Privacy Policy

Last updated: November 4, 2026

This Privacy Policy explains how Ferrata Labs handles personal information when you visit our website, use the Ferrata Labs platform, call us or receive our emails, and how we act on behalf of the businesses that use our platform. It is organized so that you can find what applies to you.

Summary

  • Our customers' data belongs to them. When a business uses Ferrata Labs, the data in its workspace is its own. We process it only on that business's instructions, as its service provider, and we do not sell or share it.
  • We do not sell personal information or use it for cross-context behavioral advertising, and we do not use advertising pixels.
  • AI models are chosen by our customers. Data sent to a third-party model is handled under that provider's terms. Any training of a customer's agents uses that customer's data only for that customer.
  • You control optional tracking. Turn it off at any time in Cookie settings, and we honor Global Privacy Control.
  • You have rights to know, correct and delete your personal information, among others, as described in Section 13.

Contents

  1. Introduction and Scope
  2. Definitions
  3. Information We Collect
  4. How We Use Information
  5. Cookies and Similar Technologies
  6. Calls with Ferrata Labs
  7. Email and Communications
  8. Customer Data and Our Role as Service Provider
  9. AI Models, Agents and Training
  10. Connected Systems
  11. How We Disclose Information
  12. Retention and Deletion
  13. Your Privacy Rights
  14. Global Privacy Control and Do Not Track
  15. Security
  16. Children
  17. Geographic Scope
  18. Changes to This Privacy Policy
  19. Contact Us

1. Introduction and Scope

1.1 Who We Are. Ferrata Labs, Inc., a Florida corporation ("Ferrata Labs," "we," "us" or "our"), provides an AI agent platform that businesses use to run operational work on their own data and systems.

1.2 What This Policy Covers. This Privacy Policy applies to personal information that Ferrata Labs collects and handles for its own purposes in connection with:
(a) our website at ferratalabs.ai, our blog and any other website we operate that links to this Privacy Policy (the "Site");
(b) the Ferrata Labs platform and the products, features, Agents, integrations and APIs that we make available (the "Services");
(c) telephone calls made to Ferrata Labs; and
(d) emails and other communications that Ferrata Labs sends on its own behalf.

1.3 What This Policy Does Not Cover. This Privacy Policy does not govern Customer Data: the information that our business customers load into, connect to or generate through the Services, including the communications that a Customer's Agents send or receive in the Customer's name. We process Customer Data on our Customers' behalf, as described in Section 8, and the relevant Customer's own privacy notice applies to it. This Privacy Policy also does not cover third-party websites or services that the Site or the Services link to or connect with.

1.4 Business Context. The Site and the Services are intended for businesses. Much of the personal information we handle relates to people acting in a professional capacity, such as employees of our Customers and prospects.

2. Definitions

In this Privacy Policy:

2.1 "Agent" means an AI agent, assistant or automation within the Services that a Customer configures to perform tasks on its behalf, such as drafting, summarizing, scoring, recommending, sending messages, placing or receiving calls, or updating records.

2.2 "Authorized User" means an individual whom a Customer permits to access the Services under its account.

2.3 "Connected Systems" means the enterprise resource planning, accounting, billing, customer relationship management, communications and other systems that a Customer designates and authorizes us to connect to the Services.

2.4 "Customer" means a business or other organization that holds an account and workspace in the Services (a "Tenant") under an agreement with Ferrata Labs.

2.5 "Customer Data" means all data, information and content in or generated through a Customer's Tenant, including data from Connected Systems, records, documents, communications, Agent activity and AI-generated output.

2.6 "Personal information" means information that identifies, relates to, describes or is reasonably capable of being associated with a particular individual or household, and includes "personal data" and similar terms as defined by applicable law.

2.7 "Usage Data" means technical, usage and performance data about the operation of the Site and the Services, as described in Section 8.4.

2.8 "Sell," "share" and "service provider" have the meanings given in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA"). "Targeted advertising," "profiling" and "processor" have the meanings given under other applicable US state privacy laws.

3. Information We Collect

3.1 Contact and Inquiry Information. When you complete a form, request a discovery call, apply to our partner program, email us or call us, we collect your name, email address, phone number, company, job title and the content of your message, along with any other information you choose to provide.

3.2 Account Information. When you create or are invited to an account, we collect your name, work email address, company, role and permissions, sign-in credentials (passwords are stored only in hashed form), settings, and records of the terms you accept. A Customer may provide some of this information when it invites you.

3.3 Call Information. When you call Ferrata Labs, we collect your phone number, call audio, transcripts, call notes and summaries, and the details you share, as described in Section 6.

