Privacy Policy

Introduction

Damascene Labs Inc. (“Damascene Labs,” “we,” “us,” or “our”) operates the website at damascenelabs.com and provides Theo, an AI voice agent that helps businesses answer phone calls and manage appointment scheduling. This Privacy Policy explains what information we collect, how we use it, and the choices available to you. It applies to visitors of our website, businesses that use Theo, and callers who interact with Theo, including callers who receive SMS appointment notifications.

By using our website or interacting with Theo, you agree to the practices described in this Privacy Policy. Read this Policy together with our Terms and Conditions and our SMS Consent and Verbal Opt-In Process page, which describes how we obtain consent for SMS appointment notifications.

Information We Collect

• Website visitors. When you submit your email address through our website (for example, to join our waitlist), we collect that email address. We do not collect any other personal information through the public website beyond the analytics described below.
• Business customers. When a business signs up to use Theo, we collect business contact information, such as a name, email address, phone number, and business details needed to configure the service.
• Callers. When a caller speaks with Theo on behalf of one of our business customers, we and our business customers may collect the caller's phone number, the content of the call (including recordings and transcripts, where applicable), and information the caller provides during the call, such as their name and appointment preferences.
• Mobile and SMS information. If a caller consents to receive SMS appointment notifications, we collect the mobile phone number provided, along with records of the consent itself. See “SMS and Mobile Information” below.

How We Use Information

We use the information we collect to:

• Operate, maintain, and improve our website and Theo
• Respond to inquiries submitted through our website
• Send product updates about Damascene Labs and Theo to individuals who opted in
• Allow business customers to configure Theo and review call activity
• Send appointment-related SMS notifications to callers who have consented, as described below
• Detect, prevent, and investigate fraud, abuse, and security incidents
• Comply with legal obligations

We do not use the information we collect to build advertising profiles, and we do not sell personal information.

Appointment and Scheduling Information

When Theo helps a caller request, confirm, reschedule, or cancel an appointment, we process the information necessary to complete that task on behalf of our business customer. This may include the caller's name, phone number, requested appointment date and time, and any notes the caller provides about the purpose of the appointment. This information is used to fulfill the scheduling request, to send related notifications (including SMS notifications where consented), and to give the business customer a record of the interaction.

Theo is designed to help schedule and manage appointments. It does not evaluate medical, legal, or other professional matters, and any information shared with Theo during a call should be limited to what is needed to schedule or manage an appointment.

SMS and Mobile Information

If you provide verbal consent during a call with Theo, we may send you SMS text messages related to your appointment, including appointment request acknowledgments, confirmations, reminders, rescheduling notifications, and cancellation confirmations. These are informational messages about your appointment, not advertising or promotional marketing messages.

Damascene Labs does not sell, rent, or share mobile phone numbers, SMS opt-in information, or messaging consent with third parties or affiliates for marketing or promotional purposes.

Mobile information may be provided to vendors acting on Damascene Labs' behalf only when necessary to operate the messaging service, deliver the messages you requested, prevent abuse, maintain the security of our systems, or comply with applicable law. Any such vendor is contractually restricted from using your mobile information for its own marketing purposes.

Additional details about SMS:

• SMS consent is optional and is not a condition of purchasing or using Damascene Labs' scheduling services.
• You may opt out of SMS notifications at any time by replying STOP to any message.
• You may reply HELP to any message for assistance.
• Message and data rates may apply.
• Message frequency varies based on your appointment activity.

For the full verbal consent process, see our SMS Consent and Verbal Opt-In Process page. For additional terms governing the SMS program, see our Terms and Conditions.

How We Share Information

We share information only as described in this Policy:

• With the business customer that Theo is representing on a call, so they can manage the appointment and respond to the caller
• With service providers who help us operate our website, communications, and Theo (see “Service Providers” below)
• When required to comply with a law, regulation, subpoena, or other legal process
• To protect the rights, property, or safety of Damascene Labs, our customers, or the public
• In connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations consistent with this Policy

We do not sell personal information, and, as stated above, we do not sell, rent, or share mobile phone numbers, SMS opt-in information, or messaging consent for marketing or promotional purposes.

Service Providers

We work with the following categories of service providers, each of which processes information on our behalf and under contractual confidentiality and use restrictions:

• Email delivery. We use Resend to store and deliver email communications sent to individuals who join our waitlist. Resend acts as a data processor on our behalf. We do not sell or rent your email address, and we do not share it with any party other than Resend for the sole purpose of delivering our communications.
• Analytics. We use PostHog for website analytics. PostHog collects session-level data such as page views, button clicks, and form interactions to help us understand how visitors use the site. Data is stored in your browser's local storage; we do not set tracking cookies, and session recording is disabled. PostHog respects the Do Not Track browser signal: if Do Not Track is enabled, no data is collected.
• Bot and abuse prevention. We use Cloudflare Turnstile to help prevent automated abuse of our website forms.
• Cloud infrastructure. We use cloud infrastructure providers to host our website, applications, and databases securely.
• Messaging and telecommunications. We use SMS and telecommunications platform providers to deliver appointment notifications to callers who have consented.

Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect the information we collect, including encryption in transit, access controls, and secure hosting infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Data Retention

We retain personal information for as long as necessary to provide our services, fulfill the purposes described in this Policy, comply with our legal obligations, resolve disputes, and enforce our agreements. Consent records for SMS notifications (see “How Consent Is Recorded” in our SMS Consent and Verbal Opt-In Process) are retained for as long as necessary to demonstrate compliance with applicable messaging regulations. When information is no longer needed for these purposes, we take reasonable steps to delete or de-identify it.

Your Choices and Rights

• Email communications. You may request deletion of your email address at any time by contacting us at hello@damascenelabs.com. We will remove your data within 7 business days.
• SMS notifications. You may opt out of SMS appointment notifications at any time by replying STOP to any message, or by contacting us at hello@damascenelabs.com.
• Access and correction. You may contact us to request access to, correction of, or deletion of personal information we hold about you, subject to applicable law.
• Do Not Track. Our website honors the Do Not Track browser signal for analytics as described above.

Depending on where you live, you may have additional rights under applicable privacy laws. To exercise any of these rights, contact us at hello@damascenelabs.com.

Children's Privacy

Our website and services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take steps to delete that information.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date at the top of this page. Your continued use of our website or Theo after changes take effect constitutes acceptance of the revised Policy.

Contact Us

If you have questions about this Privacy Policy or how we handle your information, contact us at hello@damascenelabs.com.