Sepia LabsLava Lampa Sepia Labs product

Data Processing Addendum

Last updated: 27 September 2026

This Addendum forms part of the Terms of Service between Sepia Labs LLC (“Sepia Labs”, “we”) and the customer using Sepia (“you”). It governs how we handle personal data you put into the product on behalf of your own clients. Where this Addendum and the Terms disagree about personal data, this Addendum wins.

1. Who is who

For the personal data you load into Sepia — your contacts, leads, guests and clients — you are the controller and we are the processor. You decide what to collect, why, and who to contact. We process it to provide the product and for nothing else.

For your own account data — the people on your team, your billing details, product usage — we are the controller, and our Privacy Policy describes what we do with it.

2. Our instructions

We process your customer data only on your documented instructions, which are: operating the product as you use it, sending the messages you send, running the automations you configure, and doing what support you specifically ask for. We will not sell it, share it for cross-context behavioural advertising, or use it to train AI models.

If a law compels us to process your data some other way, we will tell you first unless that law forbids it.

Sepia does not use your customer data to make decisions about your customers based on profiling or scoring that have legal or similarly significant effects. Automated steps — automations and lead routing you set up, and the product's built-in ticket, waitlist and payment rules — act on the records you hold; you can pause or change the ones you set up, and correct the records any of them touch.

3. What we handle

Categories of data: names, email addresses, phone numbers, postal addresses, message and call content, call recordings and transcripts, appointment and booking records, invoice and payment records, files you upload, and whatever you put into custom fields and notes.

Categories of people: your clients, leads, event guests, document signers and anyone else you record in the product.

Duration: for as long as your account is active, plus the deletion window in section 8.

Sepia is not designed for, and you should not load into it, government identifiers, payment card numbers, or health records subject to HIPAA. Card details go to Stripe directly and never reach our servers.

4. Security

Data is encrypted in transit and at rest. Access is scoped per workspace and enforced at the database layer, not only in the interface. Staff access to production is limited to what is needed to operate and support the service.

We are a small company and we would rather be plain about that than imply a bigger apparatus than exists: we do not currently hold SOC 2 or ISO 27001 certification. If you need one, tell us — it affects what we prioritise.

5. Confidentiality

Anyone who can reach your data is bound by confidentiality obligations that survive the end of their engagement with us.

6. Sub-processors

You authorise the sub-processors listed at sepialabs.ai/legal/subprocessors. Each one is bound by data-protection terms no weaker than these, and we remain responsible to you for what they do.

We will update that page before a new sub-processor begins handling customer data. Ask us and we will email you when it changes. If you object to a new one on reasonable data-protection grounds, tell us within 30 days and we will either find another route or let you terminate the affected part of the service without penalty.

7. Requests from the people in your database

If one of your clients asks us directly for access, correction or deletion, we will not answer for you — we will point them to you, because it is your data and your relationship.

You can action most requests yourself in the product. Where you cannot, email info@sepialabs.ai and we will help you within 10 business days at no charge.

8. Deletion and return

You can export your data at any time while your account is active. Your account closes when you ask us to close it. A lapsed or unpaid subscription does not close it: the workspace stays, possibly suspended, until you bring it current, export your data or delete the workspace. When your account closes, you have 30 days to export; after that we delete your customer data from live systems within 30 days, and from backups within 90 days as those backups age out.

We keep only what law requires us to keep — invoice and transaction records for tax purposes, and consent and opt-out records, which exist precisely to prove someone asked us to stop.

9. If there is a breach

If we discover a personal data breach affecting your data, we will notify you without undue delay and within 72 hours of becoming aware, with what we know: what happened, who is affected, what we are doing, and what we suggest you do. We will not wait until we have a complete picture to tell you something happened.

10. Audits

On reasonable notice, and no more than once a year unless a regulator requires otherwise, we will answer a written security questionnaire and provide the documentation we hold.

11. International transfers

We are in the United States and most of our sub-processors are too. Where personal data moves out of the EEA or UK, the transfer relies on the European Commission's Standard Contractual Clauses and the UK Addendum, which are incorporated here by reference.

12. Liability

The liability limits in the Terms of Service apply to this Addendum, except where the law does not permit them to.

13. Signing this

This Addendum applies automatically to every customer — you do not need to sign anything for it to be in force. If your procurement process needs a countersigned copy, email info@sepialabs.ai and we will send one.

Contact

Sepia Labs LLC
3211 NW 7th Ave Cir
Miami, FL 33127
info@sepialabs.ai