Privacy Policy

Salsa (“we,” “us,” or “our”) operates the salsas.app platform, an AI-powered execution runtime and work management system. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website at salsas.app, use our services, or interact with any of our related tools and features.

Salsa acts as the data controller for the personal information described in this policy. We are committed to protecting your privacy and handling your data with transparency and care. By accessing or using our services, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy is effective as of March 4, 2026. If you do not agree with the terms of this policy, please do not access or use our services. We encourage you to review this policy periodically to stay informed about how we protect your information.

We collect information that you provide directly to us, as well as certain information that is gathered automatically when you interact with our services. The types and scope of data we collect depend on how you use our platform.

Information You Provide

• Beta signup: When you request early access to Salsa, we collect your email address. This allows us to manage access to the beta program and notify you when your invitation is ready.
• Contact form: When you use our contact form, we collect your name, email address, and the content of your message. This information is used solely to respond to your inquiry.
• Voice widget interaction: If you use the voice widget on our website, audio data is captured by your device’s microphone and transmitted to Onzoe (api.onzoe.com) for speech-to-text and text-to-speech processing. We do not store raw audio recordings on our servers. See Section 4 for full details.

Information Collected Automatically

• Server logs: Our web servers automatically record standard log information, including your IP address, browser type and version, operating system, referring URL, pages visited, and the date and time of each request.
• Device information: We may collect general device identifiers such as screen resolution and device type (desktop, tablet, mobile) to optimize the presentation of our website.

We do not collect any special categories of personal data (e.g., racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) except as described in Section 4 regarding voice audio processing, which is transient and not stored.

We use the information we collect for the following purposes, each supported by a lawful basis under applicable data protection laws:

• Service delivery: To provide, maintain, and improve our platform, including managing your beta access, processing your requests, and delivering the features and functionality of Salsa.
• Communication: To respond to your inquiries, send service-related notices (such as beta invitations, security alerts, and system updates), and provide customer support. We will only send marketing communications if you have opted in to receive them.
• Improvement and analytics: To understand how our services are used, identify trends, and improve the user experience. Any analytics data is aggregated and does not identify individual users.
• Security: To detect, prevent, and address technical issues, fraud, abuse, and unauthorized access to our platform. This includes monitoring server logs for suspicious activity.
• Legal compliance: To comply with applicable laws, regulations, legal processes, or governmental requests, and to enforce our terms of service and protect our legal rights.

Our website includes an optional voice widget that allows you to interact with Salsa using spoken language. This feature is powered by Onzoe, a voice AI platform operated at api.onzoe.com. Understanding how audio data flows through this system is important to us, and we want to be fully transparent about the process.

When you activate the voice widget, your device’s microphone captures audio, which is transmitted in real time to Onzoe’s servers for speech-to-text (STT) processing. The resulting text transcript is then used to generate a response, which may be converted back to audio via text-to-speech (TTS) and played through your device’s speakers. Audio data is processed in-memory on Onzoe’s servers and is not stored permanently after the processing session concludes.

The voice widget requires your explicit activation — it will never record audio without your interaction. Use of the voice widget is subject to your acceptance of functional cookies as described in Section 5. You may use all other features of our website without enabling the voice widget.

Our website uses browser local storage to save minimal preferences that improve your experience. We do not currently set any server-side cookies. The following table describes all client-side storage items used by our website:

Because these items are essential to the basic functioning of the website (theme rendering and consent management), they do not require separate opt-in consent under most privacy regulations. They do not track you or identify you.

We collect limited, first-party, cookieless audience measurement by default so we can understand aggregate usage of salsas.app. This default analytics mode does not set analytics cookies, localStorage visitor IDs, sessionStorage visitor IDs, advertising identifiers, or cross-site trackers. It records page and event data such as page path, referrer, UTM parameters, asset/source labels, coarse device category, timestamp, and server-derived geography.

If you grant analytics consent, Salsa Analytics may use first-party localStorage and sessionStorage identifiers to measure returning visitors, sessions, scroll depth, clicks, and form submissions. You can withdraw analytics consent at any time through the Cookie Settings control in the site footer.

We do not sell, rent, or trade your personal information to third parties for their marketing or commercial purposes. We share data only with the following categories of service providers, each of which is necessary for the operation of our platform:

• Onzoe (api.onzoe.com): Provides voice processing infrastructure for the voice widget feature. Audio data is transmitted to Onzoe for real-time STT/TTS processing and is not retained after the session.
• Google Fonts (fonts.googleapis.com / fonts.gstatic.com): Delivers the Inter and JetBrains Mono typefaces used on our website. When your browser loads these fonts, Google may receive your IP address and standard request headers. Google’s privacy policy governs this data.
• DigitalOcean: Provides cloud hosting infrastructure for our website and services. DigitalOcean processes data on our behalf as a data processor under a data processing agreement.
• Postfix (self-hosted): Handles outbound email delivery for contact form responses, beta invitations, and system notifications. Email infrastructure is self-managed and does not involve third-party email marketing platforms.

We may also disclose your personal information if required to do so by law, in response to valid legal process (such as a court order or subpoena), or to protect the rights, property, or safety of Salsa, our users, or the public. In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction, and we will notify you of any such change.

We retain your personal information only for as long as is necessary to fulfill the purposes described in this policy, unless a longer retention period is required or permitted by law. The specific retention periods for each category of data are as follows:

• Beta signup data (email address): Retained until the conclusion of the beta program plus 30 calendar days, or until you withdraw your participation by contacting us, whichever occurs first. After this period, your email address is permanently deleted from our systems.
• Contact form submissions (name, email, message): Retained for 12 months from the date of submission to allow for follow-up correspondence and quality improvement. After 12 months, contact form data is automatically purged.
• Voice audio data: Not retained after processing. Audio streams are processed in-memory by Onzoe and are discarded upon completion of each voice interaction session. No audio recordings are stored on our servers or on Onzoe’s servers beyond the duration of the active session.
• Server logs: Retained for up to 90 days for security monitoring and debugging purposes, after which they are automatically rotated and deleted.

When personal data is no longer needed for its original purpose and no legal obligation requires its continued storage, we will securely delete or anonymize the data so that it can no longer be associated with you.

Depending on your location and applicable laws, you may have certain rights regarding the personal information we hold about you. We are committed to honoring these rights and have established processes to facilitate your requests.

European Economic Area, United Kingdom & Switzerland (GDPR / UK GDPR)

If you are located in the EEA, UK, or Switzerland, you have the following rights under the General Data Protection Regulation:

• Right of access: You may request a copy of the personal data we hold about you.
• Right to rectification: You may request that we correct any inaccurate or incomplete personal data.
• Right to erasure: You may request that we delete your personal data, subject to certain legal exceptions.
• Right to data portability: You may request a machine-readable copy of the personal data you have provided to us.
• Right to restrict processing: You may request that we limit the processing of your personal data in certain circumstances.
• Right to object: You may object to the processing of your personal data where we rely on legitimate interests as the legal basis.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

You also have the right to lodge a complaint with your local data protection supervisory authority.

California (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act and the California Privacy Rights Act:

• Right to know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the sources of collection, the business purposes, and the categories of third parties with whom we share it.
• Right to delete: You may request the deletion of your personal information, subject to certain exceptions.
• Right to opt out: You have the right to opt out of the sale or sharing of your personal information. We do not sell personal information.
• Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.

Brazil (LGPD)

If you are located in Brazil, you have rights under the Lei Geral de Proteção de Dados, including the right to confirmation of processing, access, correction, anonymization, portability, deletion of data processed with consent, information about shared data, and the right to revoke consent.

Salsa is based in the United States, and our servers and service providers are primarily located in the United States. If you access our services from outside the United States, please be aware that your personal information may be transferred to, stored in, and processed in the United States or other jurisdictions where our service providers operate.

For users in the European Economic Area, United Kingdom, or Switzerland, we ensure that any transfer of personal data outside of these regions is conducted in compliance with applicable data protection laws. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission as the primary transfer mechanism, supplemented by additional technical and organizational safeguards where appropriate.

These safeguards include encryption of data in transit using TLS, access controls that limit data access to authorized personnel, and contractual obligations imposed on our service providers to protect personal data in accordance with this policy. If you have questions about the specific safeguards we use, please contact us at hola@salsas.app.

Our services are not directed at children under the age of 13 (or under the age of 16 in the European Economic Area and the United Kingdom). We do not knowingly collect, solicit, or maintain personal information from anyone under these age thresholds. If you are a parent or guardian and believe that your child has provided personal information to us without your consent, please contact us immediately at hola@salsas.app.

If we become aware that we have collected personal information from a child under the applicable minimum age without verified parental consent, we will take prompt steps to delete that information from our systems. We encourage parents and guardians to monitor their children’s online activity and to help enforce this policy by instructing their children never to provide personal information through our services.

We take the security of your personal information seriously and implement a combination of technical, administrative, and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction.

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security). Our gateway tunnel infrastructure uses QUIC transport with end-to-end AES-GCM encryption.
• Local-first architecture: Salsa is designed with a local-first approach, meaning your work data is stored primarily on your own device. Cloud synchronization is optional, not required, and data that does traverse our infrastructure is encrypted.
• VM sandbox isolation: Autonomous agent execution occurs within isolated virtual machine sandboxes. This ensures that agent actions cannot access or modify data outside of their designated execution environment.
• Access controls: Access to our production systems is restricted to authorized personnel via SSH key authentication and role-based access controls. We follow the principle of least privilege.

While we strive to protect your personal information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we continuously review and improve our security practices to address emerging threats and vulnerabilities.

We may update this Privacy Policy from time to time to reflect changes in our practices, our services, or applicable laws and regulations. When we make changes, we will revise the “Effective” date at the top of this page.

For material changes — those that significantly affect how we collect, use, or share your personal information — we will provide at least 30 days’ advance notice before the changes take effect. Notice will be provided via email (if we have your email address on file) or by posting a prominent notice on our website. We encourage you to review this page periodically.

Your continued use of our services after the effective date of any updated policy constitutes your acceptance of the revised terms. If you do not agree with any changes, you should discontinue use of our services and contact us to request deletion of your personal information.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, we encourage you to reach out to us. We aim to respond to all inquiries within 30 days.

• General inquiries: hola@salsas.app
• Privacy and data requests: privacy@salsas.app

For data subject access requests (DSARs) or requests to exercise your rights under GDPR, CCPA, LGPD, or other applicable privacy laws, please contact privacy@salsas.app with a description of your request. We may ask you to verify your identity to protect your account and personal data.