Privacy Policy

The short version

We use your information to run Sanma for your business, and for nothing else.
Each business's data is kept separate, and we never sell personal information.
Conversations are processed by trusted AI and phone providers only to answer your customers.
Call recording is off unless a business turns it on, and recordings are removed after the business's retention period.
If you chat with the assistant on our own website, we keep that conversation for 90 days and our team may read it to improve Sanma.

Who we are

Sanma is a service operated by Charviam ("Charviam", "we", "us"). Sanma gives businesses an AI agent that answers their customers on website chat, phone calls, and text messages.

This policy explains what information we collect, how we use it, and the choices you have. It covers two groups of people:

Businesses and their team members who create a Sanma workspace or book a demo ("customers").
People who talk to a business's agent by chat, phone, or text ("end users").
Visitors to our website who talk to Sanma's own assistant (see Our website assistant).

For information in a business's workspace, including its conversations with end users, we act as a service provider to that business. The business decides how its agent is used and is responsible for its own privacy notice to its customers. If you are an end user, the business you contacted is the best first place to send privacy requests, and we will help them respond.

Information we collect

Account and business information. Your name, work email, password (stored only in hashed form), business name, team members, and settings.

Content you add. Knowledge sources such as website pages, FAQs, documents, notes, your catalog and prices, and the instructions you give your agent.

Conversation information. When end users talk to an agent we process what they say and send: chat messages, text messages, call audio converted to text, transcripts, phone numbers, and any details they share, such as a name, address, or order. Call recordings are stored only if the business turns recording on.

Demo requests. The name, business, email, phone number, and preferences you enter in the Book a demo form.

Billing information. Card payments are handled by Stripe. We receive limited details such as the card brand, last four digits, and billing status. We never see or store full card numbers.

Usage and device information. Usage counts (call minutes, chat messages, text segments), log data such as IP address, browser type, pages requested, and timestamps, used to run, secure, and bill the service.

Cookies and local storage. We use essential cookies and browser storage to keep you signed in and remember your preferences. We do not use advertising cookies or sell browsing data.

How we use information

To provide Sanma: building your agent from your knowledge, answering end users, handing conversations to your team, and showing them in your inbox.
To process orders and requests that end users make with a business, such as reading back an order and its total.
To measure usage, bill you, and show your usage in your dashboard.
To keep Sanma secure: preventing fraud, spam, and misuse, and enforcing limits.
To support you, answer questions, arrange demos, and send service messages such as security alerts and billing notices.
To improve reliability and fix problems, using usage and error data.
To comply with the law and enforce our Terms of Service.

We do not use one business's data to answer another business's customers.

How AI processing works

To generate replies, Sanma sends the relevant parts of a conversation, together with the business's approved knowledge, to the AI model provider the business has selected: OpenAI, Anthropic, or Google. Voice calls may also use ElevenLabs to produce speech.

These providers process the information to return a response on our behalf. We use their business API services, and we do not provide conversation content to them for the purpose of training their models. We do not use end users' conversations to train models of our own.

Our website assistant

Our website has its own Sanma assistant: the chat and the voice demo on our Try page, the chat bubble on our pages, and our demo phone line. For these conversations Sanma is the business you are talking to, not a service provider to someone else.

What we keep. What you type or say to the assistant, as text, and its replies, with the time and whether you used the chat, the voice demo, the chat bubble, or the phone line. In the voice demo your browser turns your speech into text (some browsers, such as Chrome, do this on their maker's servers). Only the text reaches us: we never record your voice. Calls to our demo line are converted to text and are not recorded. A conversation carries your name or contact details only if you share them, and we do not store your IP address with it. Replies are generated as described in How AI processing works.

Why we keep it. Members of the Sanma team may read these conversations to improve the assistant's answers, to understand what visitors want to know about Sanma, and to get back to you when you ask us to or leave your details.

How long. We delete these conversations, and everything shared in them, 90 days after they start. Visits where nothing was said are deleted after one day.

Your choices. Please don't share sensitive information, such as health, financial, or account details, in these chats. To have a conversation deleted sooner, email [email protected] with roughly when it happened and what it was about.

Text messages

Businesses use Sanma to send and answer text messages with their customers. Mobile numbers and text messaging consent are never shared with third parties or affiliates for their marketing or promotional purposes.

End users can reply STOP at any time to stop receiving texts from a business, START to opt back in, and HELP for help. Opt-outs are recorded and enforced automatically. Message and data rates may apply.

Call recordings

Call recording is off by default. A business can turn it on and choose the consent message callers hear before the call continues. When recording is on, recordings are linked to the conversation in the business's workspace.

Each business sets a retention period for recordings, which is 90 days unless the business changes it. After that period, recordings are removed from the workspace automatically.

How long we keep information

We keep account information, workspace content, and conversation history for as long as the business's account is active, so the business can review past conversations and orders. Recordings follow the retention period described above. Conversations with our own website assistant are deleted after 90 days, as described in Our website assistant.

A business can delete content from its workspace, or ask us to delete its workspace, at any time. After an account is closed we delete or anonymize its data within a reasonable period, except where we must keep certain records, such as billing records, to meet legal, tax, or accounting obligations.

How we protect information

Every request in Sanma is scoped to the business it belongs to, so one business cannot see another's conversations, customers, catalog, or prices. Data is sent over encrypted connections (HTTPS), passwords are hashed, and access to production systems is limited to people who need it. You can read more on our Security and trust page.

No system is perfectly secure. If we learn of a security incident that affects your information, we will notify you as required by law.

Your choices and rights

Depending on where you live, including under the Texas Data Privacy and Security Act, the California Consumer Privacy Act, and similar laws, you may have the right to:

Know what personal information we hold about you and get a copy of it.
Correct information that is inaccurate.
Delete your information.
Opt out of the sale of personal information or targeted advertising. We do neither.
Appeal a decision we make about your request.

Business customers can update most information directly in their workspace. For any other request, email [email protected]. We will verify your request and respond within 45 days. If you are an end user, we may refer your request to the business you contacted, since it controls that information. We will not discriminate against you for exercising your rights.

Children

Sanma is a service for businesses and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us information, contact us and we will delete it.

Where information is processed

Sanma is operated from the United States. Information may be processed in the United States and in other countries where our service providers operate, with protections required by applicable law.

Changes to this policy

We may update this policy as Sanma changes. We will post the new version on this page and update the date at the top. If a change is significant, we will also notify business customers by email or in the app before it takes effect.

Contact us

Questions or requests about privacy: [email protected].

Charviam, operator of Sanma, Texas, United States.

Your privacy, in plain words