3.4 Analytics Information. Unless you turn it off, we collect information about how you use the Site and the Services: pages viewed, clicks, referring page, browser and device type, a pseudonymous device identifier stored in a cookie or local storage, approximate location derived from your IP address (such as city, region and country) and timestamps. This includes session replays, with anything you type hidden.

3.5 Marketing Information. Unless you turn it off, on ferratalabs.ai we collect the pages you visit, which may be linked to your contact record if you later submit a form or give us your email address.

3.6 Cookie Settings. We remember your cookie choices so that we can honor them.

3.7 Usage and Security Information. Our servers and hosting providers collect IP addresses, browser details, request data, sign-in events, API requests, and the actions taken in the Services, which we use for security, troubleshooting, audit and the purposes described in Section 8.4.

3.8 Information from Customers and Connected Systems. Customers provide account details for the people they invite, and load or connect Customer Data as described in Sections 8 and 10.

3.9 Sensitive Personal Information. We do not seek to collect sensitive personal information, such as Social Security numbers, financial account credentials, health information or precise geolocation, and ask that you not send it to us.

4. How We Use Information

4.1 Purposes. We use the personal information described in Section 3 to:
(a) respond to inquiries and calls, follow up and schedule meetings;
(b) provide, operate, maintain and support the Site and the Services;
(c) create and administer accounts, authenticate users and manage permissions;
(d) analyze how the Site and the Services are used and improve them;
(e) send service, account, security and billing communications and, where permitted, information about our services;
(f) keep accurate business, billing and audit records;
(g) detect, prevent and respond to security incidents, fraud, abuse and violations of our terms;
(h) honor your privacy choices and requests;
(i) comply with legal obligations and establish, exercise or defend legal claims; and
(j) for any other purpose disclosed to you at the time of collection, with your consent where required.

4.2 Customer Data. We use Customer Data only as described in Section 8.

5. Cookies and Similar Technologies

5.1 Our Approach. We use cookies and similar technologies on the Site and our product sites. Some optional tracking starts when you arrive. You can turn it off at any time in Cookie settings, linked in the footer of every page, and we treat a Global Privacy Control signal as an opt-out. Your choice applies across ferratalabs.ai and our product sites on the same browser. Our Cookie Policy lists each category and its purpose.

5.2 Categories.
(a) Essential (always on): first-party cookies that keep the Site and the Services working, keep you signed in, protect against misuse and remember your settings.
(b) Performance and analytics (on unless you turn it off): a site analytics provider and a tag management service measure how the Site and the Services are used, including session replays with anything you type hidden.
(c) Marketing (on unless you turn it off): on ferratalabs.ai, a marketing and customer relationship management provider recognizes returning visitors and supports our follow-up on inquiries.

5.3 No Advertising Pixels. We do not use advertising pixels, and we do not sell personal information or share it for cross-context behavioral advertising.

5.4 Contact Forms. Our contact forms work whether or not optional tracking is on.

6. Calls with Ferrata Labs

6.1 Scope. This Section applies to calls made to Ferrata Labs. Calls that a Customer's Agents place or receive are made in the Customer's name and are governed by Section 8.

6.2 AI Assistant and Recording Notice. When you call Ferrata Labs, you speak with an AI assistant, and the call is recorded. The first words you hear are: "Hi, thanks for calling Ferrata Labs. I'm Carina, an AI assistant, and this call is recorded."

6.3 Transcripts, Notes and Records. Call recordings are transcribed, and we may create notes and summaries from them. We may match your phone number to records we already hold, and we save call details to our customer relationship management system, creating a contact and company record where none exists.

6.4 How We Use Call Information. We use recordings, transcripts and notes to respond to you, follow up (for example, by email), schedule meetings, keep accurate records and improve our service.

6.5 Who Processes Call Information. Our telephony and AI providers process call audio on our behalf as service providers, and our customer relationship management provider stores call details.

7. Email and Communications

7.1 Email. If you contact or call us, we email you to respond and follow up. We may also email business contacts about our services. Each such email identifies Ferrata Labs as the sender, may include our mailing address, and provides a simple means to unsubscribe, which we honor promptly.

7.2 Service Communications. Account, security, billing and service emails that are necessary to operate an account cannot be turned off while the account is active.

7.3 Email Engagement. Emails we send on our own behalf may contain a small image that tells us whether the email was opened. Some email services load images automatically, so an open may not mean that a person read the message.

7.4 Requests Not to Be Contacted. If you ask us not to call or email you, whether on a call, by replying to any of our emails or by contacting us as described in Section 19, we keep a record of your request so that we continue to honor it.

