Privacy Policy

1. Introduction

Sancho, Inc. ("the Company," "we," "us," or "our") builds and operates the Sancho robot orchestration platform, software that connects FANUC, KUKA, ABB, Universal Robots, Siemens PLC, and other industrial hardware into a unified cell-level control layer. This Privacy Policy explains what personal information we collect through sanchohq.com and the Sancho platform (the "Service"), how we use it, and the choices available to you. It applies to information collected through the website, contact forms, the platform login portal, and direct communications with us.

The Company is located at 160 West Santa Clara Street, Suite 700, San Jose, CA 95110 and can be reached at [email protected].

Sancho is an engineering product. Our customers are automation engineers, controls engineers, and operations managers at manufacturing facilities. The data we collect relates to operating the Service, managing customer engagements, and supporting pilot deployments, not consumer advertising or data brokerage.

2. Information We Collect

2.1 Information You Provide

We collect information you submit directly, including:

• Contact details (name, work email, company name, phone) when you submit a contact or early-access request form;
• Role and cell configuration context you describe in the contact form (vendor mix, robot models, use case);
• Account credentials (email address and hashed password) when you register for platform access;
• The content of any messages or support communications you send us.

2.2 Platform and Cell Data

When an authorized user connects Sancho to a workcell through the platform, the Service processes:

• Cell configuration data you define in your cell map (device hostnames, connector types, trigger rule definitions, IP assignments within your network);
• Orchestration telemetry generated by the Sancho runtime agent (event counts, handoff latencies, connector status transitions, error codes) used to display the platform dashboard and diagnose integration issues;
• Usage telemetry from the web platform (page views, feature interactions, session durations) collected via analytics cookies.

Cell configuration data and orchestration telemetry are processed solely to operate the platform for you. We do not use workcell data to train machine learning models without explicit written agreement with the customer. Production process data, robot motion programs, and proprietary manufacturing IP stay on your network; Sancho does not ingest or transmit those assets to our servers.

2.3 Information Collected Automatically

When you visit sanchohq.com, we automatically collect limited technical information:

• IP address and approximate location (city/region level);
• Browser type, operating system, device class;
• Pages visited, referring URLs, time on page;
• Cookie and similar identifiers (see Section 5 and our Cookie Policy).

2.4 We Do Not Knowingly Collect Children's Data

sanchohq.com is a business-to-business industrial software service. It is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

3. How We Use Information

We use the information we collect to:

• Respond to early-access and pilot inquiries and schedule technical evaluations;
• Provision and operate platform accounts for authorized pilot and production users;
• Display orchestration telemetry and cell status on the platform dashboard;
• Diagnose connector integration issues and provide customer engineering support;
• Operate, maintain, and improve the Service, including developing new vendor connectors;
• Send service updates, release notes, and (with your consent where required) engineering content;
• Detect, investigate, and prevent fraud or misuse of the platform;
• Comply with legal obligations.

We do not sell personal information for monetary value. We do not use personal information for cross-context behavioral advertising. Where applicable state law treats certain arrangements as a "sale" or "share," see Section 9 below.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf (hosting infrastructure, transactional email, analytics) under contractual confidentiality and data-processing terms;
• Authorities, when required by law or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties. Cell configuration data and orchestration telemetry are never shared with third parties except service providers operating on our infrastructure on your behalf.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, maintain login sessions, and measure usage through GA4 analytics. For details and choices, see our Cookie Policy.

6. Data Retention

We retain personal information only as long as needed for the purposes described, to comply with legal or accounting obligations, and to resolve disputes. Specifically:

• Contact and early-access inquiry records: retained for the duration of the engagement and up to 3 years thereafter;
• Platform account data: retained while the account is active and for 12 months following account closure;
• Orchestration telemetry: retained for 90 days on a rolling basis for diagnostic and dashboard purposes, then aggregated;
• Marketing contact list entries: inactive contacts purged after 24 months;
• Server access logs: retained 90 days, then deleted.

7. Security

We use administrative, technical, and physical safeguards to protect personal information, including TLS encryption in transit, restricted-access databases, and least-privilege access controls on platform infrastructure. The Sancho runtime agent communicates with your on-premises devices over your local network; we do not require inbound firewall ports to your production equipment. No system is perfectly secure; we cannot guarantee absolute security.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law. California residents should also read Section 9 below.

9. California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), California residents have specific rights regarding personal information collected about them. This section supplements the rest of the Policy. Because Sancho is headquartered in San Jose, California, and serves users across California and other US states, this section applies to our engineering team members, California-based pilot partners, and any California resident who contacts us.

9.1 Categories We Collect

In the past 12 months, we have collected the following categories of personal information defined under Cal. Civ. Code §1798.140: identifiers (name, work email, IP address); professional or employment-related information (job title, employer name, role in the manufacturing facility); commercial information (service inquiries and pilot engagement records); internet activity (browsing on sanchohq.com and use of the platform dashboard); and inferences drawn from the above for service-improvement purposes. We do not collect sensitive personal information as defined under Cal. Civ. Code §1798.140(ae). We do not collect precise geolocation, government ID, financial account credentials, health information, biometric data, or information about race, religion, union membership, sexual orientation, or the precise contents of private communications.

9.2 Sources, Purposes, Disclosure

We obtain this information from you directly (contact forms, account registration, customer engineering interactions) and through automatic site instrumentation (analytics cookies, server logs). We use it to operate and improve the Service, communicate with you about your pilot or account, and meet legal obligations. We disclose it only to service providers under written contract and to legal authorities where required.

9.3 Your CCPA / CPRA Rights

• Right to Know: request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information; we do not "share" it for cross-context behavioral advertising as defined under CPRA.
• Right to Limit Use of Sensitive PI: we do not use sensitive personal information for purposes beyond those permitted without authorization.
• Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a right.

9.4 How to Exercise

Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for us to verify you are the person whose information is the subject of the request. We respond within 45 days, with a possible 45-day extension for which we will notify you.

9.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; we may also require you to verify your identity directly.

9.6 "Shine the Light"

California Civil Code §1798.83 entitles California residents to request information regarding our disclosure of personal information to third parties for direct marketing. We do not disclose personal information for third-party direct marketing.

9.7 Do Not Track and Global Privacy Control

Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575), we disclose how we respond to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, we do not currently respond differently to them. We do not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Service. We honor an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.

11. Contact

Questions, requests, or complaints can be sent to:

Sancho, Inc.
160 West Santa Clara Street, Suite 700
San Jose, CA 95110
Email: [email protected]
Phone: +1 (408) 553-4619