Privacy Policy

1. Introduction

Sales Advisor ("we," "our," or "the Platform") is an AI-powered sales and growth platform. This Privacy Policy explains how we collect, use, store, and protect your information when you use our services. By accessing or using Sales Advisor, you agree to the practices described in this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address and password (passwords are hashed using bcrypt and never stored in plain text)
• First and last name, job title
• Profile picture (optional)
• Organization details including company name, address, industry, and size
• Language and timezone preferences

2.2 Lead and Contact Data

Data you enter or import about your leads, prospects, and clients, including:

• Contact information (name, email, phone numbers, LinkedIn profile URL)
• Company details (name, website, address, industry)
• Sales-related data (deal values, pipeline stages, lead scores, notes)
• Communication history (email threads, call logs, meeting notes)
• Birthdates (for optional automated birthday greetings). Birthdate collection is optional and used solely for user-configured automation features.

2.3 Usage and Activity Data

We automatically collect:

• Activity logs (actions taken within the platform for audit and analytics)
• Session information (login timestamps, IP addresses for security purposes)
• Feature usage data (to improve the platform and provide usage reports)

2.4 Payment Information

Subscription payments are processed by Stripe. We store your Stripe customer ID and subscription status but never store credit card numbers, bank account details, or other payment instrument data on our servers. All payment data is handled directly by Stripe in accordance with PCI-DSS standards.

2.5 Email Engagement Tracking

When you send emails through the platform, we may include tracking pixels to detect when recipients open emails or click links. This data is used to provide you with engagement notifications and analytics. Tracking only fires on recipient activity, not when you view your own sent emails. Users are responsible for ensuring tracking complies with recipient jurisdiction laws.

3. Lawful Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, and other jurisdictions that require a lawful basis for data processing, we rely on the following legal bases under the General Data Protection Regulation (GDPR):

• Contract Necessity (Article 6(1)(b)): Processing your account data, subscription management, and platform functionality is necessary for the performance of our contract with you.
• Legitimate Interest (Article 6(1)(f)): We process usage analytics, activity logs, security monitoring, and anomaly detection to maintain platform integrity, prevent fraud, and improve our services. We have assessed that these interests do not override your fundamental rights.
• Consent (Article 6(1)(a)): Email engagement tracking (open/click tracking pixels), optional birthday email automations, and marketing communications are based on your explicit consent. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal Obligation (Article 6(1)(c)): We may process data to comply with applicable tax, financial reporting, or regulatory requirements.

Where we act as a data processor on your behalf (see Section 6), the lawful basis for processing your customers' data is your responsibility as the data controller.

4. Bring Your Own Credentials (BYOC) Model

Sales Advisor uses a "Bring Your Own Credentials" model for third-party service integrations. This means:

• You provide your own API keys and OAuth tokens for services like Gmail, Outlook, Slack, Microsoft Teams, Discord, WhatsApp Business, Zoom, Webex, Google Calendar, Calendly, Chili Piper, Twilio, OpenAI, Anthropic, Google AI, xAI, Gong, Chorus.ai, Recall.ai, Salesforce, HubSpot, Zoho, Pipedrive, Monday.com, Apollo.io, ZoomInfo, Clearbit, Google Maps, LinkedIn Sales Navigator, Outreach, DocuSign, PandaDoc, Tableau, Power BI, Typeform, JotForm, Okta, Microsoft Entra ID, Google Workspace SSO, OneLogin, Jobber, QuickBooks Online, Antera, SalesRabbit, and others.
• All credentials are encrypted using AES-256-GCM encryption before storage.
• We use your credentials solely to perform actions you request within the platform.
• We never share your API keys or OAuth tokens with any other users or third parties.
• You remain responsible for managing and revoking your own credentials with each respective service provider.

5. AI Processing and Data Usage

Our platform uses artificial intelligence for various features:

• AI Sales Coach: Your questions and the AI responses are stored as chat messages within your account. Conversations are processed using your connected OpenAI API key.
• Sentiment Analysis: Inbound lead responses may be analyzed for sentiment using AI to help you prioritize follow-ups.
• Content Generation: AI-generated sales scripts, case studies, battlecards, and other materials are created on-demand and stored within your account.
• Voice Calling: AI-powered calls use OpenAI Realtime API and Twilio through your own connected credentials. Call transcripts and analysis are stored in your account.
• Lead Scoring and Predictions: AI models analyze your deal and lead data to provide scores, forecasts, and recommendations.

AI processing is performed using your own API keys. We do not use your data to train AI models. Data sent to AI providers is governed by those providers' respective privacy policies and terms of service.

5.1 AI Limitations and Disclaimer

• AI-generated outputs (including sales scripts, lead scores, deal predictions, coaching advice, and content) may contain inaccuracies, hallucinations, or errors. Sales Advisor does not guarantee the accuracy, completeness, or reliability of any AI-generated content.
• No AI output constitutes professional, legal, financial, or medical advice. You are solely responsible for reviewing, verifying, and approving all AI-generated content before use.
• Sales Advisor is not liable for any business decisions, losses, or damages resulting from reliance on AI-generated content, automated lead scoring, deal predictions, or sentiment analysis.
• AI model behavior is determined by third-party providers (e.g., OpenAI). Sales Advisor does not control model outputs, training data, or model updates made by these providers.

6. Data Controller and Processor Roles

Sales Advisor operates in a dual capacity depending on the type of data:

• Data Controller: Sales Advisor acts as the data controller for account registration data, billing information, usage analytics, and platform operational data.
• Data Processor: Sales Advisor acts as a data processor on behalf of you (the data controller) for all CRM data you input, including leads, contacts, deals, communications, and any personal data of your customers or prospects. We process this data solely on your instructions and for the purpose of providing the Platform's services.

As a data processor, Sales Advisor commits to:

• Processing your customers' personal data only as instructed by you and as necessary to provide the Platform's services.
• Implementing appropriate technical and organizational security measures (as described in Section 8).
• Not sub-processing data without your knowledge (see Section 9 for our subprocessor list).
• Assisting you in responding to data subject access requests from your customers.
• Deleting or returning all personal data upon termination of your account, subject to legal retention requirements.
• Making available information necessary to demonstrate compliance with data processing obligations.

Enterprise customers requiring a formal Data Processing Agreement (DPA) may request one by contacting info@salesadvisor.ca.

7. Data Isolation and Multi-Tenancy

The platform employs strict organization-based data isolation:

• All data (leads, deals, tasks, messages, etc.) is scoped to your organization.
• Users within the same organization can access shared data based on their assigned role (admin, manager, or rep).
• No data is shared between different organizations.
• Single active session enforcement prevents unauthorized access from multiple devices simultaneously.

8. Data Security

We implement multiple layers of security to protect your data:

• Encryption: AES-256-GCM for stored credentials, bcrypt for passwords, HTTPS for all data in transit.
• Security Headers: Comprehensive HTTP security headers including Content Security Policy, HSTS, and XSS protection.
• Rate Limiting: Database-backed rate limiting to prevent abuse and brute-force attacks.
• Input Validation: Server-side validation on all inputs to prevent injection attacks.
• Image Sanitization: Uploaded images are re-processed to strip potential malicious payloads.
• Anomaly Detection: Automated detection of path traversal, SQL injection, XSS attempts, and known scanning tools.
• Session Security: Sessions stored in the database with automatic expiration after 8 hours of inactivity.

8.1 Breach Notification

In the event of a confirmed personal data breach that poses a risk to your rights and freedoms, Sales Advisor will:

• Notify affected customers within 72 hours of becoming aware of the breach, in compliance with GDPR Article 33.
• Provide details of the nature of the breach, categories and approximate number of records affected, likely consequences, and measures taken or proposed to mitigate the breach.
• Cooperate with your own notification obligations to data subjects and supervisory authorities.

9. Third-Party Services and Subprocessors

The platform integrates with third-party services. When you connect these services, data may be shared with them as necessary to provide the requested functionality:

• Stripe (San Francisco, USA) — Payment processing and subscription management.
• OpenAI (San Francisco, USA) — AI chat, content generation, sentiment analysis, voice calling (Realtime API), and AI receptionist features.
• Twilio (San Francisco, USA) — Voice calling, SMS messaging, and media streams for AI-powered calls.
• Google / Gmail (Mountain View, USA) — Email sending, inbox syncing, and calendar integration via OAuth.
• Microsoft / Outlook (Redmond, USA) — Email, calendar, and Teams video conferencing via OAuth.
• Salesforce (San Francisco, USA) — Bi-directional lead and deal synchronization.
• HubSpot (Cambridge, USA) — Bi-directional lead and deal synchronization.
• Zoho (Chennai, India / Austin, USA) — CRM data synchronization.
• Pipedrive (Tallinn, Estonia) — CRM data synchronization.
• Apollo.io (San Francisco, USA) — Lead enrichment, person search, and contact discovery.
• Google Maps Places API (Mountain View, USA) — Lead search, business discovery, and address-based enrichment.
• Zoom (San Jose, USA) — Meeting scheduling and video conferencing.
• Gong (San Francisco, USA) — Call transcription, recording analysis, and coaching insights.
• Chorus.ai (San Francisco, USA) — Call transcription and conversation intelligence.
• LinkedIn Sales Navigator (Sunnyvale, USA) — Lead enrichment and prospect research.
• DocuSign (San Francisco, USA) — Document tracking and e-signature integration.
• PandaDoc (San Francisco, USA) — Document tracking and e-signature integration.
• Jobber (Edmonton, Canada) — Operational workflow integration.
• QuickBooks Online / Intuit (Mountain View, USA) — Financial data integration.
• Antera (USA) — Business management integration.
• SalesRabbit (Provo, USA) — Field sales management integration.
• WhatsApp / Meta (Menlo Park, USA) — Messaging integration via wa.me links.
• Pinecone (San Francisco, USA) — Vector database for AI agent shared memory and context retrieval.
• Calendly (Atlanta, USA) — Demo booking and meeting scheduling.
• Neon (San Francisco, USA) — Serverless PostgreSQL database hosting.
• Anthropic (San Francisco, USA) — AI model provider for chat and content generation features.
• Google AI (Mountain View, USA) — AI model provider for chat and content generation features.
• xAI (San Francisco, USA) — AI model provider for chat and content generation features.
• Monday.com (Tel Aviv, Israel / New York, USA) — CRM and project management data synchronization.
• Slack (San Francisco, USA) — Team notifications and sales activity alerts.
• Discord (San Francisco, USA) — Team notifications and communication.
• Webex (San Jose, USA) — Virtual meeting hosting and video conferencing.
• Google Calendar (Mountain View, USA) — Meeting scheduling and calendar synchronization.
• Chili Piper (New York, USA) — Automated meeting scheduling and lead routing.
• Outreach (Seattle, USA) — Sales engagement sequences and analytics.
• ZoomInfo (Vancouver, WA, USA) — B2B contact and company data enrichment.
• Clearbit (San Francisco, USA) — Lead data enrichment and firmographics.
• Tableau (Seattle, USA) — Sales data visualization and performance analytics.
• Power BI / Microsoft (Redmond, USA) — Interactive dashboards and reporting.
• Recall.ai (San Francisco, USA) — AI meeting bots for call coaching and transcription.
• Typeform (Barcelona, Spain) — Lead capture through interactive forms.
• JotForm (San Francisco, USA) — Lead information collection through custom forms.
• Okta (San Francisco, USA) — Enterprise SSO and identity management.
• Microsoft Entra ID (Redmond, USA) — Azure Active Directory SSO for enterprise environments.
• Google Workspace SSO (Mountain View, USA) — Single sign-on for Google Workspace enterprise teams.
• OneLogin (San Francisco, USA) — Unified access management and enterprise SSO.

Each third-party service is governed by its own privacy policy. We encourage you to review those policies. Data is only shared with services you have explicitly connected. We will notify customers of any new subprocessors at least 30 days before engagement, providing an opportunity to object.

10. International Data Transfers

The Platform is operated from Canada and uses subprocessors located primarily in the United States and other countries (see Section 9). When your data is transferred outside your jurisdiction:

• Transfers from the EEA/UK to the United States rely on the EU-U.S. Data Privacy Framework, Standard Contractual Clauses (SCCs), or other approved transfer mechanisms as applicable.
• Transfers from Canada are governed by PIPEDA and applicable provincial legislation.
• We ensure all subprocessors maintain appropriate safeguards equivalent to those required in the originating jurisdiction.
• By using the Platform, you acknowledge that your data may be processed in Canada, the United States, and other jurisdictions where our subprocessors operate.

11. Cookies and Sessions

We use session cookies to maintain your authenticated state. These are essential cookies required for the platform to function. We do not use advertising or third-party tracking cookies. Session data is stored server-side in our database, and only a session identifier is stored in your browser cookie.

12. Data Retention

We apply the following retention periods:

• Account and CRM data: Retained for the duration of your active account. Upon account termination, you may request a data export within 30 days. All account data is permanently deleted within 90 days of termination unless a legal hold applies.
• Session data: Automatically purged after 8 hours of inactivity. Expired sessions are cleaned up by automated processes.
• Activity and audit logs: Retained for 12 months from the date of creation, then automatically purged.
• Security and anomaly logs: Retained for 6 months for incident investigation purposes.
• Backup data: Database backups are retained for 30 days and then permanently deleted.
• AI-generated content: Stored within your account for the duration of your active subscription and subject to the same deletion timeline upon termination.
• Payment records: Transaction records and invoicing data are retained for 7 years to comply with tax and financial reporting obligations.

Deletion requests are processed within 30 days. To request early deletion, contact info@salesadvisor.ca.

13. Children and Age Restrictions

The Platform is designed for business use only and is not intended for personal consumer use or for individuals under the age of 18. We do not knowingly collect personal data from children or minors. If we become aware that we have inadvertently collected data from a person under 18, we will promptly delete such data. If you believe a minor has provided us with personal information, please contact us at info@salesadvisor.ca.

14. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (right to erasure)
• Export your data in a portable format (data portability)
• Object to or restrict certain processing activities
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority in your jurisdiction

GDPR (EEA/UK): You may exercise these rights by contacting our designated point of contact at info@salesadvisor.ca. We will respond within 30 days.

CCPA (California): California residents have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. We do not sell personal information.

PIPEDA (Canada): Canadian residents may access, correct, or challenge the accuracy of their personal information held by us.

15. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of the Province of Ontario, Canada, and the federal laws of Canada applicable therein, without regard to conflict of law principles. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of the courts of Ontario, Canada.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform or via email at least 30 days before they take effect. Continued use of the platform after changes constitutes acceptance of the updated policy.

17. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at info@salesadvisor.ca