Privacy Policy

1. Who we are and what this policy covers

Cognivo Labs LLC ("Cognivo Labs," "we," "us," or "our"), based in Virginia, United States, operates SayOk.ai. This policy explains how we handle personal information through our website, Android and iOS apps, AI phone agents, marketplace, and related services (the "Service"). It also applies to information about people contacted through the Service, even if they do not have an account.

SayOk lets users type text for an AI voice to speak, translate live conversations, and create, run, publish, and copy reusable phone agents. Our User Agreement governs use of the Service. This policy is a privacy notice; reading it or using the Service does not replace consent when the law requires a separate choice.

For privacy questions or requests, contact Cognivo Labs LLC at info@sayok.ai.

2. Information we collect and its sources

We receive information from you, your device, people who participate in calls, app stores, authentication and communications providers, and your use of the Service. Depending on the features you use, this includes:

• Account information: name, email address, phone number, username, account identifiers, sign-in credentials or authentication-provider identifiers, verification status, and preferences.
• Contacts and call details: contact information you allow the app to access, numbers you enter or select, caller and recipient information, call identifiers, connection status, duration, timestamps, language choices, and routing metadata. You can enter a number without granting contacts permission.
• Call content: microphone and telephone audio, recordings, typed messages, transcripts, translations, synthesized speech, prompts, conversation context, AI responses, summaries, evidence, confirmation details, and follow-up steps.
• Agent and marketplace content: agent names, objectives, instructions, constraints, success criteria, custom-field labels and values, categories, publication choices, creator display names, copies, usage counts, verification signals, and shared call-outcome receipts.
• Device and usage information: IP address, device/app and advertising identifiers, operating system, app version, language, timezone, interactions, referral information, crash reports, and performance and security logs. An IP address can indicate approximate location.
• Purchases: store and transaction identifiers, receipts or purchase tokens, subscription status, entitlement and minute balances, and purchase/refund events. Apple and Google handle store checkout; we do not receive full payment-card numbers from it.
• Support: messages, attachments, feedback, and information you provide when contacting us or making a privacy request.

Public agent content and information supplied by another caller may include information about you. You can contact us about that information without creating an account.

3. How we use information

• Authenticate users, verify phone numbers, maintain accounts, and remember preferences.
• Connect calls; generate speech; transcribe and translate conversations; run agents; and provide call history, summaries, and outcomes.
• Publish content you choose to share and operate agent discovery, copying, verification, referral, and usage features.
• Validate purchases, manage subscriptions and calling minutes, and handle billing support.
• Diagnose failures, evaluate output quality, and improve Service reliability and safety.
• Measure app usage and advertising performance and support advertising personalization as described in Section 7.
• Respond to support and privacy requests; send verification and essential account messages; prevent fraud, spam, and misuse; enforce our agreement; and meet legal obligations.

Where European or UK data-protection law applies, our legal bases depend on the purpose: performance of a contract for requested account, call, and purchase features; legitimate interests in security, fraud prevention, support, and Service reliability, balanced against your rights; consent where required for optional tracking or other processing; and compliance with legal obligations. Device permission alone does not replace any additional legal basis needed for sensitive information or another participant's information.

4. Calls, recordings, and other participants

Calls through SayOk may be recorded, transcribed, translated, and processed by AI. Audio and text can be sent to communications, speech, AI, and hosting providers as needed to operate these features. Processing can occur even when you type instead of using your own microphone, because the recipient's speech is still part of the call. Microphone permission does not control telephone-network recording or transcription.

Before calling, you must have the authority and any legally required permission to contact the recipient and to share their information. Requirements for placing an AI-voice call and for recording or transcribing a conversation are separate and can depend on both participants' locations. An announcement after connection does not replace prior permission when prior permission is required. Do not assume SayOk automatically obtains every participant's consent or plays a notice on every call. Do not place or continue a call if required permission is missing or withdrawn.

If you receive a SayOk-assisted call, the user who initiated it may receive the transcript, summary, and outcome. You can ask that caller to stop and contact info@sayok.ai about personal information processed by SayOk. We may need limited call details to locate the relevant records.

5. Marketplace and public sharing

Publishing an agent makes its public content available to other users. Public web previews can be opened without an account and can show the agent's name, creator display name, category, objective excerpt, required-field labels, sample flow, verification status, and usage counts. Other users can copy a public agent and customize their copy.

Public previews show required-field labels rather than the private values entered before a call. However, personal information you put directly into an agent's name, objective, instructions, or other published content can become public. Review that content before publishing; do not put passwords, private account details, or another person's confidential information into a public template.

