Privacy Policy

Spiffy Privacy Policy

Updated July 11, 2024

Thank you for taking the time to read this Privacy Policy. This Privacy Policy applies to the personally identifiable information (also referred to herein as “personal information”) that Spiffy AI, Inc. (“Spiffy,” “we”, “us,” or “our”) collects or receives through our interactions with you, your use of our website www.spiffy.ai or other websites that we link this Privacy Policy to (each, a “Site”), your use of any Spiffy service, application, platform, and other products that display or link to this Privacy Policy, and your registration or attendance to any of our demonstrations, webinars, or other events (collectively, “Services”).

This Privacy Policy describes the information that we collect, how we use it, how we protect it, and the choices you can make about your information. If you do not agree with any of the terms of this Privacy Policy, you should immediately stop using our Services and the Site. We understand most people have a hard time reading caps, but we hope bold is easier to read.

This Privacy Policy does not apply to personally identifiable information that has been aggregated and anonymized where such information is no longer capable of identifying a specific individual. This Privacy Policy does not apply to employees or job applicants. If you are a job applicant, we will make our job applicant privacy policy available to you upon your submission of an application for employment.

Information We Collect

Spiffy collects the following types of personally identifiable information in the manner described below.

Information You Provide to Us. You may voluntarily provide us with personally identifiable information, including: (a) your name, email address, and any other information that you provide when you access the Site or Services, register to use the Site or a Service, or fill out forms that we make available via the Site or Services; (b) information that you provide to us when you contact us, including when you communicate with our chatbot; or (c) any other information you voluntarily provide us while using the Site or Services, including documents, and document metadata.
Information We Collect Automatically. We automatically collect information that may personally identify you through tracking technologies (see the section “Cookies, Other Storage and Web Beacons” for more information). We collect the following types of information automatically through tracking technologies:
- Your Internet Protocol (IP) address;
- Domain name of your Internet service provider;
- Your approximate geographic location;
- The website you came from, the pages that you visit on the Site, the time of your visit to the Site and the page you visit after leaving the Site;
- Device identifiers, advertising identifiers or other unique identifiers;
- Information about your Internet connection, browser, or similar kinds of information; and
- Aggregated information that cannot be used to specifically identify you when you use or visit the Site or a Service that may be combined with information that does identify you.‍
Information We Collect from Other Sources. We may receive personally identifiable information from other sources, like third party data providers, public databases, joint marketing partners, referral or reseller partners, affiliate marketing programs, or similar third parties. This information may include mailing address, job title, email address, phone number, intent data, user behavior data, Internet Protocol (IP) addresses, social media profiles, social media URLs, and customer profiles, for purposes of targeted advertising.

We may combine the information we collect from or about you with information that we receive from other sources and use it in the manner described in this Privacy Policy.

How We Use Your Information

Spiffy uses the personally identifiable information that we collect for the following purposes:

The purposes for which you provided it, including, to provide you a demo, the Site or the Service, register you for an event, or provide you access to content;
To administer and provide you with information about your account, including, updated Site or Service terms or for billing and accounting purposes;
To send you information about your relationship with us;
To host events, webinars, sweepstakes, or other promotional activities;
To inform you about upcoming events or webinars or new features, products, or services;
To develop new products, features and services;
To process and respond to your inquiries or comments;
To personalize and enhance your experience using the Site and Services;
To manually review your documents for the purposes of improving the Services, including, but not limited to, the quality and completeness of your document metadata and training of our AI models;
To generate and review reports and data about our user base and service usage patterns;
To deliver targeted advertising to you;
To determine the effectiveness of our marketing and promotional campaigns;
To compile aggregated and fully anonymized data for the purposes of improving and extending the Site or Services, including, but not limited to, securing the Site and Services and increasing the accuracy of machine learning classification models;
For legal reasons, including to carry out our legal obligations and enforce our rights, investigate misuse or misconduct, protect you or other third parties, to monitor, detect and prevent fraud, malicious activity, or for other privacy or security-related concerns;
With your consent, to fulfill the purposes for which you provided the information, or in ways that we disclose to you when you provide the information; and
To administer, operate and improve the Site and Services and for internal business purposes.

