Privacy policy

AIOSO LLC ("AIOSO," "we," "us," or "our") provides OSO8.com and offers OSO and PANOCORE products and related services. This Privacy Policy explains how personal information is collected, used, disclosed, retained, and protected when you browse or shop on OSO8.com, contact us, or use our connected products, applications, subscriptions, and related services that link to this policy (together, the "Services").

Personal information means information that identifies you, relates to you, or can reasonably be linked to you or your household. The information processed depends on the product, feature, permissions, and settings you use. Purchasing a hardware product and using its optional cloud or AI features involve different data processing activities, described below.

01Our role and our relationship with Laxis

AIOSO LLC is responsible for the personal information it processes to operate its business, sell products, fulfill orders, provide customer support, and manage customer relationships. Where applicable law uses the term, we act as a data controller for these activities.

Laxis, Inc. ("Laxis") provides technical administration and data management for our website and software services, including relevant account, hosting, cloud, and AI service functions. When Laxis processes personal information on our behalf, it acts as our service provider or processor under the applicable arrangements. Using a service provider does not remove our responsibility for processing for which we are the controller.

Some software accounts or services may be supplied directly by Laxis. Where Laxis determines its own processing purposes, or you use a separate Laxis service under a direct relationship with Laxis, its privacy policy also applies to that processing: https://www.laxis.com/privacy/. The applicable service screens, agreement, or order identify the provider. This policy describes AIOSO's practices; it does not replace Laxis's notice for its independent processing or authorize additional uses by Laxis.

Our storefront uses Shopify. Shopify, payment providers, app stores, and other third parties may process some information on our behalf and some information for their own purposes, as explained in Section 6. If an employer or other organization supplies your account, it may control the content and settings of that workspace; see Section 5.

02Information we collect and its sources

Information you provide

Account and contact information. Your name, email address, telephone number, account identifiers, sign-in information, language preferences, and, if provided, company name, job title, and business contact information.

Shopping and transaction information. Billing and delivery addresses, recipient details, cart contents, products ordered, order numbers, payment confirmation and limited payment details, invoices, tax information where required, subscription entitlements, returns, refunds, exchanges, warranty requests, and related communications. Payment processors collect payment credentials through their checkout systems; see Section 4.

Customer communications. Information you send in support tickets, emails, contact forms, surveys, product reviews, promotional entries, or other communications, including files and images you choose to attach. Public reviews may display the name and other information you submit for publication.

Content used with software and AI features. Audio and other media you record, upload, or direct the Services to capture; meeting titles, participant details, and timestamps; transcripts, translations, notes, summaries, action items, AI prompts and responses; and text or speech submitted through voice input features. Video, images, or screen content are processed where you submit them or use a feature that supports their capture. We refer to these materials collectively as "Content."

Permissions and connected accounts. If you authorize an integration, we receive the information made available under the permissions you grant. For example, calendar access may provide event titles, times, invitees, and meeting links for scheduling or joining meetings. A CRM integration may exchange selected contact details, meeting notes, or tasks. Authentication providers may provide your account identifier, name, email address, and profile image. Access tokens may be used to maintain the connection. Connecting a calendar does not by itself authorize access to an entire email inbox or unrelated files.

Information collected through use

Technical and usage information. IP addresses, browser and operating system details, device and application identifiers, language, referring pages, pages viewed, feature interactions, session times, approximate location derived from IP address, diagnostic logs, crashes, and service performance information.

Product information. Depending on the device and enabled features, information such as product model, serial number, firmware or app version, device connection status, activation details, and troubleshooting records may be processed to support the product and your account.

Cookies and similar technologies. Our website and service providers may collect browsing, cart, checkout, and campaign interaction information using cookies, pixels, local storage, and similar tools. Section 7 explains their purposes and your choices.

Information from others

We may receive order, delivery, refund, fraud-prevention, or subscription information from Shopify, payment processors, carriers, app stores, and retail partners; account and Content information from Laxis and integrations you authorize; and information from workspace administrators or meeting organizers who use the Services. For example, another user may upload a meeting recording containing your voice or include your contact details in a shared workspace.

