Privacy policy

Effective date: October 20, 2026. Last updated: October 20, 2026.

1. Introduction

Sivuno (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use Negotiation Lab, by Sivuno, our AI-powered negotiation preparation (Prepare), training (Practice) and live coaching (Perform) services, including the negotiationlab.ai website, its interactive demo and the Negotiation Lab app (the “Services”). We comply with applicable data protection laws, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).

2. Information we collect

2.1 Information you provide directly

Account Information: Name, email address, company name
Billing Information: Billing address and billing contact details under your organization’s agreement with Sivuno. We do not process payment cards.
Business Data: Deal documents, spend data files, supplier information, and transaction records you upload, and the negotiation strategies prepared from them
Session Data: Your voice and the live transcripts made from it during Practice and Perform sessions, and the assessments, scores and debriefs of those sessions
Interactive Demo: If you try the live demo on our website, your voice during the call. Your microphone is used only during the call and stops when it ends. We do not record or keep your voice: it is transmitted to our AI voice and transcription provider for the live session only. The text of the conversation passes through our server to AI model providers to produce the demo’s coaching, claim checks and debrief, and we keep none of it.
Communications: Support requests, feedback, and other correspondence, including demo requests (name, work email, company, team size, and an optional note). A demo request sent after an interactive demo is linked to that demo run, and the request we receive shows the run’s score and the terms agreed.

2.2 Information collected automatically

Usage Data: Features used and activity within the Services
Device Information: IP address, browser type and version, operating system, device identifiers
Interactive Demo: For each demo run, a record of the run: its status and times, why it ended, the call’s length and estimated cost, usage counts, the score (0 to 100) and a summary of the deal terms reached, and technical identifiers for the call and its network relay. It holds no audio, transcript or coaching text, and identifies no one unless you send a demo request after the run, which links the request to it. To prevent abuse, when per-visitor limits are enabled, we use a keyed hash of your IP address combined with the date, which cannot be linked across dates.
Cookies and Similar Technologies: The negotiationlab.ai website sets no cookies. Its one exception is the embedded film on the home page, served from youtube-nocookie.com. The Negotiation Lab app uses only strictly necessary sign-in and security cookies. The interactive demo sets no cookies and uses no browser storage. We use no analytics or advertising cookies.

2.3 Information from third parties

Authentication Providers: If you sign in through your organization’s identity provider (single sign-on)
Business Intelligence: Publicly available business information for supplier research

3. How we use your information

3.1 To provide our Services

Prepare negotiation strategies from your documents, spend data and research using AI technology
Run practice role-plays and live coaching, including speech transcription
Score sessions and produce assessments and debriefs
Research supplier information and provide strategic insights
Generate reports and analytics
Manage your account
Manage billing under your organization’s agreement

3.2 To maintain our Services

Monitor and prevent technical issues

Sivuno does not use your data to train or improve AI models.

3.3 To communicate with you

Send service updates and notifications
Respond to support requests
Provide training and onboarding materials
Send marketing communications (with your consent)

4. Legal basis for processing (GDPR)

We process personal data based on:

Contract Performance: To provide the Services you’ve requested
Legitimate Interests: To ensure security and operate our business
Legal Obligations: To comply with applicable laws and regulations
Consent: For marketing communications

5. Data sharing and disclosure

5.1 Service providers

We share data with carefully selected service providers who assist us in operating our Services:

Cloud infrastructure providers
AI model providers
AI voice and transcription providers
Network relay providers, for live audio connections
Web research providers
Email delivery providers
Customer support tools

Some of these providers may keep data they process for a limited period for abuse monitoring. Our subprocessor list, available on request, names them.

5.2 Business transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

5.3 Legal requirements

We may disclose your information if required by law, court order, or governmental authority, or to protect our rights, property, or safety.

5.4 Your consent

We may share your information for other purposes with your explicit consent.

6. Data security

We implement appropriate technical and organizational measures to protect your personal data:

Encryption of data in transit and at rest
Regular security assessments and audits
Access controls and authentication requirements
Employee training on data protection
Incident response procedures

However, no method of transmission over the Internet is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.

7. How long we keep data

We keep personal data for as long as necessary to provide our Services and fulfill the purposes outlined in this Privacy Policy, unless a longer period is required by law.

Account Data and Business Data: As set out in your organization’s agreement with Sivuno and its data processing agreement
Interactive Demo: The hash of your IP address is kept only as long as needed to run the demo and prevent abuse. The run record identifies no one unless you send a demo request after the run; it is then kept with that request.
Legal Records: Kept as required by applicable laws

8. International data transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for such transfers:

Standard Contractual Clauses approved by the European Commission
Data Transfer Impact Assessments where required
Additional security measures for international transfers

9. Your rights and choices

9.1 GDPR rights (EU/UK residents)

Access: Request a copy of your personal data
Rectification: Correct inaccurate or incomplete data
Erasure: Request deletion of your data (“right to be forgotten”)
Restriction: Limit how we process your data
Portability: Receive your data in a machine-readable format
Objection: Object to certain processing activities
Automated Decision-Making: Request human review of automated decisions

9.2 CCPA/CPRA rights (California residents)

Right to Know: Information about data collection and use
Right to Request Deletion: Request deletion of personal information
Right to Correct: Request correction of inaccurate information
Right to Opt-Out: Opt-out of sale or sharing of personal information
Right to Limit Use: Limit use of sensitive personal information
Non-Discrimination: Equal service regardless of exercising rights

9.3 How to exercise your rights

To exercise any of these rights, please contact us at info@sivuno.com. We will respond to your request within the legally required timeframe (typically within a 30-day period).

10. Children’s privacy

Our Services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to erase such information.

11. AI and automated processing

We use artificial intelligence to prepare negotiations, run practice and live coaching, and score sessions. This involves:

Automated drafting of negotiation strategies from your documents, spend data and research
AI counterparts in practice role-plays, and live coaching and claim checks during negotiations
Automated scoring, assessments and debriefs of sessions

You have the right to request human review of any automated decisions that significantly affect you. Our AI processes are designed with transparency and fairness principles. Sivuno does not use your data to train or improve AI models.

12. Do Not Track signals

Some browsers transmit “Do Not Track” signals. Because there is no industry standard for handling these signals, our Services do not currently respond to them. Our website sets no cookies, and the Services use only the cookies described in section 2.2.

13. Third-party links

Our Services may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to review their privacy policies.

14. Changes to this privacy policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new Privacy Policy on this page and updating the “Last updated” date. For significant changes, we will provide additional notice via email or through the Services.

15. Contact information

For questions about this Privacy Policy or to exercise your rights, please contact us:

Email: info@sivuno.com
Data Protection Officer: info@sivuno.com

16. Supervisory authority

EU/UK residents have the right to lodge a complaint with their local data protection authority if they believe we have not addressed their concerns adequately.

17. California specific disclosures

Categories of Personal Information Collected: Identifiers, commercial information, internet activity, audio information, professional information, and inferences drawn from this information.

Sources: Directly from you, automatically through your use of Services, and from third-party business partners.

Business Purposes: Providing services, security, legal compliance, and business operations.

No Sale of Personal Information: We do not sell or rent your personal information to third parties. We do not share personal information for cross-context behavioral advertising.