Legal

Privacy Policy

Effective Date: August 10, 2026 · Supersedes the version dated March 1, 2026

Sambia LLC ("Sambia," "we," "us," or "our") provides the Sambia platform at sambia.io (the "Service"). This Privacy Policy explains how we handle personal information — and, just as importantly, which data we handle for our own purposes and which we handle only on behalf of our customers.

1. The Two Roles We Play

Sambia processes information in two distinct roles:

As a business (controller) — for information about visitors to our website, prospects who request a demo, and the account, billing, and usage information of the people who administer and use Sambia. Sections 2, 4–11 describe this processing.
As a service provider (processor) — for Customer Data: the content our business customers and their users put into their Sambia workspace, such as goals, metrics, meeting notes, documents, org charts, survey responses, and check-ins. Section 3 describes this processing.

2. Information We Collect for Our Own Purposes

Account and Billing Information

When an account is created we collect name, email address, company name, and billing information. Payments are processed by our payment processor; we do not store full card numbers.

Demo and Contact Requests

If you request a demo, we collect the name, email address, and company you provide.

Usage Data

We automatically collect information about how the Service and our website are used: pages visited, features used, timestamps, browser type, operating system, IP address, and similar log and device information. Usage Data does not include the content of Customer Data.

Cookies and Similar Technologies

Described in Section 8.

3. Customer Data — Processed on Our Customers' Behalf

Customer Data belongs to the customer organization that controls the workspace. Our customer — typically your employer, if you use Sambia at work — decides what is collected in its workspace, who can access it, and how long it is kept. Workspace administrators can view, manage, export, and delete workspace content, which may include content you contribute such as survey responses, check-ins, goals, and comments.

We process Customer Data only to provide, secure, and support the Service as described in our Terms of Service and any Data Processing Addendum, and on our customer's instructions. We do not use Customer Data content for marketing, do not sell it, and do not use it to train machine-learning models.

If you are an employee or member of an organization using Sambia and want to access, correct, or delete information in that organization's workspace, please contact that organization. We will support our customers in responding to such requests; where a request comes to us directly, we will route it to the responsible customer.

4. How We Use Information (Our Own Purposes)

Provide, operate, and maintain the Service and our website
Process transactions and manage subscriptions
Send service communications (account, billing, security, support)
Understand usage patterns to improve the Service, using Usage Data — not the content of Customer Data
Detect, prevent, and address security issues and abuse
Send product updates and marketing to business contacts; every marketing email includes an unsubscribe link, and we honor opt-outs promptly. Where applicable law requires consent, we obtain it.

5. When We Share Information

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising (as those terms are defined under California law). We disclose personal information only:

To service providers that help us operate — hosting and infrastructure, identity and authentication, payment processing, CRM and email, analytics, and survey infrastructure — under contracts limiting their use of the information to providing services to us. A current list of our service providers is available on request at support@sambia.io.
For legal reasons — when required by law, subpoena, or legal process, or to protect the rights, safety, and security of Sambia, our users, or the public. Where lawful and practicable, we will notify the affected customer before disclosing Customer Data.
In a business transfer — in connection with a merger, acquisition, or sale of assets, in which case this policy will continue to apply or affected users will be notified of material changes.

6. Categories Disclosure

For the categories of personal information we collect as a business, the sources, purposes, and recipients are as described in Sections 2, 4, and 5: identifiers and business contact information (from you), commercial information such as subscription records (from you and our payment processor), and internet activity information (collected automatically). We collect no sensitive personal information for our own purposes, and we do not use or disclose personal information for purposes incompatible with those stated.

7. Retention, Deletion, and Security

Retention. We retain account and billing information for as long as the account is active and thereafter as needed for legal, tax, and accounting purposes. We retain Usage Data only as long as needed for the purposes described in this policy. Customer Data is retained according to the customer's use of the Service and the deletion schedule in our Terms of Service: following account termination and the 30-day export window, Customer Data is deleted from production systems within 30 days and from backups in the ordinary course of backup rotation.

Deletion requests. If you delete your account, we will delete the personal information we hold as a business within 30 days, except where retention is legally required. Data export or deletion requests may be submitted to support@sambia.io. Aggregated or de-identified data that does not identify you may be retained.

Security. We maintain reasonable administrative, technical, and organizational safeguards, including encryption in transit (TLS) and at rest. Our infrastructure is hosted on Microsoft Azure in the United States. No method of transmission or storage is completely secure; we continuously review our practices. If a breach of security affects your personal information, we will notify affected parties and regulators as required by applicable law, without undue delay.

8. Cookies and Analytics

Essential cookies — required for the Service to function (session management, authentication). These cannot be disabled.
Analytics — we use product analytics to understand how our website and Service are used. Analytics is optional: you can accept or decline it in the cookie notice shown on your first visit, and change your choice at any time via the Cookie Preferences link in the site footer. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a decision to decline analytics automatically.

We do not use advertising or tracking cookies, and we do not disclose personal information to third parties for their own advertising. Because we do not sell or share personal information, there is no sale/share to opt out of; we treat browsers signaling Global Privacy Control accordingly, and our practices do not vary in response to Do Not Track signals beyond what is described here.

9. Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, or obtain a portable copy of your personal information, and to non-discrimination for exercising those rights. To exercise them, email legal@sambia.io for privacy rights requests, or support@sambia.io for data export or deletion requests. We will verify your request using the email associated with your information (and reasonable additional verification where needed), respond within the time required by applicable law (generally 45 days), and explain any denial, which you may appeal by replying to our response. Authorized agents may submit requests with proof of authorization. Note that for Customer Data, requests are routed to the customer that controls the workspace (Section 3).

You may opt out of marketing at any time via the unsubscribe link in any marketing email.

10. International Visitors and Transfers

We are based in the United States, and information we collect is stored and processed in the United States. If you access the Service from outside the U.S., your information will be transferred to the U.S. For personal data subject to the GDPR or UK GDPR, we process it under the legal bases of contract performance, legitimate interests (service operation, security, improvement), consent where required, and legal obligation. Standard Contractual Clauses are available through our Data Processing Addendum on request.

11. Children's Privacy

Sambia is a business platform and is not directed at children under the age of 16. We do not knowingly collect personal information from children. If we learn that we have collected data from a child under 16, we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. For material changes, we will notify you by email or a prominent notice on our website, and we will notify workspace administrators of material changes to how Customer Data is handled. Prior versions are available on request. The current effective date is shown above.

13. Contact

legal@sambia.io
support@sambia.io

Sambia LLC