Sensitive information can appear in Content, including private communications or health, financial, or other sensitive details. Account credentials and certain payment information may also receive special protection under applicable law. Do not submit sensitive information unless necessary, you have authority to do so, and the service and contractual protections are appropriate. Submitting Content does not authorize unrelated advertising uses or biometric identification.

03How we use information

We use personal information for the following purposes:

• Providing the Services: creating and authenticating accounts; activating devices and subscription entitlements; synchronizing Content; and delivering recording, transcription, translation, summarization, voice input, search, and AI assistant features you use.
• Processing purchases: accepting orders, processing payments, calculating taxes, arranging delivery, providing receipts and order updates, and handling returns, refunds, exchanges, and warranty support.
• Supporting customers: responding to questions, diagnosing problems, reviewing information you provide for support, and managing account or product requests.
• Maintaining reliability and security: investigating errors, preventing fraud and abuse, protecting accounts and systems, enforcing agreements, and resolving disputes.
• Understanding and improving the Services: evaluating feature usage, performance, and customer feedback and developing improvements, subject to the Content restrictions in Section 5 and any integration-specific rules.
• Communicating with you: sending essential account, billing, delivery, security, or policy notices and, subject to applicable choices and consent requirements, product news, offers, and shopping reminders.
• Marketing and measurement: understanding visits and campaign performance and, where enabled and permitted, delivering relevant advertising using website or shopping information, subject to Section 7.
• Meeting legal and business obligations: keeping required financial records, responding to lawful requests, exercising or defending legal claims, and evaluating legitimate corporate transactions.

We may use aggregated or de-identified information for analytics and service planning where permitted. When information is treated as de-identified under applicable law, we maintain it in that form and do not attempt to re-identify it except where the law permits, such as testing de-identification safeguards.

04Shopping and payment privacy

Checkout and payment processing. The payment methods available at checkout identify the relevant payment providers. Shopify and the payment provider process information needed to authorize and settle the transaction and detect fraud. Software subscriptions may be processed through Laxis's billing provider, such as Stripe, or through an app store, depending on where you subscribe. These providers may collect card numbers, security codes, billing details, and fraud signals directly. We do not ask you to send full card details or security codes by email or through support forms. Our ordinary order administration uses transaction records, payment status, and limited payment details rather than full card credentials.

Fulfillment. Warehouses, fulfillment providers, and shipping carriers receive information needed to deliver and service your order, such as the recipient's name, address, contact details, products, and tracking information. Customs or tax authorities may receive information required for cross-border shipments. They do not need your meeting recordings, transcripts, or AI prompts to fulfill a hardware order.

Returns and warranty requests. We use order details, product identifiers, your explanation, and any reasonably needed photos or shipping records to assess and process the request. Before sending back a device, remove local recordings, memory cards, and personal information where possible, disconnect accounts, and reset the device as instructed. A refund or hardware return does not automatically delete a separate software account or cancel an app-store subscription.

Marketing choice. Making a purchase does not waive your privacy rights or automatically authorize every form of marketing. You can unsubscribe from marketing emails while continuing to receive necessary order, safety, account, or billing messages. If you provide another person's delivery information, provide it only with appropriate authority and for the intended transaction.

05Recordings and AI features

Processing your Content. When you use cloud or AI features, relevant Content is transmitted to Laxis and the service providers involved in storage, speech recognition, translation, or AI processing so the requested feature can work. Transcription, summaries, translations, and AI responses can contain personal information from the source material. Processing a request with an AI model is distinct from using Content to train a model.

Model training and advertising. We do not use your private recordings, transcripts, translations, meeting notes, or AI prompts and responses to train general-purpose AI models or to target advertising. We require providers processing this Content on our behalf to respect these restrictions. Any separate optional contribution of Content for model development would require a clear explanation and your affirmative opt-in; accepting this policy does not provide that permission. Google API data remains subject to the stricter restrictions in Section 12.

Access and support. Access to private Content is limited to authorized people and providers who need it to deliver the requested service, address a support request, investigate security or abuse, or meet legal obligations. Where an integration imposes stricter human-access restrictions, those restrictions apply. Sharing Content with support or reporting an error may expose the material you include in that request.

Sharing and workspaces. If you share a recording, summary, link, export, or integration output, the recipients may access and retain it. Review sharing settings and recipient lists carefully. In an organization-managed workspace, administrators may manage accounts, permissions, access, exports, and retention under that organization's settings and agreements. The organization may be the controller of workspace Content, with AIOSO and/or Laxis acting as processors. Direct requests about that Content to the organization; we will assist as appropriate.

Recording other people. Before recording, transcribing, translating, or sharing a conversation, provide legally required notices and obtain any required consent or other authorization from participants. This policy is not consent from another participant. Recording requirements can differ by location and type of conversation. If you appear in another user's recording, contact the organizer or workspace administrator, or contact us for assistance with a privacy request.

Hardware and third-party software. Content may remain on a device, computer, or memory card or be uploaded through a connected app, depending on the product and settings. A camera or microphone used with a third-party meeting app may send data directly to that app under its own privacy practices. Deleting a cloud copy does not necessarily erase local copies, recipient exports, or copies held by a separate platform.

AI output. Generated output can be incomplete or inaccurate. You can request correction of personal information, including inaccurate information in generated output, subject to applicable law and technical feasibility. A summary or speaker label does not itself authorize use of a voiceprint or biometric template to identify someone.

06When information is disclosed

We disclose information for the purposes described in this policy to the following recipients, as relevant to your interaction:

• Laxis: administration, software accounts, cloud operations, Content processing, technical support, and related service delivery.
• Commerce and payment providers: Shopify, checkout and payment providers, software billing providers, and app stores for transactions, subscription administration, and fraud prevention.
• Operational providers: cloud infrastructure, communications, customer support, diagnostics, professional advisers, warehouses, carriers, and return or warranty service providers.
• Analytics and advertising partners: website and campaign information where those tools are enabled and permitted, subject to your choices. Private meeting Content and connected-calendar Content are excluded from advertising disclosures.
• Recipients you select: authorized collaborators, workspace administrators, integration providers, or others with whom you direct us to share information.
• Legal or transaction recipients: authorities or other parties when disclosure is necessary and lawful to meet a legal obligation, protect rights or safety, address fraud, or establish or defend a claim; and prospective purchasers, advisers, or successors in a merger, financing, reorganization, or asset sale, subject to appropriate safeguards and any stricter applicable restrictions.

Providers acting on our behalf are subject to appropriate contractual restrictions on their use and protection of personal information. A provider's independent processing, such as a payment provider's regulatory compliance or Shopify's consumer services, is governed by its own notice. See Shopify's privacy policy at https://www.shopify.com/legal/privacy and Stripe's at https://stripe.com/privacy. We do not imply that every provider receives every category of information or that every provider operates in every service.

07Cookies and advertising choices

Essential technologies support functions such as sign-in, cart and checkout, security, and remembering privacy choices. Preference technologies remember settings such as language. Analytics technologies help measure traffic and performance. Marketing technologies, where enabled, help measure campaigns and deliver advertising based on browsing or shopping activity across services. Advertising or analytics companies may collect information directly through these tools.

We do not sell personal information for money. Disclosing identifiers, browsing activity, or shopping events to advertising partners can nevertheless be a "sale," "sharing," or "targeted advertising" under some privacy laws. Your opt-out rights apply to those activities even when no money changes hands. We do not sell or share private meeting Content for these advertising purposes.

You can use Your privacy choices, the website's cookie controls where available, and you can email hello@oso8.com with the subject "Privacy opt-out" to request that we stop applicable sale, sharing, or targeted advertising. We honor legally recognized opt-out preference signals, including Global Privacy Control, where required by applicable law. A signal generally applies to the browser or device sending it and, where required and reasonably linkable, the associated account. An opt-out does not prevent disclosures needed for payment, delivery, security, or other permitted service operations.

Where consent is required, optional cookies and similar technologies are used only after that consent, and you can withdraw it. Browser settings can also block or delete cookies, although disabling essential cookies may affect service functions. Choices may need to be repeated on another browser or device or after clearing cookies. Older Do Not Track signals do not have a uniform implementation standard; we do not treat them as equivalent to legally recognized opt-out signals. You can also manage Shopify's independent privacy choices at https://privacy.shopify.com/.

