Privacy Policy

1. Introduction

This Privacy Policy explains how Slick AI Technologies, Inc. ("Slick AI") and our affiliate, Incredible Pods Technologies Ltd ("Incredible Pods"), (collectively "Slick", "we", "us", or "our") collect, use, disclose, and protect personal data when you use our websites, applications, WhatsApp/Instagram integrations, and enterprise platform (collectively, the "Services").

We are committed to protecting your privacy and ensuring transparency about our data practices. This Privacy Policy applies to all users of our Services, including:

• Individual Users who use Slick for personal productivity through our Free, Plus, or Pro plans
• Team Users who are members of organizations using Slick Teams for internal collaboration
• Business customers who contract with us ("Customers")
• Employees and authorized users of our Customers ("Users")
• End consumers who interact with our Customers through Slick ("End Users")
• Visitors to our websites and marketing materials ("Visitors")

2. Data Controller Information

2.1 Primary Entities

• For US/Global (except ME/Asia): Slick AI Technologies, Inc., a Delaware corporation, 1111B S Governors Ave STE 34221, Dover, DE 19904, United States
• For ME/Asia: Incredible Pods Technologies Ltd, Unit 02, Level 7, Gate Village Building 10, Dubai International Financial Centre, Dubai, UAE

2.2 Controller vs Processor Roles

We act in different capacities depending on the data processing activity:

• As Controller for Individual and Team Users: For personal data of Individual and Team users, we act as the data controller
• As Processor: For Customer Content (conversations, files, workflow data), we process strictly under Customer instructions per our Data Processing Agreement (DPA)
• As Independent Controller: For security, fraud prevention, diagnostics, billing, and product analytics that don't rely on Customer Content for model training

2.3 Contact Information

3. Data We Collect

3.1 Account & Business Information

• Organization details (company name, size, industry) - for Business and Teams customers
• User account information (name, email, phone, role, title)
• Authentication credentials and security settings
• Billing information (subscription tier, token usage, payment details via processors)
• Subscription tier (Free/Plus/Pro for Individual; Plus/Pro/Enterprise for Teams; Starter/Business/Enterprise/Enterprise Max for Business)

3.2 Customer Content (Processed as Processor)

• Conversation data across channels (WhatsApp, Instagram, web, SMS, email)
• Voice recordings and transcriptions
• Images and media files
• Slickflow configurations and business logic
• API integrations and webhook data
• Files and documents uploaded to the platform

3.3 Usage & Technical Data

• Service interaction logs and analytics
• Device and browser information
• IP addresses and approximate location
• Performance metrics and error reports
• Feature usage patterns
• Slick Token (ST) usage and consumption patterns
• Proactive Activation settings and triggers
• Multi-Agent Mode orchestration data
• Session recordings (enterprise customers only, with notice)

3.4 Cookies & Similar Technologies

See our Cookie Policy for detailed information about cookies, tracking technologies, and your choices.

4. How We Collect Data

4.1 Direct Collection

• When you register for an account or subscribe to Services
• When you communicate with us for support or sales
• When you participate in surveys or provide feedback

4.2 Automatic Collection

• Through your use of the Services
• Via cookies and similar tracking technologies
• Through integrated third-party services

4.3 From Third Parties

• From your organization (if you're a User or Team Member)
• From integrated platforms (WhatsApp, Meta, etc.)
• From service providers acting on our behalf
• From public sources for business intelligence

5. How We Use Your Data

5.1 Service Delivery & Operations

• Provide, maintain, and improve the Services across Individual, Teams, and Business products
• Execute Slickflows and process conversations
• Enable cross-channel communication
• Process Slick Token consumption and manage usage limits
• Enable Proactive Activation features and Multi-Agent Mode orchestration
• Provide customer support and technical assistance
• Process transactions and manage billing

5.2 Security & Compliance

• Detect, prevent, and address fraud and abuse
• Monitor and ensure platform security
• Comply with legal obligations
• Respond to legal requests and prevent harm
• Enforce our terms and policies

5.3 Communication

• Send service-related notices and updates
• Respond to inquiries and requests
• Provide technical alerts and security notifications
• Send marketing communications (with consent where required)

5.4 Analytics & Improvement

• Analyze usage patterns and trends
• Develop new features and services
• Conduct research and development
• Create aggregated and anonymized insights
• Important: We do NOT use Customer Content or Individual/Team conversation data for AI model training unless explicitly opted-in

6. Legal Bases for Processing

6.1 Under GDPR/UK GDPR

We process personal data based on:

• Contract Performance: To provide Services to Customers, Individual Users, and Teams
• Legitimate Interests: For security, fraud prevention, and service improvements
• Consent: For marketing communications and non-essential cookies
• Legal Obligations: To comply with applicable laws
• Vital Interests: In rare cases involving safety