8. Customer Data and Our Role as Service Provider

8.1 Our Role. For Customer Data, we act as a service provider and processor to the Customer. The Customer owns and controls its Customer Data, including all records, communications, Agent activity and AI-generated output in its Tenant, and Ferrata Labs claims no ownership of it. We process Customer Data only on the Customer's behalf and documented instructions, under our agreement with the Customer.

8.2 No Sale or Secondary Use. We do not sell or share Customer Data, and we do not use it for our own marketing or for any purpose other than providing, securing and supporting the Services for the Customer.

8.3 Agent Communications. A Customer's Agents may contact, or be contacted by, the Customer's own customers, vendors and prospects by phone, text message, email or other channels. Those communications are made in the Customer's name and at its direction. The Customer is responsible for the notices and consents they require, and its privacy notice applies to them.

8.4 Usage Data. We collect technical, usage and performance data about the operation of the Services, and may use that data, and aggregated, de-identified data derived from use of the Services, to operate, secure, analyze usage of and improve the Services. This data does not identify any Customer or individual. We maintain it in de-identified form, do not attempt to re-identify it and contractually require any recipient not to re-identify it, as the CCPA requires.

8.5 Demonstrations. Demonstrations, sample screens and solution examples use fictitious data, not real customer data.

8.6 Requests About Customer Data. If your information was provided to us by one of our Customers, or you were contacted by one of our Customers' Agents, please direct privacy requests to that Customer. If you contact us instead, we will refer your request to the Customer and assist it as our agreement requires.

9. AI Models, Agents and Training

9.1 Model Selection. The Services are model agnostic. Customers choose the AI models used by each Agent and function, from the frontier and open-weight models we make available. Depending on that choice, Customer Data processed by an Agent may be sent to the third-party provider of that model, or processed by an open-weight model run by us or our hosting providers, including within the Customer's own environment where agreed.

9.2 Model Providers. When a Customer's Agents use a third-party model, the Customer Data processed by that model is sent to the model's provider and handled under that provider's terms. Open-weight models may be run by us or our hosting providers, including within a Customer's own environment where agreed.

9.3 Agent Training and Learning. Customers decide whether and how their Agents learn from their operations, including through feedback, evaluations, tuning and reinforcement learning. Any such training uses a Customer's data only for that Customer's own Agents and Tenant, and what is learned is not made available to any other customer.

9.4 Customer Direction. Customers configure, direct and approve what their Agents do, including who they contact, through which channels, what they say and which actions require a person's approval. Customers are responsible for that use, including any notices, disclosures and consents it requires.

9.5 Accuracy. AI output can be inaccurate or incomplete. Customers review AI output before relying on it, and Agent activity is recorded in the Customer's Tenant so that it can be reviewed and audited.

10. Connected Systems

10.1 Connected Systems. When a Customer authorizes us, we connect to the Connected Systems it designates and pull only the data to which it gives us access, in order to provide the Services. That data is Customer Data. It remains the Customer's, and the Customer can revoke our access at any time. The Customer is responsible for having the rights, consents and notices required to give us that access. Individuals whose information is held in a Customer's systems should direct questions to that Customer.

11. How We Disclose Information

11.1 No Sale. We do not sell personal information or share it for cross-context behavioral advertising or targeted advertising.

11.2 Recipients. We disclose personal information only to the following categories of recipients:
(a) service providers and subprocessors that act on our behalf under contracts restricting their use of the information, including hosting and infrastructure, analytics, customer relationship management, email delivery, telephony and AI model providers;
(b) Customers, with respect to their own Customer Data and the activity of their Authorized Users;
(c) professional advisors, such as lawyers and accountants, under duties of confidentiality;
(d) authorities and other parties, where required by law or legal process, or where necessary to protect the rights, property or safety of Ferrata Labs, our users or others; and
(e) a successor, in connection with a merger, acquisition, financing, reorganization or sale of assets, which must continue to protect the information as described in this Privacy Policy.

11.3 Subprocessors. Customers may request our current list of subprocessors under their agreement with us.

12. Retention and Deletion

12.1 Our Own Records. We keep contact, call and inquiry information, including recordings, transcripts and notes, for as long as we need it to serve customers and prospects, follow up, keep accurate business records and establish or defend legal claims.

12.2 Account Information. We keep account information for as long as the account is active, and afterward for as long as needed for billing, audit, security and legal purposes.

12.3 Analytics Data. Analytics data is kept for as long as it remains useful for understanding use of the Site and the Services.