When you choose to share an outcome receipt, its public page can include the call summary, outcome, supporting details, confirmation information, and next steps. Automated redaction cannot identify every sensitive detail. Review what you share and only share information you are entitled to disclose.

Public links can be forwarded, indexed, cached, or captured by others. Making an agent private or removing a public link does not necessarily remove copies other users already saved or copies held outside SayOk. Contact us to request removal of information we control.

6. AI providers and other disclosures

Depending on the feature and language, our integrations include:

• Amazon Web Services: hosting, authentication, storage, and AI processing through Amazon Bedrock, including Claude models.
• Twilio and telecom carriers: phone connections, call routing, audio, recording, and communications metadata.
• Deepgram and Google speech services: speech recognition and transcription.
• ElevenLabs: speech synthesis.
• Google Firebase: app analytics, diagnostics, crash reporting, and app notifications.
• Meta/Facebook App Events: app-event measurement, attribution, and advertising features described below.
• Apple and Google: app distribution, sign-in where selected, and in-app purchases and subscriptions.

Providers receive information relevant to their function; for example, speech and AI providers can receive call audio, text, prompts, context, and generated outputs. Processing happens on remote systems, not solely on your device. Provider retention and any model-improvement use depend on the particular service, applicable contract, and account settings; this policy does not promise that all providers offer zero retention or exclude every form of model improvement. Contact us before submitting sensitive information if you need details about a particular integration.

Authorized personnel and providers may access information as needed for support, troubleshooting, security, and quality evaluation. We may also disclose information to a recipient you direct us to contact, to other people when you choose to share content, to professional advisers, or when reasonably necessary to comply with law, respond to lawful requests, prevent abuse, or protect rights and safety. Information may be transferred as part of a merger, acquisition, financing, or sale of assets, subject to applicable privacy law.

Providers acting on our behalf process information under their applicable service agreements. App stores, carriers, and organizations you call may also process information for their own purposes under their own notices. Their independent practices do not remove our responsibilities for information we process.

7. Analytics, advertising, and privacy choices

Our mobile apps include Firebase analytics and Meta/Facebook App Events. Depending on device settings, app configuration, and permissions, these integrations may receive app interactions, device/app or advertising identifiers, and related diagnostics to measure use, attribute installs or purchases, measure advertising, and support personalized advertising. On iOS, advertiser tracking is controlled through Apple's App Tracking Transparency permission.

We do not sell personal information for money. Disclosures of identifiers and app events for advertising may qualify as "sharing," "sale," or "targeted advertising" under some privacy laws, even without a monetary payment. The absence of a cash sale does not remove any applicable opt-out right.

• iOS: manage SayOk's tracking permission in Settings > Privacy & Security > Tracking.
• Android: manage advertising privacy and advertising-ID settings through your device's privacy settings. Available controls vary by Android version.
• Privacy requests: email info@sayok.ai with the subject "Privacy opt-out request" to request an applicable opt-out of sale, sharing, or targeted advertising. Device controls may not cover every use, so contact us if you want to exercise a statutory right.
• Device permissions: change microphone, contacts, and notification permissions in device settings. Turning off a permission can limit the related feature.
• Messages: use an unsubscribe link in promotional email, if any. Essential account, verification, security, and purchase messages may still be sent.

The website loads fonts and icons from external hosts, which can receive your IP address and browser request information. A browser privacy preference applies to that browser and does not automatically change a separate mobile app's permissions. Contact us about legally recognized opt-out preference signals and other privacy choices.

8. Sensitive information

Calls about appointments, billing, or account support can reveal health, financial, or other sensitive information. Share only the minimum needed for an authorized task. Do not provide passwords, one-time authentication codes, full payment-card details, government identification numbers, or information you are not authorized to disclose in prompts, public agents, or shared receipts.

SayOk is a general-purpose communications service, not a medical, legal, or financial adviser. It is not offered as a HIPAA-compliant service or a system for handling protected health information on behalf of a healthcare organization. Do not use it for a workflow requiring a business associate agreement or other special contractual safeguards unless we have separately agreed to provide them. Other privacy laws can still protect health and sensitive information.

9. How long we retain information

We retain identifiable information only for as long as needed for the purposes described in this policy or to meet applicable legal requirements. Retention depends on the type of record, why it is needed, your choices, and legal requirements. There is not a single automatic deletion period for every recording, transcript, or provider.

• Account, agent, and call records: retained to maintain your account, saved agents, call history, and related features, and to handle deletion requests.
• Audio, transcripts, and AI inputs/outputs: retention depends on the call feature, storage and provider configuration, and needs such as history, support, and troubleshooting. Ending a call does not itself delete these records.
• Diagnostics and security records: retained according to their usefulness for investigating failures, preventing abuse, and meeting security or legal obligations.
• Purchase and dispute records: may be retained after account closure to meet accounting, tax, fraud-prevention, dispute, or other legal requirements.
• Backups and public copies: backup removal can follow a separate cycle; copies other people saved or published outside SayOk are not necessarily under our control.

We assess retention using these purposes, the sensitivity and amount of information, applicable limitation periods, and whether deletion or de-identification is appropriate. Contact us for information about a particular record or to request deletion. If an exception applies, we will explain it as required by law.

10. Account and associated-data deletion

You can use Settings > Delete Account in the app to remove your sign-in account. To request deletion of associated Service data as well, email info@sayok.ai with the subject "Account Deletion Request." You can make this request without access to the app, including after removing your sign-in account.

Provide the email address or phone number used with SayOk and tell us you want your account and associated personal information deleted. We may ask for information reasonably necessary to verify account ownership. Do not send your password, payment-card details, or identity documents unless we specifically explain why an additional verification method is needed.

Your request can cover account/profile records, private agents and field values, stored call content and outcomes, public receipts we control, and information held by providers on our behalf. Removing a sign-in account does not establish that every associated record has already been erased from all systems. We will assess and respond to your request within the deadlines applicable to your location and explain any lawful extension or retention exception.

Some information may need to be retained for legal compliance, accounting, fraud prevention, security, or claims. Deletion may not remove copies independently saved by other people or records a carrier, app store, or called organization is legally entitled to retain. See Section 9.

Cancel any subscription separately through Apple or Google. Uninstalling SayOk or deleting an account does not cancel store billing. Deletion can permanently remove access to saved content and balances; contact us first about outstanding purchases or a refund request.

11. Your privacy rights

Depending on where you live and which laws apply, you may have rights to know or access the information we hold, obtain a portable copy, correct it, request deletion, restrict or object to processing, withdraw consent, opt out of sale/sharing or targeted advertising, limit certain uses of sensitive information, and receive equal treatment when exercising these rights.

Send requests to info@sayok.ai. Describe the right you want to exercise and provide enough information to locate your records. We may verify your identity or an authorized agent's authority proportionately to the request. We respond within applicable legal deadlines and explain a denial or exception. Where applicable, you can appeal a decision by replying with the subject "Privacy request appeal" and seek review by your state regulator.

California: categories described in Section 2 include identifiers, customer records, commercial information, internet/app activity, approximate geolocation, audio and electronic content, and inferences such as call outcomes or preferences. Content you submit can also include sensitive personal information. Sections 2, 3, 5, 6, 7, and 9 describe sources, purposes, recipients, advertising disclosures, and retention criteria. Applicable rights can include requests concerning the preceding 12 months and longer where required by law. Use Section 7 to request an opt-out.

EEA, UK, and Switzerland: where applicable, Cognivo Labs LLC is the controller of information processed for the purposes in this policy. You may also lodge a complaint with your local data-protection authority. Withdrawing consent does not affect processing that was lawful before withdrawal. AI-generated summaries and outcomes assist communications; they are not intended to determine your legal rights or eligibility for essential services.

12. International processing and security

We are based in the United States. We and our providers may process information in the United States and other countries whose laws differ from those where you live. Contact info@sayok.ai for information about the locations and transfer safeguards applicable to a particular feature, including contractual safeguards where required. Your use of the Service does not waive legal protections for international transfers.

We use safeguards designed to protect personal information, including access restrictions and security controls appropriate to the systems involved. Telephone calls and AI processing are not end-to-end encrypted between participants: providers must process content to deliver these features. No storage or transmission method is completely secure.

13. Adults only

SayOk is intended for people aged 18 or older. We do not knowingly permit minors to create accounts. If you believe a minor has provided personal information, contact info@sayok.ai so we can investigate and take appropriate action. Adults should avoid including children's personal information in calls, agents, or receipts unless it is necessary for a lawful task and they have the required authority.

14. Changes and contact

We may update this policy as features or practices change. We will update the date above and provide additional notice or seek consent when required by law. An update does not itself authorize a new use that legally requires your consent.

Privacy questions, deletion requests, and concerns about another person's information can be sent to Cognivo Labs LLC at info@sayok.ai. You can also use our account-deletion page.