6.2 Under Other Frameworks

• CCPA/CPRA: Processing for business purposes as defined under California law
• KVKK: Processing based on explicit consent or contractual necessity
• DIFC DPL: Processing per applicable DIFC regulations

7. Data Sharing & Disclosure

7.1 Service Providers & Sub-processors

We share data with carefully selected third parties who help us provide the Services. See our Sub-processor List for details. Key categories include:

• Cloud infrastructure providers (AWS)
• AI model providers (OpenAI, Google, Anthropic — including Anthropic served via Amazon Bedrock and Microsoft Azure AI Foundry)
• Communication platforms (Meta/WhatsApp)
• Payment processors (Stripe)
• Analytics and monitoring tools

Sub-processors are bound by data processing terms with obligations equivalent to our DPA.

7.2 Legal & Safety

We may disclose data when required to:

• Comply with legal obligations or valid legal requests
• Protect rights, property, or safety
• Detect, prevent, or address fraud and security issues
• Enforce our terms and policies

7.2.1 Government & Legal Request Procedures

When we receive requests from public authorities for personal data or information:

Legality Review Process:

• All government requests undergo immediate legal review to verify authority and scope
• We require valid legal process (warrant, court order, or subpoena) unless emergency circumstances apply
• Requests must identify specific legal basis and be signed by authorized officials
• We verify the requesting agency's identity and jurisdiction

Challenging Unlawful or Overbroad Requests:

• We reserve the right to challenge requests that appear unlawful, overbroad, or procedurally defective
• We may seek to narrow scope to protect user privacy while meeting legal obligations
• Where permitted by law, we will contest requests lacking proper legal basis
• We may involve legal counsel to oppose or modify inappropriate requests

Data Minimization for Legal Requests:

• We disclose only the minimum information necessary to satisfy valid legal requirements
• We apply the principle of proportionality to all disclosures
• Where possible, we provide anonymized or aggregated data instead of personal information
• We will not provide data beyond the specific scope and timeframe requested

Documentation & Transparency:

• All government requests are logged with: date received, requesting agency, legal basis, data scope, our response, and disclosure date
• We maintain records of our responses and any data disclosed for audit purposes
• Where legally permitted, we notify affected users of government requests
• We publish transparency reports when feasible and legally permissible
• Documentation retained for minimum 3 years or as required by law

Emergency Requests:

Emergency disclosures without standard legal process only occur when:

• Imminent danger of death or serious physical injury
• Risk to child safety
• Properly documented emergency request from verified law enforcement

7.3 Business Transfers

In the event of merger, acquisition, or sale of assets, personal data may be transferred as part of the transaction with appropriate safeguards.

7.4 With Consent

We may share data for other purposes with your explicit consent.

7.5 What We DON'T Do

• We do NOT sell personal information
• We do NOT share for cross-context behavioral advertising without opt-out rights
• We do NOT use Customer Content for AI training without explicit opt-in

8. International Data Transfers

8.1 Transfer Mechanisms

When we transfer personal data internationally, we use appropriate safeguards:

• EU/UK to US: Standard Contractual Clauses (Module 2) + UK IDTA
• Switzerland: Swiss Federal Data Protection Act Addendum
• DIFC: Appropriate transfer mechanisms per DIFC Commissioner requirements
• Turkey (KVKK): Board-approved undertakings or explicit consent with documented assessments

8.2 Data Residency

Customer data is stored on AWS in Ireland (eu-west-1). AI inference may take place in the US through the sub-processors listed on our Sub-processors page.

All plans: EU hosting (Ireland). Other regions are on our roadmap.

9. Data Retention

How long we keep your data. We retain your conversation history for up to 24 months from the date each message is created, after which it is automatically deleted. You can delete your account and associated conversation data at any time from your account settings, and we will erase it on request. Operational and diagnostic logs, which do not contain your conversation content, are retained for 30 days. Business (enterprise) customers may be subject to a different retention period as set out in their agreement.

9.1 Retention Periods

9.2 Retention Principles

• We retain data only as long as necessary for stated purposes
• Retention periods can be set per contract.
• Conversation data is retained for up to 24 months from message creation, then automatically deleted; operational and diagnostic logs (which contain no conversation content) are retained for 30 days
• For customers with a regulatory record-keeping obligation (e.g. financial-services clients), the configurable retention ceiling may be extended by agreement
• Backups are time-limited and securely deleted
• Upon account termination, data is deleted per our DPA terms

10. Your Privacy Rights

10.1 Universal Rights

Depending on your location, you may have the right to:

• Access: Obtain copies of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion ("right to be forgotten"). To delete your account and associated data, use our Delete Account page
• Restriction: Limit how we process your data
• Portability: Receive data in machine-readable format
• Objection: Object to certain processing activities