How Your Information is Disclosed

Personally identifiable information may be disclosed to third parties in accordance with this Privacy Policy, and, if applicable, subject to the terms of your agreement with us if you are a Spiffy customer. You may choose not to share certain information as described in the "Your Choices Regarding Your Information" section below.

Third-Party Service Providers. We may use third-party service providers and business partners to perform functions in connection with the Site or Services. Examples include running our Services on cloud providers, using account management ticketing products, and sending you email and text notifications via messaging providers. The categories of third parties we may share personal information with are as follows:

- Ad Networks
- Cloud Computing Services
- Data Analytics Services
- Data Storage Service Providers
- Performance Monitoring Tools
- Retargeting Platforms
- Sales & Marketing Tools
- Testing Tools
- Website Hosting Service Providers‍

Business Partners. We may share your information with third-party business partners, including referral partners, resale partners, joint marketing partners, or similar kinds of business partners.‍
Third-Party Advertising, Social Media, or Analytics Services. We may use cookies, pixels, or other tracking technologies provided by third-party advertising, social media or analytics providers, including, without limitation, Google, Facebook, or LinkedIn, these third parties may use the personally identifiable information that they receive from automatic tracking technology on our Site for their own purposes. Please see the section titled “Cookies, Other Storage, and Web Beacons” below and our Cookie Policy for more information.‍
Business Changes. If we become involved in a merger, acquisition, sale of assets, bankruptcy, reorganization, dissolution, or other transaction or if the ownership of all or substantially all of our business otherwise changes, we may transfer your information to a third party or third parties in connection therewith.‍
For Legal Purposes. We reserve the right to investigate fraud, abuse, illegal activities, violation of our policies or terms and conditions, or security incidents. We may disclose information about you to third parties if we have a good-faith belief that such disclosure is reasonably necessary to:
- Take action regarding suspected illegal activities;
- Enforce or apply this Privacy Policy, our policies or terms and conditions;
- Comply with the law or guidance and cooperate with government or law enforcement officials or private parties;
- Protect our rights, reputation, safety, and property, or that of users or other third parties;
- Respond to claims and legal process (for example, subpoenas); and/or
- Protect against legal liability.

Cookies, Other Storage, and Web Beacons

We, along with our third-party service providers, third party advertising, social media, or analytics service providers, and business partners, use cookies, pixels, web beacons, and other tracking technologies on the Site and Services. These technologies are used to deliver the features and functionality of the Service and the Site, including tracking, analytics and personalization, and optimization of the Site and Services. We also use these tracking technologies on the Site for marketing purposes. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Policy: https://www.spiffy.ai/cookie-policy.

Cookies. Cookies are small bits of information that are transferred to and stored in separate files within your computer's browser. You can instruct your browser to stop accepting cookies. But if you do not accept cookies, you may not be able to use all portions or all functionality of the Site and Services.
- Persistent cookies remain on the visitor's computer after the browser has been closed.
- Session cookies exist only during a visitor's online session and disappear from the visitor's computer when they close the browser software.‍
Other Storage. Flash cookies (also known as local stored objects) are data files that can be created on your computer by the websites you visit and are a way for websites to store information for later use. Flash cookies are stored in different parts of your computer from ordinary browser cookies. You can disable the storage of flash cookies. For additional information about managing and disabling flash cookies, please visit http://helpx.adobe.com/flash-player/kb/disable-local-shared-objects-flash.html.‍
Web Beacons. Web beacons are small strings of code that provide a method for delivering a graphic image on a web page or in an email message for the purpose of transferring data. You can disable the ability of web beacons to capture information by blocking cookies.‍
Pixel Tags. We use "pixel tags," which are small graphic files that allow us and third parties to monitor the use of the Site and collect usage data. A pixel tag can collect information such as the IP address of the computer that downloaded the page on which the tag appears, the URL of the page on which the pixel tag appears, the time (and length of time) the page containing the pixel tag was viewed, the type of browser that retrieved the pixel tag, and the identification number of any cookie previously placed by that server on your computer. We use pixel tags, either provided by us or by third party advertisers, social media sites, third-party affiliate partners or ad networks, to collect information about your visit, including the pages you view, the links you click, and other actions taken in connection with our Site, and use them in combination with our cookies. Pixel tags also enable social media providers and ad networks to serve targeted advertisements to you when you visit our Site or other websites.

Security

While we have implemented security measures to protect the information we process, we cannot guarantee against loss, theft and unauthorized use, disclosure, or modification. However, no transmission over the Internet or email is ever fully secure or error-free. You should use caution whenever submitting information online and take special care in deciding what information you provide us.

Links to Other Sites

This Privacy Policy applies only to the Site and Services. The Site may contain links to third-party websites that we do not own or operate. We do not guarantee that we have endorsed or reviewed any links to third-party websites. The policies and procedures we describe here do not apply to third-party websites. We cannot control nor are we responsible for the privacy practices or content of these third-party websites. We suggest contacting these websites directly for information on their privacy policies and practices.

Your Choices Regarding Your Information

You have choices regarding the use of information on our Site and Services. You may have additional rights, as explained below, if you are a resident of the European Economic Area, Switzerland, Canada, certain U.S. states.

Changing Your Information. You may log into the Service to modify certain profile information that you have provided at any time.
Email Communications. To change your information regarding email communications, please unsubscribe from the footer of any communication or contact us at aniket@spiffy.ai.
Cookies, Other Storage, and Web Beacons. Please see the "Cookies, Other Storage, and Web Beacons" section above.
Closing Your Account. Subject to the terms of your agreement with us, you may close your Spiffy account by contacting your account administrator or contacting us at aniket@spiffy.ai. Note that even if you request to close your Spiffy account, you may still have obligations under your subscription agreement with us.
Withdrawing Consent. If we have relied on your consent to process your personal information (which may be express and/or implied consent depending on the applicable law), you have the right to withdraw your consent at any time. You can withdraw your consent at any time by contacting us at aniket@spiffy.ai.
Opting out of Marketing and Promotional Communications. You can unsubscribe from our marketing and promotional communications at any time by clicking on the unsubscribe link in the emails that we send, or by contacting us at aniket@spiffy.ai. You will then be removed from the marketing lists. However, we may still communicate with you — for example, to send you service-related messages that are necessary for the administration and use of your account, to respond to support requests, or for other non-marketing purposes.

EU Data Subject Rights

If you are a resident of Switzerland, the United Kingdom, or a country within the European Economic Area (EEA), you may have rights under European data protection laws regarding the processing of your personal information. You have the right to access the personal information that we process, and, in some cases, you may have the right to ask that your personal information be corrected, erased, or transferred (subject to limitations under applicable law). You may also have the right to object to or request that we restrict the processing of your personal information. If we collect personal information based on your consent, you have the right to revoke your consent.

If your personal information has been submitted to us by a subscriber and you wish to exercise any rights you may have under applicable data protection laws, please inquire with the applicable subscriber directly.

Residents of the United Kingdom, any country within the EEA, or Switzerland may file a complaint with a data protection authority. The data protection authority will require you to first attempt to resolve any complaint with us. Any other dispute arising out of or related to this Privacy Policy will be handled in accordance with the dispute resolution process indicated in our Website Terms or other terms of service, as applicable.

