Privacy Policy.
The disclosure document required by GDPR, Quebec Law 25, CCPA/CPRA, and PIPEDA. This is the document that legally enables anonymization and downstream commercial use of data, by giving notice and obtaining consent at the point of collection.
May 24, 2026 · v1.2 · Effective for all visitors and clients as of this date. Covers Florida (entity jurisdiction), EU, Quebec (Law 25), and California exposure.
Who We Are.
Studio Mate LLC (“we,” “us,” “our,” or “studio-Máté.ai”) operates conversational AI agents (each, an “Agent“) deployed on third-party websites and properties (each, a “Host Site“). This Privacy Policy describes how we collect, use, share, and protect personal information when you interact with an Agent.
Roles.
For Personal Information collected through the Agent, the Host Site acts as a controller (or business, under U.S. law) and we act as a processor (or service provider) for the duration of your conversation and reasonable analytics retention thereafter.
After we irreversibly anonymize your data so that it cannot reasonably be linked back to you, we process the resulting Anonymized Data and Aggregated Data as an independent controller for the purposes described in Section 4.
What We Collect.
When you interact with an Agent, we collect:
- Conversation content — your messages (text, voice transcripts), the Agent’s responses, timestamps, conversation duration, and session structure;
- Technical data — IP address, browser type, device type, operating system, referring URL, and approximate location (derived from IP);
- Inferred data — intent classifications, sentiment markers, topic tags, lead-quality scores, and similar AI-derived signals;
- Voluntary information — any name, email, phone, project details, or other information you choose to provide during the conversation;
- Cookies and similar technologies — session identifiers, analytics cookies, and embedded-player identifiers (governed by the Host Site’s cookie banner).
How We Use Personal Information.
- To operate the Agent and respond to your inquiries;
- To route qualified leads, schedule appointments, and send follow-up communications you request;
- To provide the Host Site with reporting and analytics about its own deployment;
- To secure the Agent, prevent abuse, and comply with law.
- To improve our AI models, prompts, and Provider Platform;
- To produce industry benchmarking studies, research reports, white papers, and commentary;
- To license aggregated insights to third parties (manufacturers, investors, publishers, academic institutions, AI model providers);
- To develop new products and services.
Section 4.2 is what legally authorizes the data resale business model. Without it, anonymized data may still be considered personal data under some interpretations of GDPR and Quebec Law 25. Counsel should ensure the anonymization standard meets the regulatory threshold in each target jurisdiction.
Legal Bases (GDPR / Quebec Law 25).
We process your Personal Information on the following legal bases:
- Performance of a contract (GDPR Art. 6(1)(b)) — to operate the Agent for the Host Site;
- Consent (GDPR Art. 6(1)(a); Quebec Law 25 manifest consent) — for the anonymization and downstream commercial use of data, given by your continued interaction after disclosure;
- Legitimate interests (GDPR Art. 6(1)(f)) — for security, fraud prevention, and service improvement;
- Legal obligation (GDPR Art. 6(1)(c)) — to comply with applicable law.
Sharing.
We share Personal Information with:
- The Host Site — as controller of your interaction with their Agent;
- Subprocessors — see Section 11 for the current list (Anthropic, Anam, Railway, and other hosting/database providers);
- Third-party recipients of Anonymized or Aggregated Data — in non-identifying form only;
- Legal recipients — in response to lawful requests, subpoenas, or to protect rights, safety, and property;
- Corporate transactions — in connection with a merger, acquisition, or sale of assets, subject to equivalent privacy protections.
We do not sell Personal Information in the narrow CCPA/CPRA sense, but we do share Anonymized and Aggregated Data for commercial purposes.
Retention.
- Identifiable Conversation content: retained for up to twenty-four (24) months from collection;
- Technical and analytics logs: retained for up to twenty-four (24) months;
- Anonymized Data and Aggregated Data: retained indefinitely;
- Records of consent: retained for at least the limitations period applicable to the relevant claim plus one year.
Your Rights.
Depending on your jurisdiction, you may have the right to:
- Access the Personal Information we hold about you;
- Correct inaccurate Personal Information;
- Delete Personal Information (note: this does not extend to Anonymized or Aggregated Data, which by definition cannot be linked back to you);
- Restrict or object to certain processing;
- Receive a portable copy of your Personal Information;
- Withdraw consent (this does not affect the lawfulness of prior processing or anonymized outputs);
- Lodge a complaint with your local data protection authority (e.g., the Commission d’accès à l’information du Québec for Quebec residents).
To exercise these rights, contact hello@studio-mate.ai. We will respond within the period required by applicable law (typically thirty (30) days).
Quebec Law 25 — Additional Disclosures.
Where applicable to Quebec residents.
[Name, Title, Email].
The Agent uses AI to classify intent and route conversations. This processing influences how your inquiry is handled but does not produce legal effects concerning you. You have the right to be informed of the principal factors and parameters that led to any decision and to submit observations.
If you are a Quebec resident, your Personal Information may be transferred to and processed in the United States and other jurisdictions outside Quebec. We have conducted a privacy impact assessment for such transfers and applied contractual and technical safeguards as required by Law 25. For Quebec residents under Law 25, our designated Person in Charge of the Protection of Personal Information is the Compliance Officer at Studio Mate LLC, reachable at privacy@studio-mate.ai or via the toll-free number above.
California Residents — CCPA/CPRA.
Under the California Consumer Privacy Act, you have the right to know what categories of personal information we collect, the sources, the purposes, and the categories of third parties with whom we share it. You may also request deletion, correction, and to opt out of any “sale” or “sharing” of personal information.
To exercise California rights, contact hello@studio-mate.ai or use the “Do Not Sell or Share My Personal Information” link on the Host Site.
Subprocessors.
We use the following subprocessors to deliver the Service. This list may be updated; the current list is maintained at studio-mate.ai/subprocessors.
- Anthropic, PBC (USA) — large language model inference;
- Anam AI Ltd. (UK) — real-time avatar rendering;
- Railway Corp. (USA) — application hosting and compute;
- Hosting and database providers — AWS, Supabase, or equivalent.
International Transfers.
Where Personal Information is transferred outside the EEA, the UK, or Quebec, we rely on Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms.
Security.
We apply commercially reasonable administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, alteration, disclosure, or destruction. No system is perfectly secure; we cannot guarantee absolute security.
Children.
The Agent is not directed to children under sixteen (16). We do not knowingly collect Personal Information from children under sixteen (16). If you believe we have collected such information, contact hello@studio-mate.ai for deletion.
Changes.
We may update this Policy from time to time. Material changes will be communicated via the Host Site or by direct notice. The “Last Updated” date reflects the latest revision.
— End of End-User Privacy Policy · Legal Stack v1.2 —
Document URL: studio-mate.ai/privacy · See also: