Rampa Privacy Policy

1. Our role: who controls your data

Rampa's data-protection role depends on the type of data.

• Conversation data (audio, transcripts, and information derived from captured conversations). For this data, the Business Customer that deploys Rampa is the data controller (or the equivalent "business" under applicable law), and Rampa acts as a data processor (or "service provider") that processes the data only on the Business Customer's documented instructions and under a written agreement. If you are a customer whose conversation was captured, or a frontline user asking about how captured conversations are used, the Business Customer's own privacy notice governs those decisions, and requests are generally directed to them. See Section 11 (Your Rights).
• Account, device, and app-usage data. For information we need to operate, secure, and support the App itself (such as account credentials, device identifiers, and diagnostic logs), Rampa acts as a controller.

Where this Policy and a Business Customer's own privacy notice both apply, the Business Customer's notice governs their decisions about conversation data, and this Policy governs how Rampa handles data as described here.

2. Who this Policy covers

This Policy applies to two groups:

• App users (frontline teams). People who sign in to and use the App under a Business Customer account.
• Customers and other individuals whose conversations are captured. People who speak with a frontline user during an interaction where the App is used.

3. Information we collect

3.1 Information you provide

• Account and profile information: name, work email address, organization, role or team, and authentication credentials, as provisioned by your Business Customer.
• Support communications: information you provide when you contact us for help.

3.2 Conversation information (the core of the Service)

When a frontline user starts a session, the App captures:

• Audio recordings of the in-person interaction.
• The consent disclosure and the response to it, recorded at the start of the session as part of the record.
• Transcripts generated from the audio.
• Derived field intelligence: information extracted by our AI, such as customer intent, objections raised, product and competitor mentions, sentiment, unmet needs, and other signals defined per use case.
• Session metadata: date, time, duration, the user who captured the session, and, where enabled by the Business Customer, coarse location or store or site identifiers.

Audio may include the voices of the frontline user and of the customer(s) participating in the conversation. Depending on the jurisdiction, voice may be treated as sensitive or biometric personal information. See Section 5.

3.3 Information collected automatically

• Device and technical data: device model, operating system version, app version, language, time zone, and unique device or installation identifiers.
• Diagnostic and usage data: crash reports, performance logs, and feature-usage events used to operate and improve the App.

We do not use third-party advertising SDKs, and we do not track you across other companies' apps or websites for advertising purposes.

4. How we use information

We use information to:

• Provide the App and the Services, including capturing sessions, generating transcripts, and producing field intelligence for the Business Customer.
• Record and preserve consent disclosures as part of each session.
• Authenticate users, secure accounts, and prevent fraud or misuse.
• Provide support and respond to requests.
• Maintain, troubleshoot, and improve the App and our models and Services, subject to the limits in Section 6 and our agreement with the Business Customer.
• Comply with legal obligations and enforce our terms.

Conversation data is processed on behalf of, and under the instructions of, the Business Customer. We do not sell personal information, and we do not use conversation data for our own independent marketing.

5. Voice and sensitive or biometric data

Capturing conversations means we process voice recordings. Some laws treat voice as sensitive personal information or as biometric data (for example, the EU and UK GDPR, and certain US state laws).

• We process this data to deliver the Services described above and to record consent.
• Rampa is consent-first by design. The App is built so that a frontline user makes a clear, brief disclosure at the start of each interaction, and the customer's response is captured as part of the session record.
• Where explicit consent is the legal basis, we and the Business Customer rely on the consent captured at the start of the session.
• We apply the retention limits in Section 8 and the security measures in Section 9 to this data.

Consent settings and disclosure behavior may be configured by the Business Customer to meet the requirements of their jurisdiction and use case. The Business Customer is responsible for determining the lawful basis for capture in the locations where it operates.

6. Use of data to improve the Services and AI models

We may use technical, diagnostic, and usage data to maintain and improve the App.

We use conversation data to provide the Services to the applicable Business Customer. We do not use one Business Customer's conversation data to build or improve products for other customers except where the data has been aggregated or de-identified so that it no longer identifies any individual, and only where permitted by our agreement with the Business Customer and by applicable law. A Business Customer may further restrict this by contract.

We do not permit our AI subprocessors to use conversation data to train their own foundation models on terms that would expose that data to other customers. See Section 7.

7. How we share information

We share information only as described here:

• With your Business Customer. Conversation data and derived field intelligence are made available to the Business Customer that deployed Rampa, and to the users and administrators it authorizes.
• With service providers and subprocessors. We use vetted third parties to host data, transcribe and analyze audio, and operate the Services (for example, cloud hosting, speech-to-text, and AI processing providers). They act on our instructions under contracts that restrict their use of the data to providing services to us. A current list of subprocessors is available on request.
• For integrations you or your Business Customer enable. Where the Business Customer connects Rampa to its own tools (such as a CRM, business-intelligence, or analytics platform), we share the relevant data with those tools at the Business Customer's direction.
• For legal and safety reasons. When required by law, legal process, or government request, or to protect the rights, safety, and property of Rampa, our users, or others.
• In a business transfer. In connection with a merger, acquisition, financing, or sale of assets, subject to the protections of this Policy.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law.

8. Data retention

We retain personal information for as long as needed to provide the Services and for the periods directed by the Business Customer under our agreement, and then delete or de-identify it.

• Conversation data is retained according to the Business Customer's configured retention settings and contractual instructions. When a Business Customer's agreement ends, we delete or return conversation data as provided in that agreement.
• Account and app data is retained for the life of the account and for a reasonable period afterward as needed for security, legal, and record-keeping purposes.

You can request deletion as described in Section 11. Where Rampa acts as a processor, we route deletion of conversation data through the Business Customer that controls it.

9. Security

We use administrative, technical, and organizational measures designed to protect personal information, including encryption of data in transit and at rest, access controls, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International data transfers

Rampa operates globally and is headquartered in the United States. Your information may be processed in countries other than the one in which you live, including countries whose data-protection laws differ from yours. Where we transfer personal data internationally, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses or another lawful transfer mechanism, where required.

11. Your rights and choices

Depending on where you live and your relationship to the data, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, to object to processing, and to withdraw consent. Residents of the EEA, the UK, California, Argentina, and other jurisdictions may have specific rights under the GDPR, the CCPA/CPRA, Argentina's Personal Data Protection Law, and comparable laws.

How to exercise rights:

• If you are a customer whose conversation was captured, or you are asking about specific conversation data: the Business Customer controls that data. Please contact the organization whose representative you spoke with, or contact us at contact@getrampa.com and we will route your request to the responsible Business Customer.
• If you are an App user asking about your account data, or for any other request: contact us at contact@getrampa.com.

We will respond within the timeframes required by applicable law. We do not discriminate against you for exercising your rights. You also have the right to lodge a complaint with your local data-protection authority.

Withdrawing consent. Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal. For a captured conversation, withdrawal is handled by the Business Customer as controller.

12. Children

The App is a workplace tool intended for use by adults in a professional capacity. It is not directed to children, and we do not knowingly collect personal information from children. If you believe a child's information has been provided to us, contact us at contact@getrampa.com.

13. Third-party services and links

The App may connect to third-party services at the direction of the Business Customer. Those services are governed by their own privacy policies. We are not responsible for the privacy practices of third parties.

14. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date and, where required, provide additional notice. Your continued use of the App after an update means you accept the revised Policy.

15. Contact us

If you have questions about this Policy or our privacy practices, contact:

Rampa Technologies LLC
131 Continental Dr Ste 305
Newark, DE 19713-4324, US
Email: contact@getrampa.com
Data protection contact: Santiago Botta