Privacy Policy

1. Hey Sammi Services; Teams and Users

The Services may be used to organize and manage sports teams and organizations; maintain rosters of athletes participating in sports activities (each, a "Player"); manage registrations and payments; receive and process team schedules; create reminders and planning information; connect supported calendars; and communicate with parents, guardians, coaches, Team Admins, and other authorized participants.

Our Users

The Services may involve the following people and roles:

• Registered User: A person who creates or uses a Sammi account or otherwise enrolls in the Services, including a parent, guardian, coach, or other authorized adult.
• Team Admin: A Registered User, organization, coach, manager, or authorized designee with administrative access to manage one or more teams, rosters, registrations, payments, schedules, communications, and related team information.
• Player: An athlete whose roster, registration, scheduling, or related information is managed through the Services. A Player does not need to be a Registered User.

Team and User Content

Users and Team Admins may submit or maintain information relating to teams, Players, schedules, registrations, payments, and team communications (collectively, "Team Content"). Team Content is made available only as needed to provide the Services and as directed or authorized by the applicable User, Team Admin, or organization. Sammi does not provide public fan pages, public forums, or public content channels.

Team Admins and organizations are responsible for having the authority to provide Player and roster information to Sammi and for determining which authorized users may access Team Content. Depending on the circumstances, Sammi may process Team Content on behalf of a Team Admin or organization.

2. How We Collect Information

We may collect information:

• Directly from you, including through our website, account onboarding, forms, email, customer support, and text messages.
• From Team Admins, organizations, parents, guardians, coaches, and other authorized users who provide roster, registration, scheduling, payment, or team information.
• Through your use of the Services, including account activity, website activity, and interactions with messages and features.
• From supported calendar providers when you affirmatively connect a calendar, as described in Section 4.
• From sports schedule providers, team-management platforms, and other third-party services when you provide a schedule link, file, screenshot, message, or authorization that enables Sammi to access the information.
• From payment processors, analytics providers, advertising platforms, and other service providers that support our operations.
• From social media platforms and marketing partners when you interact with our pages, advertisements, or campaigns, subject to your settings and applicable law.

3. Categories of Information We Collect

Information You or Other Authorized Users Provide

• Account and Contact Information: Name, email address, phone number, mailing address, account credentials, notification preferences, subscription status, and similar account information.
• Player and Roster Information: Player name, age or date of birth, gender or team designation, parent or guardian information, contact details if provided, team assignment, roster status, registration information, and relationships between Players and authorized adults.
• Team and Organization Information: Team or organization name, sport, age group, season, time zone, location, coaches, Team Admins, and authorized team participants.
• Schedule and Event Information: Practice, game, tournament, meeting, and other event titles, dates, times, locations or addresses, notes, schedule changes, cancellations, reminders, and related instructions.
• Registration and Transaction Information: Registration selections, fees, transaction amount, payment date, payment status, purchase history, refunds, and limited payment-method information. Payments may be processed by a third-party payment processor. Sammi does not necessarily receive or store your full payment-card number.
• Communications: Text messages, emails, support requests, feedback, survey responses, corrections, and private team communications sent through or in connection with the Services.
• Calendar Information: Information received through Google Calendar or Microsoft Outlook when you connect a calendar, as described in Section 4.
• Online Activity and Device Information: Information collected through cookies, pixels, analytics tools, and similar technologies, as described in Section 5.

Information Received From Team Admins, Organizations, and Other Users

A Team Admin, organization, parent, guardian, coach, or other authorized user may provide Personal Information about you or a Player, including roster, eligibility, registration, payment, scheduling, contact, and relationship information. If you provide information about another person, you represent that you have the authority and any consent required to provide that information and permit Sammi to process it as described in this Privacy Policy.

De-identified and Aggregated Information

We may aggregate or de-identify information that was not obtained through Google Workspace APIs or Microsoft APIs and use it for analytics, research, service improvement, marketing measurement, and other lawful business purposes. We will not attempt to re-identify information that applicable law requires us to maintain in de-identified form.