08Retention and deletion

We retain personal information only for as long as needed for the purposes described here, taking account of the information's sensitivity, your account and settings, contractual requirements, legal duties, and the need to resolve disputes or protect security. Different categories have different retention criteria:

• Account information: for the duration of the account and any period necessary to complete closure, resolve outstanding matters, or meet legal requirements.
• Content: while needed to provide your account or workspace features, subject to applicable deletion requests, account settings, service arrangements, and any organization-managed retention requirements.
• Order, payment, tax, refund, and warranty records: for fulfillment, applicable warranty and dispute periods, and the accounting or other retention periods required by law, including after an account closes.
• Support and security records: for the period reasonably needed to resolve the issue, detect recurring problems or fraud, and meet relevant legal obligations.
• Marketing preferences and consent records: while relevant to your choices and as reasonably needed to document compliance or maintain a suppression record so we do not contact you again.
• Cookie and analytics information: according to the technology's lifespan, configured retention settings, your choices, and applicable legal requirements.

When retention is no longer necessary, information is deleted or de-identified. Deleted information may remain in protected backups until those backups expire under the applicable rotation schedule; backup information is not used for ordinary ongoing operations. A legal hold or another permitted exception may delay deletion of specific records. We do not promise immediate deletion from every system or a single universal retention period for all information.

You can request account or Content deletion by contacting us. Where Laxis administers the relevant information on our behalf, we coordinate the request with Laxis. Disconnecting an integration stops future authorized access but does not itself delete information already imported. Deleting an app, returning a product, canceling a subscription, and deleting an account are separate actions. We may retain records necessary to perform a remaining transaction or satisfy an applicable legal exception.

09Security and international processing

We use reasonable technical and organizational safeguards appropriate to the information and processing involved, including access controls and safeguards for transmission, storage, and provider access. No internet service or storage system can guarantee absolute security. Protect your account credentials and devices, use available security settings, and contact us if you suspect unauthorized access. We provide incident notifications when required by applicable law.

AIOSO operates in the United States. Laxis and other providers may store or access information in the United States and other locations where they operate. Applicable data residency arrangements, if any, are identified in the relevant service agreement. This policy does not promise that every category of website, payment, support, or software data remains exclusively in one country.

Where applicable law restricts an international transfer, we use an authorized transfer mechanism, such as a relevant adequacy decision or appropriate contractual safeguards, including applicable EU standard contractual clauses and UK transfer terms. You may contact us for information about the safeguards applicable to your information and, where available, a copy, subject to lawful redactions. This policy does not represent that AIOSO or Laxis is certified under a particular international transfer framework.

10Your rights and how to submit a request

Depending on your location and the law that applies, you may be entitled to access or receive a copy of personal information; correct inaccurate information; request deletion; obtain portable data; restrict or object to processing; withdraw consent; or opt out of sale, sharing, targeted advertising, or certain profiling. Some laws also provide rights concerning sensitive information and automated decisions with significant effects. These rights have exceptions and do not all apply to every person or processing activity.

Email hello@oso8.com with the subject "Privacy request" and describe what you would like us to do. Identify the email address used for your order or account and whether the request relates to shopping, software, or both. You can also use our contact page at https://oso8.com/pages/contact. Do not send passwords, full card details, or unnecessary identity documents.

We may verify identity and authority as reasonably necessary for the request, using information already available where possible. Opt-out requests are handled without requiring an account or unnecessary identity verification. An authorized agent may submit a request where the law permits; we may require proof of authorization and identity verification when allowed. Request information is used to process and document the request, protect security, and meet legal obligations.

We respond within the time required by applicable law, explain permitted extensions or refusals, and provide appeal information where applicable. Requests are generally free; a fee or refusal is possible only where applicable law allows it. If your state provides an appeal right, reply with "Privacy appeal" to ask us to reconsider a denial. We will explain the appeal outcome and how to contact the relevant regulator. We do not discriminate against you for exercising privacy rights.

To stop marketing emails, use their unsubscribe link or contact us. You can change app permissions, microphone and calendar access, notifications, and integration access through the relevant device, app, or connected-service settings. Withdrawing a permission may make the associated feature unavailable. Withdrawing consent does not invalidate processing that lawfully occurred before withdrawal.