12.4 Customer Data. We keep Customer Data for as long as the Customer's account is active. Before an account closes, the Customer can export its Customer Data. Once the account is closed, we delete its Customer Data, and backup copies are removed in the normal backup cycle within 7 days. Usage Data and de-identified aggregate data described in Section 8.4 are not Customer Data.

12.5 Requests and Legal Holds. When you make a valid request under applicable law, we delete your information unless we need to keep it for one of the purposes described in this Section or applicable law requires us to keep it.

13. Your Privacy Rights

13.1 Notice at Collection. We collect the following categories of personal information, as described in the CCPA, from the sources described in Section 3, for the purposes described in Section 4. We disclose each for business purposes to the recipients described in Section 11 and retain it as described in Section 12. We do not sell or share any category.

Category Examples
Identifiers Name, email address, phone number, IP address, device or cookie identifier, account identifier
Customer records information Name, phone number and company details provided through forms, calls or accounts
Commercial information Records of services inquired about, purchased or used
Internet or other electronic network activity Pages viewed, clicks, referring page, browser and device type, session replays, API and security logs
Approximate geolocation City, region or country derived from IP address (not precise geolocation)
Audio and electronic information Recordings and transcripts of calls with Ferrata Labs
Professional or employment-related information Company, job role and work email address

13.2 Right to Know and Access. You may request that we tell you what personal information we have collected about you, the categories of sources, the purposes for collecting it and the categories of recipients, and that we provide a copy of it in a portable format.

13.3 Right to Correct. You may request that we correct personal information about you that is inaccurate.

13.4 Right to Delete. You may request that we delete personal information we collected from you, subject to the exceptions that applicable law allows, such as completing a transaction, security, legal compliance and defending claims.

13.5 Right to Opt Out. You may opt out of the sale or sharing of personal information, targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in these activities, and we honor Global Privacy Control as an opt-out regardless.

13.6 Sensitive Personal Information. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use under the CCPA.

13.7 Non-Discrimination. We will not discriminate against you for exercising any of these rights.

13.8 Where These Rights Apply. These rights are available to residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and other states whose laws provide them, as those laws provide.

13.9 How to Make a Request. To exercise your rights, contact us as described in Section 19. For requests about a call, please include your phone number and the approximate date and time of the call.

13.10 Authorized Agents. You may designate an authorized agent to make a request on your behalf. We may require proof of the agent's authority and may ask you to verify your identity directly with us.

13.11 Verification and Response. We verify requests in proportion to the sensitivity of the information involved, which may require matching information you provide with information we hold. We will respond to a verified request within 45 days, or within the period that applicable law requires. Our response may decline the request, in whole or in part, where an exception under applicable law applies or where the information is Customer Data, and will explain why.

13.12 Limits and Appeals. We may retain records needed to show what you agreed to, to honor an opt-out, to meet a legal obligation or to defend legal claims, and if we do, we will tell you what we retained and why. If we decline your request, you may appeal by replying to our decision. If you are not satisfied with the outcome of your appeal, you may contact your state attorney general.

13.13 Requests About Customer Data. Where we process your personal information as a service provider or processor to a Customer, we will refer your request to that Customer, or assist the Customer in responding, as described in Section 8.6.

14. Global Privacy Control and Do Not Track

If your browser sends a Global Privacy Control signal, we treat it as an opt-out of Performance and analytics and Marketing tracking and as a request to opt out of any sale or sharing of personal information, and the page displays: "Your browser sent a privacy signal, so we turned off optional tracking." We treat Do Not Track signals the same way.

15. Security

15.1 Safeguards. We maintain administrative, technical and organizational safeguards designed to protect personal information and Customer Data.

15.2 Your Part. You are responsible for keeping your sign-in credentials and any API credentials confidential, and for telling us promptly if you suspect unauthorized access.

15.3 Incidents. No system is perfectly secure, and we cannot guarantee the security of information. If a security incident affects your personal information, we will notify you as applicable law requires.

16. Children

The Site and the Services are intended for businesses and are not directed to individuals under 16 years of age. We do not knowingly collect their personal information. If you believe we have, please contact us and we will delete it.

17. Geographic Scope

Ferrata Labs is based in the United States, stores data in the United States and offers the Site and the Services to businesses in the United States. They are not directed to individuals in the European Economic Area, the United Kingdom or Switzerland. If you access them from outside the United States, your information is transferred to and processed in the United States.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with its last updated date. For material changes, we will provide notice on the Site or in the Services before the changes take effect and, where required, ask users of the Services to accept the updated version.

19. Contact Us

Ferrata Labs, Inc.
Privacy requests, general inquiries and support: hello@ferratalabs.ai