This provision does not apply to Google Calendar Data or Microsoft Calendar Data. Those data are governed by the stricter restrictions in Section 4, including restrictions on advertising, sale, transfer, and artificial-intelligence or machine-learning training.

4. Calendar Integrations: Google Calendar and Microsoft Outlook

This Section applies specifically to data received through the Google Calendar API and Microsoft Graph calendar APIs. For purposes of this Privacy Policy, "Google Calendar Data" includes raw information received through Google Calendar APIs and information derived, aggregated, or anonymized from that information. "Microsoft Calendar Data" includes raw information received through Microsoft APIs and information derived, aggregated, or anonymized from that information. Google Calendar Data and Microsoft Calendar Data are collectively referred to as "Calendar Data."

If another provision of this Privacy Policy conflicts with this Section, this Section controls with respect to Calendar Data.

4.1 Google Calendar Permission

When you choose to connect Google Calendar, Sammi requests only the following Google Calendar authorization scope:

https://www.googleapis.com/auth/calendar.events.owned

This scope permits Sammi to see, create, change, and delete events on Google calendars owned by the user. Sammi does not use this integration to access Gmail, Google Drive, Google Contacts, Google Photos, or other Google Workspace data. Sammi does not request permission to manage calendar-sharing settings or to access events on calendars the user does not own.

4.2 Microsoft Outlook Permission

When you choose to connect Microsoft Outlook, Sammi requests the Microsoft Graph delegated permission Calendars.ReadWrite. This permission allows Sammi, on behalf of the signed-in user, to create, read, update, and delete events in the user's calendars. Sammi does not request Microsoft Graph permission to read email messages, contacts, files, or other Microsoft account content through this calendar integration.

4.3 Calendar Event Data Accessed

Sammi accesses only calendar event data reasonably necessary to provide the calendar and scheduling features you request. Depending on the event, this may include:

• Event title and description or notes.
• Event date, start time, end time, and time zone.
• Event location or address.
• Recurrence information, reminders, and event status.
• Calendar and event identifiers needed to synchronize, update, or delete an event.

Sammi does not receive or store your Google or Microsoft password.

4.4 How Sammi Uses Calendar Data

Sammi uses Calendar Data only to provide or improve user-facing features requested by the user, including:

• Adding practices, games, tournaments, meetings, and related sports events to the user's calendar.
• Reading calendar events to maintain an accurate family schedule and identify potential scheduling conflicts.
• Keeping calendar events synchronized with team schedules and schedule changes.
• Updating or deleting calendar events when a schedule changes, an event is canceled, or the user requests the action.
• Providing daily or weekly planning information, reminders, event locations, travel-time information, and weather information related to scheduled events.

Sammi does not use Calendar Data to develop unrelated products, create marketing profiles, determine creditworthiness, make lending or insurance decisions, or conduct unrelated research.

4.5 Storage of Calendar Data and OAuth Tokens

Google and Microsoft OAuth access and refresh tokens are stored in Sammi's PostgreSQL database. The tokens enable Sammi to perform the calendar actions authorized by the user without receiving or storing the user's Google or Microsoft password.

Sammi may store the event data needed to synchronize schedules, monitor changes, provide reminders, identify conflicts, and maintain the user-facing features requested by the user. Access to Calendar Data and OAuth tokens is restricted to systems, service providers, and personnel that reasonably need access to operate, secure, maintain, or support the Services, subject to the restrictions in this Section.

4.6 Disconnecting a Calendar

You may disconnect Google Calendar or Microsoft Outlook from Sammi at any time. When you disconnect a calendar through Sammi, the associated OAuth tokens are deleted immediately from Sammi's active systems, Sammi stops retrieving new information from that calendar, and Sammi can no longer create, read, update, or delete events through that connection.

Disconnecting a calendar does not automatically delete events that Sammi previously created in Google Calendar or Microsoft Outlook. You may delete those events directly in the applicable calendar. Stored event data within Sammi remains subject to the deletion practices below, and you may request its deletion at any time by contacting privacy@heysammi.com.

You may also revoke access through your Google Account's third-party connections controls or through Microsoft's permissions-management pages. Revoking access through the provider makes Sammi's authorization unusable; you may also disconnect through Sammi or contact us to request deletion of the stored token and Calendar Data.

4.7 Unsubscribing and Immediate Calendar Deletion

When a user unsubscribes from Sammi, including by replying STOP to Sammi text messages or otherwise ending the Sammi service, Sammi immediately deletes the user's stored Google Calendar event data, Microsoft Calendar event data, and associated Google and Microsoft OAuth tokens from its active systems. Sammi then stops accessing, synchronizing, creating, updating, or deleting events through those connections.

After a user unsubscribes, Sammi may retain only the user's phone number and a short internal note indicating that the person was a previous customer or has unsubscribed. This minimal record may be retained to recognize prior customers, maintain appropriate business records, and honor communication and opt-out preferences. It does not include Calendar Data or OAuth tokens.

A user may request deletion of the remaining phone number and previous-customer note by contacting privacy@heysammi.com. We may retain only the limited information required by law or reasonably necessary to prevent fraud, resolve disputes, maintain tax or accounting records, or honor an opt-out request.

Deleting Calendar Data does not automatically delete separate roster, registration, transaction, or team records maintained by a Team Admin or organization, or records Sammi must retain for legal, accounting, security, or dispute-resolution purposes. Calendar Data and OAuth tokens remain subject to the stricter deletion rules in this Section.

4.8 Inactive Users

After 60 days of inactivity, Sammi contacts the user to ask whether the user wants to continue using the Services. If the user confirms that the Services are no longer wanted, Sammi immediately deletes the user's stored Calendar Data and associated OAuth tokens from its active systems.

If the user does not respond within 30 additional days, Sammi deletes the stored Calendar Data and associated OAuth tokens from its active systems. This means Calendar Data and OAuth tokens are deleted no later than approximately 90 days after the account becomes inactive, unless the user resumes using the Services before deletion.

After deletion for inactivity, Sammi may retain only the user's phone number and a short previous-customer note, subject to the same limitations described above.

4.9 No Advertising, Sale, or Independent Third-Party Use

Sammi does not sell or rent Calendar Data. Sammi does not use or transfer Calendar Data for advertising, targeted advertising, retargeting, interest-based advertising, marketing profiles, data-broker activities, information-reseller activities, lending, creditworthiness decisions, or any third party's independent purposes.

These restrictions apply to raw Calendar Data and to data derived, aggregated, or anonymized from Calendar Data. Calendar Data is excluded from the advertising, analytics-sharing, data-extract, and marketing disclosures described elsewhere in this Privacy Policy.

4.10 Artificial Intelligence and Machine-Learning Restrictions

Google Calendar Data and Microsoft Calendar Data are not sent to OpenAI or any other artificial-intelligence or machine-learning service. Sammi does not use raw, derived, aggregated, or anonymized Calendar Data to develop, train, retrain, fine-tune, evaluate, or improve any artificial-intelligence or machine-learning model. Sammi does not transfer Calendar Data to a third-party service for that service to train, develop, fine-tune, evaluate, or improve an artificial-intelligence or machine-learning model.

4.11 Limited Service-Provider and Human Access

Sammi may permit a service provider to process limited Calendar Data only when necessary to provide or improve a user-facing Sammi feature requested by the user, maintain the underlying database or infrastructure, deliver notifications, protect the Services, or provide technical support. Such providers may process Calendar Data only on Sammi's behalf and may not sell it, use it for advertising, use it to build independent profiles, or use it for unrelated purposes.

Sammi personnel do not access Calendar Data except when reasonably necessary to provide user-authorized support, investigate a security or technical issue, comply with applicable law, or operate, secure, maintain, or improve the user-facing calendar features requested by the user.

4.12 Google Limited Use Compliance

Hey Sammi's use and transfer of information received from Google Workspace APIs, including Google Calendar API data, will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.13 Microsoft API Compliance and Revocation

Hey Sammi uses Microsoft Calendar Data only within the permissions granted by the user and in accordance with applicable Microsoft API terms. Users may revoke Microsoft permissions at any time through the Microsoft account consent-management page or, for organizational accounts, the My Apps portal. Users may also disconnect Microsoft Outlook through Sammi or contact privacy@heysammi.com.

5. Online User Activity

We and our vendors may use cookies, pixels, software development kits, local storage, and similar technologies (collectively, "Activity Tools") to collect information about your use of our website, Services, and online marketing channels. Activity Tools may collect:

• Usage details, such as pages viewed, links clicked, visit dates and times, session length, referring pages, and interactions with our website or advertisements.
• Device and network information, such as Internet Protocol address, browser type, operating system, device type, language, and identifiers associated with cookies or advertising technologies.
• Approximate location derived from an Internet Protocol address. Sammi does not collect precise device GPS location through the Services. Event or venue addresses submitted for scheduling and travel planning are treated as schedule information, not continuous device-location tracking.

We use Activity Tools to operate and secure the Services, remember preferences, understand site usage, measure campaign performance, and deliver or measure advertisements. We use technologies including Meta Pixel and Google Ads remarketing or similar tools that may support cross-context behavioral advertising. Calendar Data and Player or roster information are not provided to Activity Tools or used for targeted advertising. You may manage cookies through our cookie banner and browser settings. Where required by law, we honor recognized Global Privacy Control signals as requests to opt out of sale, sharing, or targeted advertising for the browser and device sending the signal.

6. Children's Information

The Services are intended for parents, guardians, coaches, Team Admins, organizations, and other adults. Children under 13 may not independently create an account or enroll in the Services. A parent, guardian, Team Admin, coach, or organization may provide limited Personal Information about a child or Player when reasonably necessary to maintain a roster, process a registration or payment, manage a team schedule, communicate with an authorized adult, or provide the Services. Such information may include a Player's name, age or date of birth, gender or team designation, parent or guardian details, team assignment, registration status, and event information.

By providing information about a child, the submitting adult or organization represents that it has the authority and any consent required to provide the information and permit its use as described in this Privacy Policy.

We do not knowingly collect Personal Information directly from a child under 13 without verifiable parental consent. A parent or guardian who believes Sammi has received a child's information without appropriate authorization may contact privacy@heysammi.com to request review or deletion.

We do not sell Player Data or use information about children or Players for targeted advertising.

7. How We Use Personal Information

We may use Personal Information for the following purposes:

• Provide, operate, maintain, and support the Services.
• Create and manage accounts, teams, organizations, rosters, registrations, subscriptions, and user preferences.
• Process schedules, schedule changes, reminders, calendar actions, event locations, weather, and travel-time information.
• Process payments, registration fees, refunds, and related transactions.
• Facilitate authorized communications among parents, guardians, coaches, Team Admins, organizations, and other team participants.
• Respond to questions, requests, corrections, and customer-support matters.
• Operate surveys, promotions, waitlists, referral programs, and feedback programs.
• Monitor reliability, usage, security, and performance; diagnose errors; prevent fraud or abuse; and protect users and the Services.
• Analyze and improve user-facing features, communications, onboarding, and business operations.
• Send service-related notices and, where permitted, marketing communications about Sammi.
• Measure and improve advertising and marketing campaigns using website and independently collected marketing data.
• Comply with law, enforce our agreements, and establish, exercise, or defend legal claims.

We may combine information obtained from different non-calendar sources. When we combine information with Personal Information, we treat the combined information as Personal Information. Calendar Data is used only as described in Section 4. Player Data and roster information are not used for targeted advertising.

8. How We Disclose Personal Information

We may disclose Personal Information in the following circumstances:

8.1 Team Admins, Organizations, and Authorized Team Users

We may provide team, roster, registration, payment-status, schedule, and contact information to the applicable Team Admin, organization, parent, guardian, coach, or other authorized participant as needed to provide the Services and according to the access configured by the Team Admin or organization. Team Admins and organizations may have their own privacy practices and legal obligations. Contact the applicable Team Admin or organization for information about its independent use of Team Content.

8.2 Service Providers

We may disclose information to vendors that perform services on our behalf, such as website and application hosting, database management, text-message and email delivery, payment processing, customer support, security, fraud prevention, mapping, weather, travel-time services, analytics, survey tools, and advertising or marketing technology. Service providers are permitted to use information only as necessary to perform services for Sammi, subject to applicable contracts and law. Calendar Data is subject to the stricter restrictions in Section 4, and Player Data is not provided for targeted advertising.

8.3 At Your Direction

We may disclose information when you direct us to do so, such as when you ask Sammi to send schedule information to a spouse, family member, caregiver, coach, or other person. You are responsible for ensuring that you are authorized to provide the recipient's contact information and direct the communication.

8.4 Legal, Security, and Safety Reasons

We may disclose information when we reasonably believe disclosure is necessary to comply with law or legal process; investigate fraud, abuse, or a security incident; enforce our agreements; protect the rights, safety, or property of Sammi, users, or others; or respond to an emergency.

8.5 Affiliates and Business Transactions

We may disclose information to our corporate affiliates for legitimate business and operational purposes. Information may also be transferred in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction. Any transfer of Calendar Data remains subject to Section 4 and applicable Google and Microsoft requirements, including any required consent.

8.6 Advertising and Analytics Partners

As described in Sections 5 and 9, we may disclose website identifiers, Online User Activity, and related marketing information to analytics and advertising partners through cookies, pixels, and similar technologies. Depending on applicable law, this activity may be considered a sale, sharing, or targeted advertising. We do not disclose Calendar Data, Player Data, roster information, or information about children to advertising partners for targeted advertising.

8.7 SMS Consent Information

We do not sell or share text-message opt-in information or SMS consent records with third parties for their independent marketing or promotional purposes. We may provide phone numbers and messaging information to service providers only as necessary to operate Sammi's text-messaging service.

9. General Advertising

We may use advertising and analytics technologies, including Meta Pixel, Google Ads remarketing, and similar tools, to measure website activity, understand campaign performance, and deliver advertisements to people who may be interested in Sammi.

These technologies may receive online identifiers, cookie identifiers, Internet Protocol addresses, browser or device information, pages viewed, links clicked, and conversion or campaign information. Under some state privacy laws, disclosure of this information for cross-context behavioral advertising may be considered a "sale" or "sharing" of Personal Information even when no money is exchanged.

Calendar Data, Player Data, roster information, and information about children are never used or disclosed for targeted advertising, retargeting, or advertising profiles.

You may opt out through the cookie banner available on our website, by sending a recognized Global Privacy Control signal, or by contacting privacy@heysammi.com where applicable. Browser and device choices may need to be applied separately on each browser or device.

10. Your Privacy Choices

Marketing Communications

You may unsubscribe from marketing emails by using the unsubscribe link in the message. Even after opting out of marketing, we may send non-marketing communications relating to your account, transactions, security, or the Services.

Cookies and Targeted Advertising

You may manage non-essential cookies and targeted-advertising technologies through our cookie banner and browser controls. We endeavor to honor recognized Global Privacy Control signals where required by law.

Text Messages

You may reply STOP to unsubscribe from Sammi text messages. Unsubscribing triggers the Calendar Data and OAuth-token deletion process described in Section 4.7.

Calendar Connections

You may disconnect Google Calendar or Microsoft Outlook through Sammi, revoke access through your Google or Microsoft account controls, or contact privacy@heysammi.com. See Section 4 for the resulting access and deletion practices.

Account and Team Participation

You may request account access, correction, or deletion by contacting support@heysammi.com or privacy@heysammi.com. For Team Content controlled by a Team Admin or organization, you may also need to contact that Team Admin or organization.

11. How to Access, Update, or Delete Your Information

You may request access to, correction of, or deletion of Personal Information by contacting privacy@heysammi.com. You may also update certain account and communication preferences by texting Sammi or using available account settings.

We may need to verify your identity before fulfilling a request. We may deny or limit a request when permitted by law, including when fulfilling it would adversely affect another person's rights, require disproportionate technical effort, interfere with security or fraud prevention, or conflict with legal, tax, accounting, transaction, dispute-resolution, or recordkeeping obligations.

If information is maintained as Team Content under the control of a Team Admin or organization, we may direct you to that Team Admin or organization or coordinate with it to respond to the request.

General retention exceptions do not authorize Sammi to continue using or retaining Calendar Data or associated OAuth tokens after the deletion events described in Section 4, except to the limited extent retention is specifically required by applicable law.

12. Special Notice Regarding Text Messages

When you provide a mobile number and affirmatively consent to receive text messages, you authorize Sammi to send service-related and, where separately permitted, promotional text messages to that number. Message frequency varies based on schedules, preferences, team activity, and use of the Services. Message and data rates may apply.

You represent that the mobile number belongs to you or that you are authorized to use it and receive messages at that number. Notify us if the number changes or is reassigned.

Reply STOP to unsubscribe. We may send one final confirmation message, after which you will no longer receive Sammi messages unless you later provide new consent. Reply HELP for assistance. Participating carriers are not responsible for delayed or undelivered messages.

Consent to receive promotional text messages is not a condition of purchasing the Services. Service-related text messages may be necessary to use a text-based Sammi feature.

13. Security and Retention

Security

We use administrative, technical, and organizational safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, misuse, loss, or destruction. These measures include access controls and security practices appropriate to the nature of the information and the Services.

No method of transmission or storage is completely secure. We cannot guarantee that unauthorized parties will never defeat our safeguards. If we discover a security incident, we will provide notices required by applicable law.

General Retention

We retain Personal Information only for as long as reasonably necessary to provide the Services, maintain an active relationship, process transactions, support teams and rosters, honor communication preferences, protect security, comply with legal and accounting obligations, resolve disputes, and enforce agreements.

Registration, transaction, tax, accounting, fraud-prevention, and dispute records may be retained for the periods required or permitted by law. Team Content may also be retained according to the applicable Team Admin's or organization's instructions and legitimate operational needs.

When a user unsubscribes, the user's Calendar Data and OAuth tokens are deleted as described in Section 4.7. Only the phone number and a short previous-customer or opt-out note may remain, subject to applicable legal exceptions and the user's deletion rights.

Deletion from active systems occurs according to the timelines stated in this Privacy Policy. Residual copies of deleted Calendar Data and associated OAuth tokens may remain in protected backups for up to 90 days after deletion from active systems. These residual copies are not used for active processing and are accessed only when necessary for disaster recovery, security, or legal compliance. They are permanently overwritten or deleted within 90 days through Sammi's routine backup-retention process.

14. Links to Other Websites and Services

The Services may contain links to sports platforms, maps, payment processors, social media platforms, calendar providers, and other third-party websites or services. This Privacy Policy does not govern the independent privacy practices of those third parties. Review the applicable third party's privacy policy before providing information or using its service.

15. Jurisdiction-Specific Notices

15.1 Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia

To the extent the privacy law of your state applies to Sammi and to the information at issue, you may have some or all of the following rights, subject to applicable exceptions:

• Confirm whether we process your Personal Information and request access to or a copy of it.
• Request correction of inaccurate Personal Information.
• Request deletion of Personal Information.
• Request a portable copy of certain Personal Information.
• Request information about the categories of Personal Information collected, sources, purposes, and categories of recipients.
• Opt out of the sale or sharing of Personal Information, targeted advertising, or certain profiling activities, where applicable.
• Appeal a decision we make regarding a privacy request, where applicable.
• Exercise rights without unlawful discrimination.

To submit a request, email privacy@heysammi.com. We may ask for information reasonably necessary to verify your identity and authority. You may use an authorized agent where permitted by law, but we may require proof of authorization and verification of your identity.

You may opt out of cookie-based sale, sharing, or targeted advertising through the cookie banner on our website or by sending a recognized Global Privacy Control signal. You may also contact privacy@heysammi.com. We do not engage in profiling that produces legal or similarly significant effects concerning users.

Deletion requests may be subject to lawful exceptions for matters such as transaction records, tax and accounting obligations, fraud prevention, security, disputes, and legal claims. Those exceptions do not override the specific Calendar Data and OAuth-token deletion commitments in Section 4 except where retention is specifically required by law.

15.2 Residents of California Only

The following table describes categories of Personal Information we may have collected during the preceding 12 months. Whether a category applies to a particular person depends on how the person uses the Services.

California Disclosures, Sharing, and Sale

We may disclose categories A, B, C, D, F, G, I, and L to service providers for business purposes such as hosting, database management, communications, payments, security, analytics, and customer support, as applicable.

We have not sold Personal Information for monetary consideration. Our use of Meta Pixel, Google Ads remarketing, and similar technologies may be considered a sale or sharing under California law. The categories that may be sold or shared through these technologies are A (identifiers) and F (Internet or network activity). The recipients are advertising, marketing, and analytics providers.

Calendar Data, Player Data, roster information, and information about children are not sold or shared for cross-context behavioral advertising.

You may opt out through our cookie banner, a recognized Global Privacy Control signal, or by contacting privacy@heysammi.com. We do not knowingly sell or share the Personal Information of consumers under 16.

We do not generally provide financial incentives in exchange for Personal Information. If we offer a promotion, referral benefit, discount, or loyalty feature that qualifies as a financial incentive under California law, we will provide the required notice and terms at the time of enrollment.

California residents may also request information regarding disclosures of Personal Information to third parties for the third parties' direct-marketing purposes by contacting privacy@heysammi.com.

15.3 Nevada Residents

We do not sell Personal Information as "sale" is defined under Nevada Revised Statutes Chapter 603A. Nevada residents may nevertheless submit a verified request regarding the sale of covered information by emailing privacy@heysammi.com.

15.4 European Residents

This Section applies to individuals in the European Union, European Economic Area, United Kingdom, or Switzerland, and to Personal Information governed by applicable European data-protection law.

Your Rights

Subject to applicable law and exceptions, you may have the right to access, correct, erase, restrict, or object to processing of your Personal Information; receive certain information in a portable format; withdraw consent; and lodge a complaint with a supervisory authority. You may also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Sammi does not currently use such automated decision-making for users.

To exercise a right, contact privacy@heysammi.com. We may verify your identity before responding. If we deny a request, we will provide the reason where required.

Legal Bases

Depending on the context, we process Personal Information based on one or more of the following legal bases:

• Performance of a contract or steps requested before entering into a contract, including providing the Services, processing registrations and payments, and maintaining accounts.
• Consent, including consent to connect a calendar, receive certain communications, or use non-essential advertising technologies where consent is required.
• Legitimate interests, including operating and improving the Services, protecting security, preventing fraud, supporting users, measuring business performance, and marketing Sammi, where those interests are not overridden by the individual's rights.
• Compliance with legal obligations.
• Establishment, exercise, or defense of legal claims.

We do not knowingly process Personal Information directly from a child below the age at which parental consent is required under applicable European law without appropriately verified parental authorization.

International Transfers

Sammi is operated from the United States. When Personal Information governed by European data-protection law is transferred to a country that has not been found to provide adequate protection, we use a lawful transfer mechanism where required, such as standard contractual clauses or another permitted safeguard. You may contact privacy@heysammi.com for more information.

Depending on the circumstances, Sammi may act as a controller or as a processor or service provider on behalf of a Team Admin or organization.

16. International Data Transfers and Use

Sammi is operated from the United States. Personal Information may be stored, processed, or accessed in the United States and other countries where Sammi or its service providers operate. Those countries may have privacy laws that differ from the laws where you live.

We handle Personal Information according to this Privacy Policy and applicable law regardless of where it is processed. Where required, we use appropriate contractual or legal safeguards for cross-border transfers.

17. Privacy Policy Updates

We may update this Privacy Policy to reflect changes in the Services, technology, data practices, legal requirements, or business operations. The revised policy will identify the updated effective date. If a change materially affects how we use Personal Information, we may provide additional notice through the Services, website, email, text message, or another appropriate method.

18. Contacting Us

If you have questions, concerns, or privacy requests, contact:

Privacy: privacy@heysammi.com
Support: support@heysammi.com