Effective Date: January 1, 2026

Last Updated: March 17, 2026

This Privacy Policy describes how Smooth Labs, Inc., a Delaware corporation doing business as Conntinuum (“Company,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you visit our website at conntinuum.com (the “Site”), use the SparkXplorer conversational AI experience, or interact with our other services, features, and functionality (collectively, the “Services”).

This Privacy Policy also describes your choices regarding your personal information, including your rights under the General Data Protection Regulation (“GDPR”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and other applicable privacy laws.

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices described herein, please do not access or use the Services.

Privacy at a Glance

• We collect only what we need to deliver our Services and improve your experience.
• Your product ideas and session data belong to you. We process them to deliver your session and never sell them to third parties.
• SparkXplorer sessions use AI processing (Anthropic) and real-time video technology (Tavus). We explain exactly how your data flows through these systems below.
• You have rights over your data — including access, correction, deletion, and portability — and we honor them.
• We do not sell your personal information. Period.

1. INFORMATION WE COLLECT

1.1 Information You Provide to Us.

• Contact and registration data: name, email address, company name, role/title, and other information you submit through forms on the Site (hosted by HubSpot, Inc.).
• SparkXplorer session inputs: product ideas, business descriptions, strategic concepts, and other content you share during a SparkXplorer session (“Your Inputs”).
• Video and audio data: real-time video and audio streams transmitted during SparkXplorer sessions via Tavus’s Conversational Video Interface using WebRTC technology.
• Contact inquiry data: inquiry type, message content, and other information submitted through our contact form.
• Communications data: information contained in emails, messages, or other communications you send to us.
• Payment data: when subscription services become available, payment information processed by Stripe, Inc. We do not directly store payment card numbers.

1.2 Information Collected Automatically.

• Device and browser data: IP address, browser type and version, operating system, device type, screen resolution, language settings, and unique device identifiers.
• Usage data: pages visited, time spent on pages, click patterns, navigation paths, referring URLs, and other interaction data collected through HubSpot analytics and Google Analytics 4.
• Cookie data: information collected through cookies, pixels, and similar tracking technologies as described in Section 6 below.
• Session metadata: SparkXplorer session duration, persona selected, session completion status, and other non-content session data used for analytics and service improvement.

1.3 Information From Third-Party Sources.

We may receive information about you from third-party sources, including HubSpot (enriched contact data), public sources (company information from public records), and marketing partners (event co-sponsors or affiliate partners). We combine this information with information we collect directly to maintain accurate records and improve the relevance of our communications.

2. HOW WE USE YOUR INFORMATION

We use the personal information we collect for the following purposes:

2.1 Service Delivery.

• To provide, operate, and improve the Services, including delivering SparkXplorer sessions and generating Vision Board outputs.
• To personalize your experience, including personalizing SparkXplorer sessions based on the name, company, and role you provide.
• To respond to your inquiries, requests, and feedback.
• To process transactions and manage subscription services when available.

2.2 Communications.

• To send you service-related communications, including session summaries, Vision Board delivery, and account notifications.
• To send marketing communications, including product updates, educational content, and promotional materials. You may opt out of marketing communications at any time.
• To send email sequences following SparkXplorer sessions, as described in our Terms and Conditions.

2.3 Analytics and Improvement.

• To analyze usage patterns and improve the Services, including the SparkXplorer experience and the Conntinuum platform.
• To generate anonymized and aggregated insights from session data to improve our AI models and methodology, provided such data does not identify you or Your Inputs.
• To monitor and improve the security and performance of the Services.

2.4 Legal and Compliance.

• To comply with applicable laws, legal processes, and regulatory requirements.
• To enforce our Terms and Conditions and protect the rights, property, and safety of Smooth Labs, Inc. and others.
• To detect, prevent, and address fraud, security issues, and technical problems.

3. SPARKXPLORER SESSION DATA PROCESSING

SparkXplorer sessions involve the processing of your data by multiple service providers. We believe in full transparency about how your data moves through our systems. The following describes the data flow for a SparkXplorer session:

 

Important Notes on SparkXplorer Data Processing:

• Tavus processes video and audio data in accordance with its Privacy Policy (tavus.io/privacy-policy). Tavus may collect biometric data (facial geometry, voiceprints) as part of the real-time video interaction. By initiating a SparkXplorer session, you consent to this processing as described in Tavus’s Biometric Data Policy.
• Anthropic processes conversation data through its commercial API under terms that prohibit use of API customer data for model training. As of September 2025, Anthropic’s standard API data retention is thirty (30) days, after which inputs and outputs are deleted. Anthropic retains User Safety classifier results to enforce its Usage Policy. Zero Data Retention arrangements may be available for qualifying enterprise customers.
• We do not record or retain the video or audio stream from your SparkXplorer session. The real-time video interaction is processed by Tavus and is not stored on our servers.
• Session recordings: If we introduce an option to record sessions in the future, recording will require your separate, explicit opt-in consent before the session begins.

4. HOW WE SHARE YOUR INFORMATION

We do not sell your personal information. We share your information only in the following circumstances:

4.1 Service Providers (Sub-Processors).

We share personal information with third-party service providers who process data on our behalf to help us deliver the Services. Our current sub-processors include:

• HubSpot, Inc. — CRM, form hosting, email communications, marketing automation, and website analytics.
• Tavus, Inc. — Real-time conversational video AI technology for SparkXplorer sessions.
• Anthropic, PBC — AI language model technology (Claude API) for session processing and output generation.
• Google LLC — Google Analytics 4 for website usage analytics.
• Stripe, Inc. — Payment processing for future subscription services.
• Website hosting provider — HubSpot CMS or designated hosting service.

Each sub-processor is contractually obligated to process your data only for the purposes we specify and to maintain appropriate security measures.

4.2 Legal Requirements.

We may disclose your information if required to do so by law or in response to valid legal process, including subpoenas, court orders, or government requests.

4.3 Business Transfers.

In connection with a merger, acquisition, sale of assets, or other business transaction, your personal information may be transferred to the acquiring entity. We will notify you of any such change in ownership or control.

4.4 Protection of Rights.

We may disclose your information to protect the rights, property, or safety of Smooth Labs, Inc., our users, or others, including to enforce our Terms and Conditions.

4.5 With Your Consent.

We may share your information with third parties when you have given us explicit consent to do so.

5. DATA RETENTION

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

• Contact and CRM data: Retained for the duration of the contact relationship and for a reasonable period thereafter for re-engagement purposes, unless you request deletion.
• SparkXplorer session content (Your Inputs and outputs): Retained for service delivery purposes and deleted upon your verified request.
• Session metadata: Anonymized after twenty-four (24) months. Anonymized and aggregated data may be retained indefinitely.
• Website analytics data: Retained in accordance with HubSpot and Google Analytics retention settings (typically 14–26 months for user-level data).
• Payment data: Retained by Stripe in accordance with its data retention policies and applicable financial record-keeping requirements.
• Email communications: Marketing consent records retained for the duration of the relationship. Transactional emails retained per applicable record-keeping requirements.

When we no longer require your personal information, we will delete or anonymize it. If deletion is not immediately possible (for example, because data is stored in backup archives), we will securely isolate your information from further processing until deletion is possible.

6. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to collect information about your interaction with the Services. Our use of cookies falls into the following categories:

6.1 Essential Cookies.

These cookies are necessary for the Site to function and cannot be disabled. They include session cookies required for form submissions, security cookies for fraud prevention, and cookies required for the SparkXplorer form gate functionality.

6.2 Analytics Cookies.

We use HubSpot analytics cookies and Google Analytics 4 to understand how visitors interact with the Site. These cookies collect information such as pages visited, time on site, click patterns, and referral sources. This data is used to improve the Services and optimize the user experience.

6.3 Marketing Cookies.

We may use cookies to deliver relevant marketing communications, measure the effectiveness of marketing campaigns, and track conversions from advertising channels. These cookies may be set by third-party advertising partners.

6.4 Cookie Consent.

When you first visit the Site, you will be presented with a cookie consent banner that allows you to accept or reject non-essential cookies. You may update your cookie preferences at any time through our cookie settings, accessible via the link in the Site footer. Essential cookies cannot be disabled as they are required for the Site to function.

7. DATA SECURITY

We implement appropriate technical and organizational measures designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL.
• Encryption of data at rest using industry-standard encryption.
• Access controls and role-based permissions for internal access to personal data.
• Regular security assessments and vulnerability monitoring.
• Contractual data protection obligations on all sub-processors.
• Tavus API keys and session tokens are never exposed in client-side code.
• Rate limiting on session creation to prevent abuse.

While we strive to protect your personal information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, and you acknowledge that you provide your information at your own risk.

8. YOUR RIGHTS UNDER THE GDPR (EUROPEAN USERS)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the GDPR with respect to your personal data:

• Right of access: You have the right to request a copy of the personal data we hold about you.
• Right to rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to erasure (“right to be forgotten”): You have the right to request deletion of your personal data, subject to certain legal exceptions.
• Right to restriction of processing: You have the right to request that we restrict the processing of your personal data under certain circumstances.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object: You have the right to object to processing of your personal data based on our legitimate interests.
• Rights related to automated decision-making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. SparkXplorer outputs are generated by AI and are informational only; they do not produce legal or similarly significant effects.

8.1 Legal Bases for Processing (GDPR).

We process your personal data on the following legal bases:

• Contract performance: Processing necessary to deliver the Services you have requested, including SparkXplorer sessions and Vision Board delivery.
• Legitimate interests: Processing necessary for our legitimate interests, including analytics, service improvement, security, and marketing (where not overridden by your rights).
• Consent: Processing based on your specific consent, including marketing communications and non-essential cookies.
• Legal obligation: Processing necessary to comply with applicable laws and regulations.

8.2 International Data Transfers.

Your personal data may be transferred to and processed in the United States, where Smooth Labs, Inc. and its sub-processors are located. We ensure appropriate safeguards for international transfers, including Standard Contractual Clauses (SCCs) approved by the European Commission, and we assess the data protection laws of recipient countries.

9. YOUR RIGHTS UNDER THE CCPA/CPRA (CALIFORNIA RESIDENTS)

If you are a California resident, you have the following rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act:

• Right to know: You have the right to request information about the categories and specific pieces of personal information we have collected, the purposes for collection, and the categories of third parties with whom we share it.
• Right to delete: You have the right to request deletion of personal information we have collected from you, subject to certain legal exceptions.
• Right to correct: You have the right to request correction of inaccurate personal information.
• Right to opt-out of sale/sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes.
• Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.
• Right to limit use of sensitive personal information: To the extent we collect sensitive personal information, we use it only for purposes permitted under the CCPA/CPRA.

9.1 Categories of Personal Information Collected.

In the preceding twelve (12) months, we have collected the following categories of personal information as defined by the CCPA/CPRA: identifiers (name, email, IP address); commercial information (inquiry type, subscription data when applicable); internet or network activity (browsing history, interaction with the Site); professional or employment-related information (company, role/title); audio, electronic, and visual information (video and audio during SparkXplorer sessions); and inferences drawn from the above.

9.2 Do Not Sell or Share.

We do not sell personal information as defined by the CCPA/CPRA. We do not share personal information for cross-context behavioral advertising. We honor the Global Privacy Control (GPC) signal as a valid opt-out request under the CCPA/CPRA.

10. CHILDREN’S PRIVACY

The Services are not directed at or intended for use by individuals under the age of eighteen (18). We do not knowingly collect personal information from children under eighteen (18). If we become aware that we have collected personal information from a child under eighteen (18), we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a child, please contact us at privacy@conntinuum.com.

11. THIRD-PARTY LINKS AND SERVICES

The Services may contain links to third-party websites, services, or resources that are not owned or controlled by us. We are not responsible for the privacy practices of such third parties. We encourage you to review the privacy policies of any third-party services you access through links on our Site. Key third-party privacy policies relevant to our Services include:

• Tavus Privacy Policy: tavus.io/privacy-policy
• Anthropic Privacy Policy: anthropic.com/privacy
• HubSpot Privacy Policy: legal.hubspot.com/privacy-policy
• Stripe Privacy Policy: stripe.com/privacy
• Google Privacy Policy: policies.google.com/privacy

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. If we make material changes, we will notify you by updating the “Last Updated” date and, where appropriate, by providing additional notice (such as a banner on the Site or an email notification). Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.

13. CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at:

Smooth Labs, Inc.

Doing business as Conntinuum

Email: privacy@conntinuum.com

Website: conntinuum.com

For data subject rights requests (access, deletion, correction, portability), please email privacy@conntinuum.com with the subject line “Data Subject Request.” We will respond to all verified requests within thirty (30) days, or within the timeframe required by applicable law.