Sepia LabsLava Lampa Sepia Labs product

Privacy Policy

Last updated: 3 November 2026

This policy explains how Sepia Labs LLC (“Sepia Labs”, “we”, “us”), a Florida limited liability company, handles information in connection with Sepia — our CRM and operating platform for client businesses.

Two very different roles

Read this first, because everything below depends on it. Sepia handles information in two distinct capacities, and your rights differ depending on which applies to you.

• As a controller — for our own customers. If you create a Sepia account, we decide how your account and billing information is used, and this policy governs it.
• As a processor — for everything a customer puts into their workspace. When a business uses Sepia to manage its clients, guests, and contacts, that business decides what to collect and why; we process it on their instructions. If you are a guest, attendee, or client of a business that uses Sepia, that business — not Sepia — is your point of contact for access or deletion. We will route requests to them where we can identify the workspace.

Information we collect

Account information (we are the controller)

• Name, email address, authentication credentials, and profile photo.
• Workspace details: business name, industry, branding, team members and their roles.
• Billing information — plan, subscription status, invoices, and usage balances. We do not receive or store full payment card numbers. Card details are collected and held by Stripe.
• Support correspondence you send us.

Workspace content (we are the processor)

Customers use Sepia to store information about the people they work with. Depending on the features they enable, that can include:

• Contact and lead records — names, email addresses, phone numbers, addresses, tags, notes, and activity history.
• Bookings and appointments, including anything a guest enters into a booking form.
• Event RSVPs and ticket purchases — guest name, email, phone, party size, payment status, and door check-in codes.
• Signed documents — the signer’s name, email, the values they enter, their signature image, and an audit trail that records their IP address and browser user agent.
• Messages sent and received through the workspace: email, SMS, and in-app conversations.
• Call records. Where a customer enables call recording, calls are recorded and automatically transcribed, and an AI summary may be produced. See “Calls” below.
• Files, images, and documents uploaded to the workspace.

Technical information

• Log and diagnostic data, including IP address, timestamps, and error reports.
• Abuse-prevention records. For rate limiting we store a hashed form of the request key rather than raw IP addresses.
• Cookies and browser storage that the sites need to work. They keep you signed in, protect sign-in, forms and payments from abuse, take card payments, and remember choices you make. Our Cookie Policy lists every one, with its provider, purpose and duration.
• We do not use advertising or analytics cookies or tracking pixels. To protect sign-in and forms from abuse, we use Google reCAPTCHA Enterprise through Firebase App Check, which collects device and interaction signals under Google’s own privacy terms.
• Videos, music and maps that a business adds to its page come from other companies, such as YouTube, Spotify and Google Maps. They load only when you tap them or allow “Embedded media” in Cookie settings. Once loaded, that company’s own privacy terms apply.
• When you create an account, a record that you confirmed your age (18 or older for a business account, 13 or older for a Lava Lamp ticket account) and agreed to our Terms and this policy: which versions, when, where in the product, and a one-way hash of your IP address.

How we use information

• To provide, secure, and support the platform.
• To process payments, subscriptions, and usage charges.
• To send transactional messages — confirmations, reminders, receipts, and service notices.
• To detect, investigate, and prevent fraud, abuse, and security incidents.
• To meet legal, tax, accounting, and telecommunications-carrier obligations.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We do not share mobile opt-in data or consent with third parties for their own marketing or promotional purposes.

Sale, sharing and Global Privacy Control

We do not sell personal information. We do not share it for cross-context behavioral advertising, as California law uses those words. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a valid request to opt out of sale and sharing for that browser. We will not turn on marketing cookies while it is on. If we ever start using a marketing cookie or pixel, we will list it in our Cookie Policy first, ask before it loads, and add a “Your Privacy Choices” link to every page.

Artificial intelligence

Sepia includes AI features. When one is used, the content needed for that request — a prompt, a document, a call transcript, or the record you asked about — is sent to a third-party model provider to generate the response. Content is sent when the feature is invoked, not continuously, and only what the request requires.

Model providers appear in “Service providers” below, and their handling of that content is governed by their own terms. Do not put information into an AI feature that you are not permitted to disclose to a processor.

Automated decisions

Sepia does not profile or score people to make decisions that have legal or similarly significant effects on them, such as decisions about credit, employment, housing, insurance eligibility or pricing. Features that analyse records — for example purchase-history filters and AI lead scores — show their results to the business using Sepia, and the assistant only proposes actions for a person there to confirm. Some steps run automatically because a business or a guest set them up: a business's automations send messages or update its records, a paid waitlist charges the card a guest saved only when a seat opens, and a ticket stops admitting after a full refund or a chargeback. If one of these affected you, contact the business operating the workspace; its staff can review and change the outcome.

Calls, recording, and transcription

Where a customer enables it, Sepia records calls placed or received through the platform and transcribes them automatically. Recording laws vary by state and country, and some require the consent of every party. The customer operating the workspace is responsible for obtaining any required consent and giving any required notice. Sepia provides the capability; it does not determine whether a particular use is lawful.

Where a business turns on its AI receptionist, calls to that business may be answered by an automated voice assistant. The assistant tells callers it is an AI assistant. The audio and transcript are processed by our voice provider to answer the call, and are stored in the business’s workspace like other call records.

When we store a call transcript or the AI notes about a call, we automatically remove payment card numbers, security codes, expiry dates, Social Security numbers, bank account and routing numbers, and one-time codes, and we do not keep the original. Automatic removal works from patterns and can miss a number said in an unusual way, so do not ask callers for these details on a recorded call.

Service providers

We share information with providers who perform services for us, only as needed to run the platform. Our Sub-processors page lists our sub-processors, what each receives and why, and we update it before a new one starts handling customer data.

This list may change as the platform develops; material changes will be reflected here.

Google sign-in, Calendar and Drive

Google sign-in uses your account identity, such as your name, email address and profile picture, to sign you into Sepia. Calendar and Drive connections are optional and request additional permissions separately from ordinary sign-in.

When you connect Google Calendar, Sepia reads calendar names and identifiers to offer writable destinations and imports up to 250 primary-calendar events from 30 days ago onward into your selected workspace. Imported information includes titles, descriptions, times and event identifiers. New and imported links also retain the Google account and calendar identity so later requested edits and removals target the original event. Sepia creates, updates or removes Google events when you request those actions; assistant proposals require your confirmation.

Imported entries are stored in Google Cloud/Firebase as workspace records and can be seen by members with calendar access. Scheduling and enabled briefing features use those records. When you ask the assistant about records or use another AI feature that reads them, relevant information can be sent to the AI providers listed above to produce the requested result.

Google Drive access is limited to files you select for Sepia through Google's picker and files Sepia creates for you. Import copies selected content into Sepia's file storage; supported Google-native documents are exported to PDF for import. Export sends the selected Sepia file or notebook content to your Google Drive. Sepia does not request permission to browse or manage your entire Drive.

Disconnecting Calendar changes Sepia's connection setting and clears its current Calendar token cache. It does not erase imported records or revoke the grant in your Google Account. You can manage that grant through Google's third-party connections controls. Imported records and files remain subject to the retention and deletion provisions below. Contact info@sepialabs.ai about your own Sepia account, or the business operating the workspace about records it controls.

Google API data and Limited Use

Sepia's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. This commitment also covers information derived from Google API data.

We use Google API data for the connected features you authorize and transfer it to service providers as needed to provide those features, protect security or meet legal obligations. We prohibit its use for advertising, sale to data brokers or credit decisions. We do not retain Google Workspace API data to develop, improve or train non-personalized artificial intelligence or machine-learning models.

Connected email

When you choose to connect a mailbox through Nylas, the mailbox provider asks you to authorize access separately from signing into Sepia. For Gmail, Sepia requests your account identity, read access to messages and permission to send email on your behalf. Sepia retrieves recent messages and attachment information into the selected workspace, makes attachments available when requested and sends messages you request. The initial import retrieves up to 50 recent messages; new messages arrive through the connection. Imported mail is stored in Google Cloud/Firebase and can be read by workspace members. Assigning a personal sender controls who can send from that mailbox; it does not make imported workspace messages a private personal inbox.

When you request a reply draft, summary, assistant answer or scheduled assistant task using imported messages, relevant message context can be sent to the AI service providers listed above. An AI answer can contain information derived from those messages. Chat history and any records you choose to save from that answer follow the applicable workspace or account retention and deletion controls. You can use the connected Inbox without requesting AI help.

Resend processes platform email and replies addressed to Sepia reply addresses. Delivery events help us track delivery, failures and suppression. Disconnecting an email account does not by itself erase messages already imported into a workspace. Those records follow the retention and deletion provisions below.

Pictures in emails you receive load automatically through our servers, so the sender sees our server’s address rather than yours. A sender can still tell that a message was opened. You can turn pictures off for any sender.

Payments

Businesses that accept payments through Sepia connect their own Stripe account. In that arrangement the business is the merchant of record for its own sales — it holds the customer relationship, receives the funds, and handles its own refunds and disputes. Sepia facilitates the transaction and may collect a platform fee. Payment card details are collected by Stripe and are never stored on our systems.

Retention

• Workspace content is retained while the account is active and for a reasonable period afterwards, so an account can be recovered after accidental deletion.
• Deleting a record removes it from the workspace. Some records are moved to a trash area first and can be restored until permanently removed.
• Deleting an event permanently deletes its guest records, including names, contact details, and check-in codes.
• Some records are kept longer where law requires it — for example, insurance enrollment consent records, retained for ten years.
• Sepia's own billing and payment records for an account, such as purchases and subscription charges, are kept for seven years from the transaction date for tax and accounting purposes, including after the workspace is deleted.
• If you build a dashboard from a file in the chat, the dashboard keeps a copy of that file until you delete the dashboard, its stored file, or your workspace. Erasing a contact also removes their rows from those copies.
• Backups and logs persist for a limited period after deletion.

Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing. To exercise a right regarding your Sepia account, contact info@sepialabs.ai. See our data deletion instructions for what to include and how to disconnect Meta.

If your information sits in a workspace operated by one of our customers, contact that business. They control that data. If you contact us instead, we will forward the request where we can identify the workspace.

We will not discriminate against you for exercising these rights.

Text messaging

If you provide a mobile number and consent, you may receive SMS or MMS messages. Consent is never a condition of purchase or of using the platform. Message frequency varies, and message and data rates may apply. Reply STOP to opt out or HELP for help. Full terms are in our SMS Terms.

Children

Business accounts — workspaces, organizer spaces and team seats — are for adults: you must be 18 or older to create one. A Lava Lamp account used only for event tickets requires you to be 13 or older. You confirm your age when you sign up. Sepia is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided information to us, contact us and we will delete it.

Security

We use administrative, technical, and organizational safeguards appropriate to the risk, including encryption in transit, workspace-scoped access controls, and role-based permissions. No online service can guarantee absolute security.

International transfers

We offer Sepia to businesses in the United States. We operate in the United States and most information is processed there. A few providers on our Sub-processors page process some data in other countries, as that page shows. If you access Sepia from elsewhere, you understand your information will be transferred to and processed in the United States.

Changes

We will update this policy as the platform changes and will revise the date above. Where changes are material, we will give additional notice.

Contact

Sepia Labs LLC
3211 NW 7th Ave Cir
Miami, FL 33127
Privacy: info@sepialabs.ai
Support: info@sepialabs.ai