10.2 CCPA/CPRA Rights (California)

• Right to know categories and specifics of data collected
• Right to delete personal information
• Right to opt-out of sale/sharing (we don't sell, but you can opt-out of any sharing)
• Right to limit use of sensitive personal information
• Right to non-discrimination
• Do Not Sell/Share: Use our Cookie Preference Center or email [email protected]

10.3 GDPR/UK GDPR Rights

• Right to lodge complaints with supervisory authorities
• Right to withdraw consent
• Right not to be subject to automated decision-making
• Right to be informed about processing

10.4 Turkey (KVKK) Rights

• Right to learn whether data is processed
• Right to request information about processing
• Right to request rectification
• Right to apply to the Personal Data Protection Board

10.5 How to Exercise Your Rights

To delete your account: use our Delete Account page.

For all other requests: [email protected]

Response timeline:

• Acknowledgment: Within 24 hours
• Identity verification: 3-5 business days
• Completion: Within 30 days (may extend to 60 days for complex requests)

For urgent privacy matters, please mark your email as "URGENT - PRIVACY RIGHTS"

11. Cookies & Tracking

11.1 Cookie Usage

We use cookies as detailed in our Cookie Policy. Key points:

• Essential cookies: Always active for functionality
• Analytics cookies: Help us understand usage
• Marketing cookies: For relevant advertising (with consent)

11.2 Your Controls

• Cookie Preference Center: www.getslick.ai/cookie-preferences
• Global Privacy Control (GPC): We honor GPC signals from every visitor, treating them as an opt-out of non-essential cookies
• Do Not Track: Currently not recognized, but you can manage preferences
• EU/UK Default: Only essential cookies load without consent

12. AI Model Providers & Data Processing

To deliver our AI features, we send relevant conversation content, prompts, and related media to third-party AI model providers (OpenAI, Google, and Anthropic — including Anthropic's Claude models served via Amazon Bedrock (AWS) and, as a fallback for specific model tiers, Microsoft Azure AI Foundry) that process this data to generate responses on our behalf. We share only the data necessary to provide the requested AI functionality.

Provider applicability is scoped by product and plan. Claude-based tenants run on Anthropic via Amazon Bedrock (with Anthropic's direct API and Azure AI Foundry as fallback); OpenAI and Google also process data for specific features (voice-note transcription, image text extraction); see our Sub-processors page. The providers that apply to your deployment are identified in your tenant or contract documentation.

12.1 Model Selection

AI model providers can be set per contract. We maintain transparency about:

• Available providers (OpenAI, Google, Anthropic, Amazon Bedrock, Microsoft Azure AI Foundry, etc.)
• Data retention by providers

12.2 Provider Data Handling

We use AI providers through their business APIs. Each provider's data handling is listed on our Sub-processors page. In summary:

• OpenAI: Not used for training; may be retained up to 30 days for abuse monitoring under the provider's API terms
• Anthropic: Not used for training; may be retained up to 30 days for abuse monitoring under the provider's API terms
• Amazon Bedrock (AWS): Not stored or used for training by AWS
• Microsoft Azure AI Foundry: Not used for training; may be retained up to 30 days for abuse monitoring under the provider's API terms
• Google (Gemini API, Cloud Vision, Speech-to-Text, Vertex AI): Up to 55 days for abuse monitoring, per Google's API terms

12.3 Opting Out

Customers can opt-out of specific model providers via:

• Per contract
• Written notice to [email protected]

13. Data Security

We implement comprehensive security measures including:

13.1 Technical Safeguards

• Encryption at rest (AES-256) and in transit (TLS 1.2+, TLS 1.3 supported)
• Customer-managed keys (BYOK) available on request
• Multi-factor authentication for administrative access
• Automated vulnerability scanning of container images and dependencies

13.2 Organizational Safeguards

• Access controls and least privilege principles
• Incident response procedures
• Automated daily backups with point-in-time restore

13.3 Compliance

• SOC 2: Planned
• GDPR: DPA available · CCPA: consumer requests via [email protected]
• ISO 27001: Planned

For detailed security information, see our Security Overview.

14. Children's Privacy

Our Services are not directed to individuals under 16. We do not knowingly collect personal data from children. If we learn of collection from a child, we will promptly delete such information and terminate the account.

15. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by:

• Posting notice on our website
• Sending email to account administrators
• In-app notifications for Individual and Teams users
• Updating the "Last Updated" date

Your continued use after changes constitutes acceptance of the updated policy.

16. Additional Resources

• Terms of Use
• Data Processing Agreement
• Cookie Policy
• Sub-processor List
• Security Overview
• Vulnerability Disclosure Policy

17. Contact Us

For privacy-related questions, requests, or concerns: