Privacy Policy

1. Introduction

Sauna Labs, Inc. ("the Company," "we," "us," or "our") operates the website saunalabs.org and the Sauna Labs workflow automation platform (the "Service"). Sauna Labs observes how operations and revenue teams complete recurring work across connected tools such as Salesforce, HubSpot, Notion, Slack, Linear, Gmail, Airtable, and Intercom, then builds playbooks that handle the assembly steps while leaving every judgment call to the person on the team.

This Privacy Policy explains what information we collect in connection with that service, how we use it, and the choices you have. It applies to information collected through saunalabs.org, the platform interface, and direct communications with us.

The Company is based at 150 Varick Street, Floor 6, New York, NY 10013 and can be reached at [email protected].

2. Information We Collect

2.1 Information You Provide

We collect information you submit directly, including:

• Contact details (name, work email, phone) when you register for an account, request early access, or contact us;
• Company information you choose to share (employer name, team size, role, tools in your stack);
• Account credentials (email address and hashed password) for platform access;
• The content of any messages you send us through forms or email.

2.2 Workflow and Tool Activity Data

When you connect Sauna Labs to your tools and authorize the observation layer, we receive and process:

• Event sequences describing which actions were performed across which connected tools, and in what order, to complete a recurring workflow;
• Metadata about those actions (timestamps, tool identifiers, field names, record types) that allows Sauna Labs to recognize a repeating pattern;
• The content of playbooks we build from those patterns, including step descriptions and the tool targets for each automated step.

Sauna Labs does not retain the substantive business content of records in third-party tools (for example, the body of a CRM deal or an email draft) beyond the time needed to execute a specific playbook run. We process that content transiently to carry out the step, and it is not retained in our databases.

We do not use workflow activity data to train AI or machine learning models for purposes beyond delivering the Sauna Labs service to your team.

2.3 Information Collected Automatically

When you visit saunalabs.org, we automatically collect limited technical information:

• IP address and approximate location (city/region level);
• Browser type, operating system, device class;
• Pages visited, referring URLs, time on page;
• Cookie and similar identifiers (see Section 5).

2.4 We Do Not Knowingly Collect Children's Data

saunalabs.org is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

3. How We Use Information

We use the information we collect to:

• Provide, operate, and improve the Sauna Labs workflow automation platform;
• Recognize recurring workflow patterns from connected tool activity and generate playbooks;
• Execute automated steps in playbooks across your connected tools on your behalf;
• Respond to inquiries and support requests;
• Send account-related communications and, with your consent where required, product update emails;
• Detect, investigate, and prevent fraud, abuse, or security incidents;
• Comply with legal obligations.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see your state's section below.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf (hosting, email delivery, analytics, payment processing) under contractual confidentiality terms;
• The third-party tools you have connected to Sauna Labs, solely to execute playbook steps you have authorized;
• Authorities, when required by law or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, remember preferences, and measure usage. For details and choices, see our Cookie Policy.

6. Data Retention

We retain personal information only as long as needed for the purposes described, to comply with legal or accounting obligations, and to resolve disputes.

• Account and profile information: retained while your account is active and for 12 months after closure, unless a longer period is required by law;
• Workflow pattern and playbook data: retained while your account is active; you may delete individual playbooks at any time from the platform;
• Transient tool content processed during playbook execution: not retained in our databases after the step completes;
• Marketing-list contacts who have not engaged: purged after 24 months;
• Server access logs: retained 90 days, then aggregated.

7. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including TLS encryption in transit, restricted-access databases, and least-privilege access controls. No system is perfectly secure; we cannot guarantee absolute security. If you believe your account has been compromised, contact [email protected] immediately.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law.

9. New York Residents

New York does not currently have a comprehensive consumer privacy statute. As a matter of policy, we extend the following baseline rights to all U.S. residents regardless of state of residence.

9.1 Baseline Rights

• Right to Know: request the categories of personal information we have collected about you.
• Right to Delete: request deletion of personal information you have provided.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Marketing: unsubscribe from marketing emails or opt out via the link in each marketing message.

9.2 How to Exercise

Email [email protected] with a description of your request and enough detail for us to verify your identity. We respond within 45 days.

9.3 Sector-Specific Rights

If you are protected by federal sector laws (e.g., HIPAA, GLBA, FERPA), those laws may give you additional rights with respect to data covered by them. Sauna Labs does not specifically target healthcare or financial services verticals, but team workflow data submitted through your connected tools may be subject to the sector-specific obligations your organization holds independently of this Policy.

9.4 California Visitors

If you are a California resident, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. We do not sell personal information and do not "share" personal information for cross-context behavioral advertising.

To submit a CCPA / CPRA request, email [email protected] with the subject line "California Privacy Request."

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.

11. Contact

Questions, requests, or complaints about this Policy can be sent to: