개인정보 처리방침

Who we are

Sam is made by Limen (PTY) Ltd. ("Limen", "we", "us", "our"), a company registered in South Africa. This policy explains what information we collect when you use Sam (our website, web app, mobile apps and Telegram bot, together the "Service"), why we collect it, who helps us process it, and the choices you have.

Limen is the responsible party (under POPIA) and the controller (under the GDPR) for your personal information. You can reach us, including our information officer, at hello@usesam.co.

Sam is for adults. You must be at least 18 to use it.

What we collect

Your account

Your name, email address and profile picture, which you give us when you sign up (directly, or through a sign-in provider such as Google), and the sign-in sessions on your devices.

What you put into Sam

Everything you create or share with Sam so it can help you: chats with Sam, notes, tasks, plans, spaces, files and images you upload, voice notes and their transcripts, and what you tell Sam about yourself, such as your goals and how you like to work.

What Sam works out from it

To be useful, Sam connects what you've shared into a picture of your life: the people, places, projects and topics that come up, how they relate, and summaries of meetings and conversations. This lives in your account, is used only to help you, and is deleted with your account.

Your calendar, if you connect it

If you connect Google Calendar or Microsoft Outlook, Sam reads your calendars and events (titles, times, places, descriptions, attendees and meeting links) so it can see your week, prepare you for meetings and plan around what's already there. Sam asks for read-only access: it can't change, add or delete events in your calendar. The access tokens are encrypted before we store them. You can disconnect a calendar at any time in Settings, and Sam stops reading it.

Telegram, if you link it

If you link Telegram, we store your Telegram chat ID so Sam can talk with you there. Messages and voice notes you send Sam on Telegram are handled like any other chat with Sam.

Notifications

If you allow notifications on your phone, we store a push token for that device so Sam can reach you, along with your notification settings (such as quiet hours).

Payments

If you buy a plan, our payment partner handles the payment. We receive your plan, its status, renewal dates and a customer reference. We never see or store your full card number.

How the Service is used

Which features are used, when, on what kind of device and browser, and errors and performance. We also record how much of Sam's allowance each request uses, so we can meter plans fairly. In production, the content of your messages and Sam's replies is not included in this analytics data.

How we use it

• To provide Sam: to answer you, remember what matters, prepare you for what's coming and follow through on your plans.
• To keep your account secure and the Service working, and to prevent abuse.
• To understand how Sam is used, so we can improve it.
• To meter allowances and manage your plan and payments.
• To contact you about your account, and with updates you can opt out of.
• To meet our legal obligations.

We do not sell your personal information, use it for advertising, or use your content to train AI models.

AI and your content

Sam uses large language models to think with you. Requests to these models go through OpenRouter to model providers such as Anthropic, OpenAI and Google, with zero data retention: the providers process your request to produce Sam's answer, and don't store it or train on it.

Voice notes are transcribed with OpenAI's speech-to-text API. OpenAI does not train on data sent through its API.

Who helps us run Sam

We share personal information only with the service providers we need to run Sam, only for that purpose, and under agreements that require them to protect it.

Provider	What they do for Sam
Clerk	Sign-in and account security
Convex	Our database and backend, where your Sam data is stored
Vercel	Hosting for our website and web app
OpenRouter, and the model providers it routes to (such as Anthropic, OpenAI and Google)	The AI models Sam thinks with, with zero data retention
OpenAI	Transcribing voice notes
Gladia	Live transcription, when you record something for Sam as you speak
Exa	Web search, when Sam looks something up for you (only the search query is sent)
UploadThing	Storing files and images you upload
PostHog	Product analytics and usage metering (without message content)
Resend	Sending emails, such as invitations when you share something
Loops	Emails about your account (getting started, your plan) and, if you say yes, what's new in Sam. It receives your name, email, language and facts about your account, never what you write
Expo, Google Firebase and Apple	Delivering push notifications to your phone
Telegram	Carrying messages between you and Sam, if you link Telegram
Google and Microsoft	Your calendar, if you connect it
Dodo Payments	Payments, as our merchant of record

We may also disclose information if the law requires it, to protect the rights and safety of our users or others, or as part of a merger or sale of our business (in which case this policy continues to apply to your information).

Google user data

Sam's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data from your Google account (your calendar):

• is used only to provide and improve the features you see in Sam, such as your week, meeting preparation and planning around your calendar;
• is not used to train generalised AI or machine learning models;
• is not sold, and is not used for advertising, credit-worthiness or lending;
• is not transferred to others except as needed to provide Sam's features (such as sending relevant events to an AI model, with zero data retention, when you ask Sam about your week), to comply with the law, or as part of a merger or sale with notice to you;
• is not read by people, unless you ask us to for support, it's needed for security or to investigate abuse, or the law requires it.

Sharing inside Sam

Your notes, plans and chats are private by default. When you share a note, task, plan or space with someone, they can see what you shared and Sam can use it when helping them with it. You can stop sharing at any time.

Cookies

Our website counts visits with PostHog. Until you choose, it does that without storing anything on your device. If you say yes to cookies, PostHog sets a cookie on usesam.co, which the Sam app shares, so we can see which links and campaigns bring people to Sam and whether they go on to use it. If you say no, nothing is stored. You can change your choice any time with Cookie settings at the bottom of every page. We never use cookies for advertising.

The Sam app uses cookies and similar storage it needs to work, such as keeping you signed in (Clerk), and PostHog analytics cookies to understand how the app is used.

Security

Information is encrypted in transit (TLS) and at rest. Calendar access tokens are additionally encrypted with AES-256-GCM before they're stored. Access to production systems is limited to the people who need it. No system is perfectly secure, but we work hard to protect your information and will tell you and the regulator promptly if a breach affects you, as the law requires.

How long we keep it

We keep your information while you have an account. When you delete your account in Settings, we delete your content, what Sam has learned about you, your connections and your files from our systems, cancel any subscription, and remove you from anything shared with you. Copies in backups and logs are removed as those age out. We keep a minimal record that an account was deleted, and payment records as tax and accounting law requires.

Where it's processed

We're based in South Africa, and our providers process information in other countries, including the United States and the European Union. When information leaves South Africa, we make sure it's protected by law, binding agreements or your consent, as POPIA and the GDPR require.

Your rights

Depending on where you live (including under South Africa's POPIA, the EU and UK GDPR, and South Korea's PIPA), you can:

• see the personal information we hold about you, and get a copy of it;
• correct it if it's wrong;
• delete it, which you can do yourself by deleting your account in Settings;
• object to or restrict some uses of it, and withdraw consent you've given, for example by disconnecting your calendar or Telegram;
• take it with you in a portable format.

To use any of these rights, email hello@usesam.co. We'll answer within 30 days, and won't charge you unless a request is clearly excessive.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to a regulator: in South Africa, the Information Regulator; in South Korea, the Personal Information Protection Commission; in the EU or UK, your local data protection authority.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change is significant, we'll tell you in Sam or by email before it takes effect.

Contact

Questions about this policy or your information: hello@usesam.co.