to investigate errors, security incidents, misuse, consent failures, or service problems; protect accounts; and support reliability. Access for those purposes is limited to authorized personnel or providers with an appropriate need. We do not describe all support access as consent-based when it instead relies on another lawful basis.

Our own marketing must follow applicable channel rules and the individual's choices. Necessary security, billing, contract, and service messages may continue after opting out of unrelated marketing, where lawful. We also process information to comply with legal obligations, respond to valid legal process, and establish, exercise, or defend claims.

6. AI processing and model training

Anna uses AI services to process information relevant to the selected function and produce content, voice, summaries, or proposed actions. Information sent to an AI provider may include relevant prompts, knowledge, conversation content, and necessary context. The selected AI feature and authorized integrations determine the provider and information processed. AI-provider handling can include temporary retention, security or abuse review, logging, and authorized human access under the applicable service terms; it is not necessarily zero retention.

We do not treat acceptance of this Privacy Notice or a general instruction to improve Anna as permission to train general-purpose models on customer-controlled personal information. Any additional training purpose requires a valid legal basis, accurate notice, and any necessary specific authorization and processor arrangements. Customer-specific knowledge retrieval and configuration are distinct from general model training. A deployment requiring particular provider training or retention settings must have those settings confirmed in its processing schedule before the affected feature is used.

AI can generate inaccurate personal information or misleading inferences. Customers and affected individuals may seek correction and appropriate human review through the relevant business or our privacy contact, as applicable. A chat interface cannot make a legally required human decision or appeal process disappear. The standard Services do not authorize solely automated consequential decisions about credit, employment, insurance eligibility, housing, or comparable significant matters without separately approved legal and operational arrangements.

7. Calls, messages, recording, and choices

Providing a phone number, signing our business agreements, or acknowledging this notice does not by itself consent to marketing calls, AI-voice calls, text campaigns, or recording. The responsible business must obtain the permissions appropriate to the particular communication and technology. Required marketing choices must identify the business, channel, and purpose and remain separate from platform contract acceptance.

For supported SMS programs, follow the instructions in the message to stop messages or request help. Reasonable verbal or written objections must also be handled as applicable. Consent and suppression records may be retained in limited form so that an objection remains effective. Deleting all evidence of an opt-out can cause unwanted contact, so a minimal suppression record may need to remain.

Marketing email includes an appropriate unsubscribe method. Withdrawal of marketing consent does not revoke a previously signed business agreement. Similarly, agreement cancellation does not automatically erase records required to document communications permissions or legal obligations. Recording choices and any alternative contact route must be explained in the relevant interaction.

Mobile numbers and text-message opt-in records are not shared with third parties or affiliates for their independent marketing. They may be processed by the business responsible for the communication and its necessary communications providers to operate the requested program and maintain lawful records. Any other sharing requires a separate lawful basis and accurate disclosure.

8. Who receives information

The customer organization and authorized agencies. Account administrators and permitted users can access information according to their roles. A properly authorized agency may administer a customer's workspace. Shared organizational records can be visible to multiple authorized users; individual accounts are not necessarily private from the business administrator.

Service providers and subprocessors. We use providers for hosting, databases, AI processing, voice generation and transcription, communications, authentication, payment processing, support, and security. Our services use infrastructure and capabilities including Supabase for database and authentication, Cloudflare for website delivery, Anthropic for AI processing, Twilio for telephony and messaging, ElevenLabs for selected voice functions, and Stripe for payments. Other connected services depend on the functions selected. Request the applicable subprocessor schedule for the relevant legal entities, processing locations, data categories, provider settings and transfer arrangements; a brand list is not a completed transfer instrument. Providers process customer-controlled information under required contractual restrictions. Some payment, carrier, or customer-selected integration activities may involve independent controllers under their own notices; those roles must be identified accurately.

Customer-selected integrations. When authorized, information may be sent to or received from the connected provider to perform the selected workflow. The customer's instructions, provider permissions, and applicable privacy commitments govern the connection. A broad OAuth permission does not make every possible use necessary or permitted.

Legal and corporate matters. We may disclose information when legally required, to protect legal rights and security where lawful, to professional advisers under appropriate duties, or in connection with a genuine corporate transaction subject to suitable confidentiality and data-protection safeguards. We do not claim that a business sale permits unrestricted reuse of personal information.

We do not sell customer-controlled personal information as a data product or authorize its use for a provider's unrelated marketing. Legal definitions of sale, sharing and targeted advertising can be broader than a sale for money. You may submit applicable opt-out requests to support@autonomized.io. Any additional advertising or enrichment feature requires an accurate disclosure and applicable choices before that use begins.

9. Cookies and similar technologies

Necessary technologies maintain authentication, security and user-selected settings. Website delivery and request logs can include IP addresses, requested URLs and device information. We do not describe such logs as anonymous merely because they are used for aggregate reports.

The legal pages presenting this notice do not load optional analytics or advertising scripts. Other website or connected-service surfaces may use different technologies and must present applicable choices. Where consent is required, optional analytics, advertising, session replay and comparable tools require that consent before use. Contact support@autonomized.io to ask about a particular surface or change an applicable privacy choice. Blocking necessary storage in your browser may prevent sign-in or saved settings. Browser preference signals, including Global Privacy Control, are handled according to their applicable legal scope. A business account does not waive visitors' cookie or privacy rights.

10. UK and EU lawful bases and transfers

For processing where Autonomized is a controller, applicable bases may include performing a contract with an individual customer, legitimate interests in operating and securing the business and communicating with business representatives, compliance with legal obligations, and consent for processing that requires it. A contract with a company is not automatically a contract-based lawful basis for every employee's information. Legitimate interests require an assessment of necessity and the individual's rights; they do not override a channel-specific consent requirement.

Where processing relies on consent, it can be withdrawn prospectively without affecting prior lawful processing. Direct marketing objections and other applicable rights remain available. Special-category data requires an additional legal condition; the general bases above are insufficient by themselves. UK automated-decision rules must be evaluated under the current UK framework separately from EU rules.

Personal information may be processed in the United States and other countries identified in the applicable processing schedule. Access by support personnel outside a region can itself be relevant to transfer rules. Where required, transfers must rely on an applicable adequacy arrangement or appropriate safeguards such as the European Commission's standard contractual clauses and the approved UK Addendum or another valid mechanism, with necessary assessments and supplementary measures. We do not claim Data Privacy Framework certification, EU-only hosting, or an international-transfer arrangement unless it is verified for the relevant entity and activity. Contact us for information about applicable safeguards and how to obtain a copy, subject to lawful redactions.

11. Retention and deletion

We retain personal information for the purposes described, for the period needed to provide the agreed Services, and where necessary for legal obligations, security, disputes, or maintaining effective consent and suppression records. Retention depends on the data category and purpose; account closure does not justify retaining every recording indefinitely.

We determine retention by the service term and customer instructions; the need to deliver, correct or export records; applicable accounting, tax and other legal periods; security and dispute needs; and the need to keep opt-outs effective. CRM content and recordings are assessed separately from agreement and billing evidence. Applicable Orders and processing schedules specify any agreed fixed periods, deletion timing, backup cycle and export window. Contact us for the period or criteria applicable to a particular record. Legal holds may require limited retention after a deletion request.

When data is deleted from active systems, restricted backup copies may remain until the applicable backup cycle expires. Relevant deletion and suppression instructions must be reapplied after restoration. Truly anonymized information may be retained where lawful; removing a name alone does not make a record anonymous. Contact us for export and deletion requests; deletion is not necessarily immediate across every provider or backup.

12. Security and incidents

We use administrative and technical measures appropriate to the processing risk and the documented security schedule. The service uses authenticated accounts, workspace permissions, database access controls and encrypted HTTPS connections. Specific backup, recovery, provider-access and other deployment commitments are governed by the applicable processing and security schedule. No internet service can promise that every attack, mistake, or disclosure will be prevented.

Customer organizations control their own users, devices, permissions, and integration choices. We remain responsible for our own commitments and applicable duties. We investigate suspected incidents and provide notices and assistance as required by law and the DPA. This notice is not a certification under SOC 2, ISO or HIPAA, or a promise of zero retention or immunity from security incidents.

13. Privacy rights and requests

Depending on the applicable law and our role, an individual may request access, correction, deletion, portability, restriction, an objection to processing, withdrawal of consent, or applicable protections and review for automated decisions. U.S. state laws may provide rights concerning sale, targeted advertising, profiling, sensitive information, authorized agents, and appeals of denied requests. The existence and scope of each right depend on the law, its coverage thresholds and exemptions, and the circumstances.

Contact the privacy channel above with enough information to identify the relevant account or interaction. We will use proportionate verification and will not request unnecessary sensitive identification. Authorized agents may submit requests with appropriate proof of authority. We will respond within applicable legal periods, explain lawful limitations or extensions, and provide any available appeal process. If we process the information for a customer, we will assist that customer and route the request appropriately rather than disclaim all responsibility.

We do not retaliate against individuals for exercising protected rights. UK and EU individuals may complain to their competent supervisory authority, including the UK's Information Commissioner's Office where applicable, without first completing our internal complaint process. Other regulators and courts remain available under applicable law. Acceptance of platform terms does not waive these rights.

14. Children and sensitive information

Our accounts and website offerings are directed to adults using business software. We do not knowingly invite children to open accounts. Businesses using the Services must assess whether their own customers or recipients include children and must not assume that a business-use label eliminates children's privacy protections.

If restricted information about a child or other sensitive information is received, contact us promptly so we can assess minimization, deletion, required permissions, and other legal duties. A healthcare, school, employer, or financial-services customer needs an appropriate deployment review before processing sensitive or regulated records.

15. Updates

We will identify changes with a distinct version and effective date and give additional notice where appropriate or required. A material expansion of data use requires a valid legal basis and any necessary new consent or contractual authorization before that use begins. Continuing to use a website is not a blanket permission for unrelated model training, marketing, or disclosure.

We preserve prior notices where needed to explain the practices applicable at the relevant time. Privacy questions can be raised without accepting revised commercial terms.