Lawful Basis. If you reside in the European Economic Area or Switzerland (collectively the "EU"), where we are the data controller we rely on the following lawful grounds under the General Data Protection Regulation, the United Kingdom General Data Protection Regulation, or the Swiss Data Protection Act (collectively referred to in this Privacy Policy as "GDPR") to process (collect, store, and use) your personal information: (a) where it is necessary for the performance of a contract with you; (b) pursuant to our or a third party’s legitimate business interest; (c) with your consent; or (d) pursuant to our vital interests. Our subscribers determine the lawful grounds for the processing of personal information submitted through their use of our Services and we limit such processing to our subscribers’ instructions.
Data Transfer Notice. We are located in the United States and transfer your personal information for processing in the United States. We make the transfer to the United States in the absence of an adequacy decision because it is necessary for the performance of a contract with you, or with your explicit consent. We also use model contractual clauses (or the then-lawful data transfer mechanism recognized under GDPR or other applicable law) with our subscribers to provide adequate protection for the transfer and processing of your personal information in the United States. We also use the model contractual clauses with our subprocessors to provide adequate protection for the transfer and processing of your personal information.
Individual Rights and Data Requests. Depending on your location, your jurisdiction, and subject to applicable law, you may have the rights below with regard to the personal information we control about you. We will respond to your requests within the appropriate timeline under applicable law:
- The right of access means that you have the right to request that we disclose what personal information we have collected, used and disclosed about you;
- The right of deletion means that you have the right to request that we delete personal information collected or maintained by us, subject to certain exceptions.
- The right to non-discrimination means that you will not receive any discriminatory treatment when you exercise one of your privacy rights;
- You can also ask us to correct or update your personal information, object to the processing of your personal information, ask us to restrict processing of your personal information or request the portability of your personal information;
- While you cannot opt out of service-related emails if you are an account holder, as this is an essential part of the Services, you have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you, or you can contact us using the contact information below;
- If our lawful basis is your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent; and
- You have the right to complain to a data protection authority about our collection and use of your personal information.‍
Exercising Your Rights. We provide features in our Services to allow our subscribers to respond directly to data subject requests to access, transfer, rectify or erase their personal information, or to restrict or object to the processing of their personal information. You may also contact us at aniket@spiffy.ai to request access to, transfer of, and rectification or erasure of your personal information, or restriction of processing, or to object to processing of your personal information, to the extent that we process such information on our own behalf. Please specify the nature of your request and the information that is the subject of your request. We may require you to submit additional information necessary to verify your identity and status as an EU data subject. If we are processing your personal information for a subscriber, we will forward your request to our subscriber and assist the subscriber in responding within 30 days. If you are a visitor to our Site, we will respond to your request directly within 30 days. If we are processing your personal information based upon the lawful ground of your consent, you have the right to withdraw your consent for such processing at any time without affecting the lawfulness of processing based on consent before it is withdrawn. To withdraw consent, please email us at aniket@spiffy.ai.‍
Retention. At a minimum and to the extent allowed under applicable law, we will retain your personal information for as long as necessary for the purpose in which it was collected, such as to deliver a Service, perform our obligations under a contract, for our or a third party's legitimate interest, or with your consent.

U.S. State Privacy Law Rights

California Resident Privacy Rights

If you are a California resident, the California Consumer Protection Act (the “CCPA”), as amended by the California Privacy Rights Act (the “CPRA”), may provide you with additional rights regarding your personal information. The rights outlined in this section do not apply to information exempted under the CCPA, including aggregated data, or to individuals who are not residents of California.

To the extent provided under the CCPA, and subject to applicable exceptions, California residents have a right to request information about our collection, use, and disclosure of their personal information. Specifically, California residents have the following rights:

The right to know the categories and specific personal information we have collected, the categories and sources from which we collected the personal information, the categories of third parties with whom we share personal information, and the business or commercial purpose for collecting or selling (if applicable) personal information;
The right to request a copy of the personal information that we collected during the past 12 months;
The right to opt out of sales of personal information or sharing personal information for cross-contextual behavioral advertising (in each case, where applicable and in accordance with the CCPA);
The right to request that we delete the personal information that we have collected from you, subject to certain exceptions;
The right to correct inaccurate personal information that we maintain about you;
The right to limit the disclosure of your sensitive personal information, if we use or disclose sensitive personal information;
The right to request information about and opt out of automated decision making (if applicable); and
The right to exercise the rights described above free from discrimination or retaliation, as prohibited by the CCPA.

California privacy laws define a "sale" as disclosing or making available to a third party, personal information in exchange for monetary or other valuable consideration, and "sharing" includes disclosing or making available personal information to a third party for purposes of cross-context behavioral advertising. We do not disclose personal information to third parties in exchange for monetary compensation. As defined by the CCPA, we may “sell” or “share”: (a) Category A “Identifiers,” (b) “Personal Information, as Defined in the California Customer Records Law,” (c) Category D “Commercial information,” (e) Category F “Internet or Other Similar Network Activity Information,” and (f) Category K “Inferences Drawn from Other Personal Information,” to or with third-party advertising networks, analytics providers, and social networks. We do not "sell" or "share" (as defined by the CCPA) sensitive personal information, nor do we "sell" or "share" any personal information about individuals who we know are under 16 years old.

California residents may request to opt-out of “sales” and “sharing” via the cookie banner on the Site.

We have collected the following categories of personal information in the past 12 months:

Category

Examples

Collected

A. Identifiers

Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name

YES

B. Personal information categories listed in the California Customer Records statute

Name, contact information, education, employment, employment history, and financial information

YES

C. Protected classification characteristics under California or federal law

Gender, date of birth, race, disability

YES

D. Commercial information

Transaction information, purchase history, financial details, and payment information

YES

E. Biometric information

Fingerprints and voiceprints

F. Internet or other similar network activity

Browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems, and advertisements

YES

G. Geolocation data

Device location (not precise geolocation)

YES

H. Audio, electronic, visual, thermal, olfactory, or similar information

Images and audio, video or call recordings created in connection with our business activities

I. Professional or employment-related information

Business contact details in order to provide you our Services at a business level or job with us

YES

J. Education Information

Student records and directory information

K. Inferences drawn from other personal information

Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual's preferences and characteristics

YES

L. Sensitive Personal Information

Social security number, government issued ID, financial account information, health, genetics, or biometric information, precise geographic location, contents of electronic messages, information about race religion, or trade union membership, or sexual orientation.

‍

We have disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months: (a) Category A “Identifiers,” (b) Category B “Personal Information, as Defined in the California Customer Records Law,” (c) Category C Protected Classification,” (d) Category D “Commercial Information,” (e) Category F “Internet or Other Electronic Network Activity Information,” (f) Category I “Professional or Employment Information,” and (g) Category K “Inferences Drawn from Other Personal Information.” Please see the section "How Your Information is Disclosed" above for more information.

Financial Incentives

Financial incentives are programs, benefits, or other offerings, including payments to consumers as compensation, paid in exchange for the disclosure, deletion, or sale of personal information about them. We do not offer financial incentives to a consumer for the disclosure, deletion, or sale of their personal information.

Exercising Your U.S. Privacy Rights

California residents may exercise their CCPA rights by contacting us by phone or email as indicated in the “Contact Us” section below. Your rights may only be exercised by you or by your designated agent. You may only submit a CCPA request to know twice within a 12-month period.

Your request must include enough information to allow us to reasonably verify that you are the person about whom we collected personal information or an authorized representative, which may include: (a) verifying your account information if you have an account with us; or (b) requesting two forms of identification that are reliable for verification purposes, unless the request includes sensitive information and, in which case, we may require three forms of verification and a signed declaration. The information included in your request must allow us to properly understand, evaluate, and respond to it.

We cannot respond to your request if we cannot verify your identity or authority to make the request and confirm that the personal information relates to you. If we cannot verify your identity or authority, we will not fulfill your request. We will only use personal information provided in the request to verify the requesteor’s identity or authority to make it.

You may submit a request through a designated agent. You must instruct that agent that they will need to (a) state that they are acting on your behalf when making the request, (b) have reasonably necessary documentation, and (c) be prepared to provide the necessary personal information to identify you in our database.

Children

We do not knowingly collect personal information from an individual under the age of 16. If you are under the age of 16, please do not submit any personal information through the Site. If you have reason to believe that we may have accidentally received personal information from an individual under the age of 16, please contact us immediately at aniket@spiffy.ai.

Data Retention

How long we retain your information depends on the type of data and the purpose for which we process the data. We will retain your information for the period necessary to fulfill the purposes outlined in this Privacy Policy and our agreement with you unless a longer retention period is required or permitted by applicable law.

Subscriber Rights

If you have purchased a subscription to a Service that is subject to and governed by a separate agreement between you and Spiffy, to the extent that there's a direct conflict between this Privacy Policy and the terms of that agreement, the terms of that agreement will control and supersede this Privacy Policy.

Changes to Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time and from time to time to ensure that it's easy to understand, aligns with our current practices and operations, and compliesy with continually evolving laws and regulations. Please review this Privacy Policy periodically, and especially before you provide any information. Your continued use of our Site and Services constitutes your agreement to this Privacy Policy and any updates to this Privacy Policy.

How to Contact Us

If you have any questions about our Privacy Policy or requests regarding your personal information, please email aniket@spiffy.ai or you may also contact us by mail at Spiffy, [ADDRESS], Attention: Legal Department.