Version 2026-10-23 · Effective October 23, 2026

Privacy Policy

What personal information Tesan AI LLC collects, why, who we share it with, how long we keep it, and the choices and rights you have.

1. Who we are

Tesan AI LLC ("Tesan," "we," "us") is a New York limited liability company. This policy covers tesanai.com, its subdomains, our sign-up and login pages, and the Tesan AI platform (the "Service").

We play two roles. For information about our own customers and visitors (for example, the account owner's name, email, phone number and billing details), we decide how it is used and are the "controller" or "business." For information our customers put into the Service about their own clients, leads and contacts (CRM records, website form submissions, connected email), we act on our customer's behalf as a "processor" or "service provider." If you are one of our customer's contacts, please direct privacy requests to that business; we will help them respond.

2. Information we collect

Account information: your name, business name, email address and mobile phone number.
Google sign-in: if you choose "Continue with Google," we receive your name, email address, profile photo and whether Google has verified your email. We request only the openid, email and profile permissions at sign-up.
Billing information: payments are handled by Stripe. We receive your billing name, email, card brand, last four digits, expiry and payment status. We never receive or store full card numbers or security codes.
Usage and metering data: features used, AI token counts per request, CRM lead counts, and timestamps.
Device, network and security data: IP address, browser and device type, login and verification events, bot-check results, and security logs.
Cookies: see section 11.
Customer content: data you or your users put into the Service, such as CRM records, website content, messages, files, and email from mailboxes you connect.
Consent records: what you agreed to, which version, when, and from which IP address and browser.

3. How we use information

To provide and operate the Service, including your workspace, website, AI Assistant and integrations.
To create your account, authenticate you, and send one-time verification codes.
To bill you, process payments, and send receipts and legally required billing notices.
To prevent fraud, abuse, bots, card testing and unauthorized access.
To provide support and respond to your requests.
To secure and monitor the Service and fix problems.
To comply with law, enforce our Terms, and keep records of consent.
To send service and product communications. Marketing emails are sent only if you opt in, and every marketing email has a one-click unsubscribe link.

4. Google user data (Limited Use)

Tesan's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data, including Gmail data when you connect a mailbox, is used only to provide and improve user-facing features you turned on (such as showing and drafting email in your CRM). We do not sell it, do not use or transfer it for advertising, do not use it to train AI models, and do not let people read it unless you ask us to for support, it is needed for security or to comply with law, or it has been aggregated and anonymized for internal operations.

5. Text messages (SMS)

We use your mobile number to send verification codes and account security alerts. When you give us your number on our forms, or by voice to our AI receptionist when booking, you consent to receive the text messages described here, which may include verification codes, account and billing alerts, appointment confirmations and reminders, and replies to support requests. Consent to texts is not a condition of any purchase.

Message frequency varies. Message and data rates may apply. Reply STOP to opt out and HELP for help, or contact [email protected]. After you opt out you will receive one confirmation message and no further texts except as required by law; reply START to re-enroll.

We do not use your number for marketing texts unless you separately opt in. Mobile numbers and SMS opt-in consent are not shared with or sold to third parties or affiliates for their marketing purposes. Texts are delivered through Twilio, which is bound by contractual data-protection obligations.

6. AI processing

When you use the AI Assistant and other AI features, the content you submit and the related context (for example, CRM or email content you ask it to work with) is sent to third-party AI model providers listed on our Subprocessors page to generate a response. Those providers process it under API terms that do not permit them to use it to train their models. We do not use your content to train AI models.

We share personal information with service providers that help us run the Service, under contracts that limit their use of it. The current list, with what each does and where it processes data, is on our Subprocessors page. We will update that page before we add a new subprocessor.

We may also share information to comply with law or valid legal process, to protect the rights, safety and security of our users, the public or Tesan, or as part of a merger, acquisition or sale of assets, subject to this policy.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

8. How long we keep information

Account information: while your account is open, then 30 days after it closes.
Customer content: while your account is open, then 30 days after it closes, after which it is permanently deleted.
Unverified sign-ups: deleted 24 hours after they were started if email and phone were not verified.
Billing and tax records: as long as tax and accounting law requires.
Security and audit logs: as long as needed to protect the Service and investigate security incidents, then deleted.
Consent records: kept after account deletion so we can show what was agreed, with personal data limited to what is needed for that purpose.

9. Security

We protect information with encryption in transit (TLS) and at rest, access controls, row-level tenant isolation in our database so one customer's workspace cannot read another's, encrypted storage of connected-account credentials, hashed verification codes, bot and abuse protection, and monitoring and audit logging. No system is perfectly secure, and we cannot guarantee absolute security.

10. Your privacy rights

Depending on where you live, including California (CCPA/CPRA), New Jersey and other U.S. states with comprehensive privacy laws, you may have the right to: know and access the personal information we hold about you; correct it; delete it; receive a portable copy; and opt out of the sale of personal information, targeted advertising and certain profiling (we do not do any of these). We will not discriminate against you for exercising these rights.

How to make a request: signed-in users can export data and request deletion at Account → Privacy. Anyone can email [email protected]. You can use an authorized agent where the law allows.

Verification: we verify requests by confirming control of the email address or phone number on the account (for example, with a one-time code), and may ask for more information if needed. We never ask for more than we need to verify you.

Timing: we respond within 45 days, and may extend once by another 45 days where the law allows, with notice.

Appeals: if we decline your request, you can appeal by replying to our decision or emailing [email protected] with "Appeal" in the subject. We will respond within the time the law requires and explain how to contact your state attorney general if you disagree.

If your information was provided to us by one of our customers (for example, you are a lead in their CRM), we will refer your request to that customer and help them respond.

11. Cookies

By default we use only strictly necessary cookies: to keep you signed in, protect forms and sessions (including Cloudflare bot checks), remember security steps such as a recent verification, and remember your cookie choice.

Analytics: only if you choose "Accept analytics" in our cookie banner, we set a first-party cookie for up to one year to count page visits on tesanai.com. We do not use advertising cookies.

Partner referrals: if you arrive through a partner's referral link, we set a first-party cookie for 90 days so we can credit that partner if you become a customer.

Websites our customers build and host with the Service are operated by those customers, who are responsible for the cookie notices on their own sites.

12. Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18.

13. Where data is processed

We are based in the United States and store account and customer data in the United States. Some subprocessors, including certain AI model providers and global network services, may process data in other countries; the Subprocessors page lists each location. Where data is transferred internationally, we rely on contractual protections with those providers.

14. Security incidents

If a security incident affects your personal information, we will notify you and the authorities where the law requires, without undue delay, and tell you what happened and what we are doing about it. For incidents affecting customer data we process for our customers, we will notify the affected customer so they can meet their own obligations.

15. Changes to this policy

We will post updates on this page with a new effective date. For material changes we will email account owners and show a notice in the app before the change takes effect, and ask you to review and accept it at your next sign-in.

16. Contact us

Privacy requests and questions: [email protected].