11Additional information for California and other US residents

Where the California Consumer Privacy Act, as amended ("CCPA"), applies, this section supplements the rest of the policy. Sections 2 through 8 describe sources, purposes, recipients, and retention criteria. Depending on the Services used, the categories collected and disclosed for the described business purposes include:

The categories that apply to you depend on your interactions. We use sensitive information to provide requested services and for other legally permitted purposes; this notice does not authorize using it to infer sensitive characteristics for unrelated purposes. We do not require health, education, protected-characteristic, or biometric identification data to purchase ordinary hardware, although you or another user may include such information in Content.

The advertising disclosures described in Section 7 may involve identifiers, internet activity, commercial information, approximate location, and shopping-interest inferences. Where they occur, they may constitute sale or sharing under the CCPA. They exclude private meeting Content and account access credentials. We do not knowingly sell or share personal information of consumers under 16.

Where applicable, you can request disclosure of categories and specific pieces of personal information, sources, purposes, recipients, and sale or sharing practices; correction; deletion; and opt-out of sale or sharing. You may also have a right to limit certain sensitive-information uses. Use Section 10 to submit a request and Section 7 to opt out. Applicable rights extend to other US residents under their state laws, including relevant appeal rights. California residents may also ask about disclosures for third parties' own direct marketing under the Shine the Light law where applicable.

12European and connected account protections

For individuals in the EEA, UK, and Switzerland, where applicable, we rely on the following lawful bases: contractual necessity for requested accounts, software features, purchases, delivery, and subscription administration; legitimate interests for proportionate security, fraud prevention, service diagnostics, customer support, and business administration, balanced against your rights; legal obligations for tax, accounting, and lawful regulatory requirements; and consent for processing that requires it, including applicable optional tracking or permissions. Where sensitive information requires an additional legal condition, that condition must also be met; an ordinary contract alone is not sufficient.

You may object to processing based on legitimate interests on grounds relating to your situation, and you may object to direct marketing at any time. You can also exercise applicable access, correction, deletion, restriction, portability, and consent-withdrawal rights through Section 10. If information necessary for a purchase or requested feature is not provided, we may be unable to complete that purchase or provide that feature. Optional marketing information is not required to buy hardware.

You may complain to your local data protection authority, including the UK Information Commissioner's Office at https://ico.org.uk/ or the Swiss Federal Data Protection and Information Commissioner at https://www.edoeb.admin.ch/. You do not have to contact us first. Information about applicable international transfers is in Section 9.

Google integrations. When you connect a Google account, Google API information is accessed only within the permissions you grant and for the connected features disclosed to you. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use that information for advertising or transfer it to advertising platforms, data brokers, or information resellers. Human access is restricted to circumstances permitted by that policy, such as your affirmative agreement for specific information, necessary security work, or legal requirements. Google Workspace information is not used to train or improve generalized AI or machine-learning models. These restrictions prevail over broader analytics, improvement, or business-transfer language in this policy. You can revoke access through your Google account settings and contact us to request deletion of previously imported information.

Other integrations operate under the permissions you grant and their applicable provider rules. Review those permissions before connecting a service. A connection may transfer selected information out of the Services to the provider you choose, where its privacy policy applies.

13Children and third party services

The Services are intended for general consumer and business use and are not directed to children under 13. We do not knowingly collect information directly from children under 13 without legally required authorization. Where local law requires a higher age or parental authorization, those requirements apply. If you believe a child has provided information without the required authorization, contact us so we can investigate and take appropriate action.

Schools, parents, and meeting organizers must have the necessary authority before submitting children's information. A classroom use case does not by itself establish that the Services satisfy requirements for student records or regulated educational data.

Our Services may link to independent websites, retailers, meeting platforms, or apps. Their processing is governed by their own notices. This policy does not control information you independently give those parties or restrict their lawful obligations, but it continues to govern processing for which AIOSO is responsible.

14Changes to this policy

We may revise this policy as products, processing practices, or legal requirements change. The revised policy will display an updated date. We provide additional notice of material changes and obtain fresh consent when applicable law requires it. A policy update does not by itself authorize a new use of information that legally requires your consent.

15Contact AIOSO LLC

For questions, privacy requests, complaints, or help identifying the provider responsible for your information, contact:

AIOSO LLC

Email: hello@oso8.com

Website: https://oso8.com/

Contact page: https://oso8.com/pages/contact

Please use "Privacy request" or "Privacy opt-out" in your subject line so we can route your message appropriately.