Privacy Policy

Preamble & binding nature

Section 1: Controller vs. processor carve-out

1.1. WebinarGent as Data Controller. Lazostar LLC acts as a Data Controller under applicable Data Protection Laws for Personal Data collected directly from Visitors, Hosts, Creators, Agency Hosts, and account administrators. This includes information gathered for account provision, identity verification, subscription billing, direct marketing, platform usage telemetry, customer support routing, and system security monitoring.

1.2. WebinarGent as Data Processor. When Hosts, Creators, or Agency Hosts use WebinarGent to create registration pages, broadcast live or automated webinars, collect attendee leads, record chat interactions, execute polls, trigger automated email or SMS sequences, or manage post-event analytics, the Host acts as the sole Data Controller for all such Registrant Data, media uploads, and interaction logs (“Customer Content”).

• Lazostar LLC processes Customer Content and Registrant Data strictly as a Data Processor or Sub-Processor acting under the documented instructions of the Host pursuant to our Data Processing Addendum (“DPA”).
• Instructions for Registrants: If you submitted Personal Data during a webinar registration or broadcast, you are interacting directly with the Host organizing that event. To exercise privacy rights such as access, correction, or deletion, submit your request directly to the Host. WebinarGent cannot modify or delete Registrant Data without explicit written authorization from the applicable Host.

1.3. Excluded Anonymized & Aggregated Data. This Policy does not restrict data that has been fully anonymized, de-identified, or aggregated so that it can no longer reasonably identify or be linked to a specific natural person. Lazostar LLC may process anonymized telemetry and aggregated benchmark data for platform optimization, system health monitoring, and operational statistics.

Section 2: Categories of Personal Data we collect

We collect Personal Data across distinct business interactions, categorized in accordance with global privacy frameworks, including CCPA/CPRA § 1798.140 and GDPR Article 6.

Section 3: Single Sign-On & social livestreaming API scopes

3.1. Single Sign-On Data Collection. WebinarGent offers Single Sign-On through Google, Microsoft, and LinkedIn. When you authenticate through these platforms, we collect data limited to the scopes you authorize:

1. Google SSO: Full name, primary email address, profile-picture URL, Google account ID, and an optional mobile phone number if requested during live-event support onboarding.
2. Microsoft SSO: Display name, work email address, tenant ID, Microsoft user object ID, and profile image.
3. LinkedIn SSO: Full name, email address, profile-photo URL, vanities, job title, and company name.

3.2. Google API Services Limited Use Disclosure. WebinarGent’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Google Calendar Scope: Used strictly to read start times, end times, and titles of calendar events to schedule corresponding webinar broadcasts automatically.
• Google Contacts Scope: Used strictly to import attendee contacts into the Customer’s WebinarGent CRM for event-registration invitations upon Host request.
• Advertising and human-inspection prohibition: We never use Google API data to serve advertisements or permit personnel to read it unless you explicitly agree for technical support, it is necessary for a security investigation, it is required by law, or the data is fully aggregated and anonymized for platform-performance analysis.

3.3. Social Livestreaming Integrations. For YouTube Live, use is subject to the YouTube Terms of Service and Google Privacy Policy, and permissions may be revoked through Google Security Settings. Facebook Live use is subject to the Meta Terms of Service and Privacy Policy, and session tokens are processed strictly to initiate and manage streams. LinkedIn Live credentials are used solely to establish broadcast RTMP links and are never stored permanently after the session.

Section 4: Methods of collection & automated telemetry

4.1. Direct Submissions. We collect Personal Data when you create an Account, execute an Order Form, submit a support request to support@webinargent.com, complete landing-page forms, or configure AI Studio prompts.

4.2. Automated Tracking Technologies. When you navigate our websites or view a webinar, we automatically record server logs and telemetry through first-party and third-party cookies, clear GIFs, web beacons, local-storage objects, and browser-fingerprinting tools.

4.3. Session Recording & Behavioral Analytics. We use pseudonymized session-recording tools, including heatmaps, scroll-depth tracking, and interaction logs, to evaluate user experience, diagnose interface defects, and optimize page-load speeds. These tools collect device details and anonymized IP addresses and are not configured to read raw password or payment-card fields.

4.4. Third-Party Data Enrichment. We may enrich corporate account data with business information such as company size, corporate address, and public social profiles received from trusted B2B data aggregators and commercial enrichment partners.

Section 5: Legal bases for processing

For individuals in the EEA, United Kingdom, Switzerland, Brazil, Canada, or India, Lazostar LLC processes Personal Data as a Data Controller under these legal bases:

• Contractual Necessity (GDPR Article 6.1(b)): To execute our Master Terms, provision Workspaces, process billing, and deliver platform functionality.
• Explicit & Freely Given Consent (Article 6.1(a)): For affirmative opt-ins such as promotional newsletters, non-essential marketing cookies, or SSO profile imports. Consent may be withdrawn without affecting prior processing.
• Legitimate Interests (Article 6.1(f)): For interests not overridden by fundamental privacy rights, including network security, trial-abuse prevention, DDoS detection, streaming optimization, and financial auditing.
• Legal Obligations (Article 6.1(c)): For accounting, tax reporting, court subpoenas, anti-money-laundering rules, and other legal requirements.

Section 6: How we use Personal Data

1. Service Delivery: Provisioning, maintaining, operating, and updating WebinarGent, AI Studio, automated funnel engines, and CRM integrations.
2. Financial Transactions: Processing subscription payments, invoices, usage overages, and affiliate commissions.
3. Account Communication: Sending security alerts, operational updates, maintenance notifications, and support responses.
4. Security & Fraud Prevention: Detecting and mitigating unauthorized access, credential stuffing, trial abuse, acceptable-use violations, and cyberattacks.
5. Product Optimization: Internal auditing, telemetry research, and server-load analysis to improve streaming and infrastructure.
6. Marketing & Sales, subject to opt-in: Product updates, webinar invitations, promotional offers, and industry news with one-click unsubscribe links.

Section 7: AI Studio, autonomous AI Closers & chat governance

7.1. Processing Mechanics. WebinarGent uses artificial-intelligence tools, natural-language-processing models, and autonomous AI Closers to generate webinar outlines and presentation scripts, manage automated chat responses, and trigger dynamic calls to action.

7.2. Zero Third-Party LLM Model Training Guarantee. Lazostar LLC does not sell, share, or transmit your Personal Data, Customer Content, webinar transcripts, or prompts to third-party AI providers to train public or commercial large language models. Inputs and prompts are processed to generate outputs for your Workspace under contractually bound enterprise API arrangements.

7.3. Chat Transcript Retention. Live, automated, and AI-assisted chat logs, Q&A threads, and support conversations are retained within the Customer’s Workspace for quality assurance, compliance records, and service delivery. Hosts may manage or delete them through administrative settings or written DPA instructions.

Section 8: Data Privacy Framework, SCCs & global transfers

8.1. Global Processing. Personal Data may be stored, processed, or transferred to servers in the United States or other jurisdictions where Lazostar LLC, its affiliates, or Sub-Processors maintain facilities.

8.2. Data Privacy Framework. Lazostar LLC complies with and certifies adherence to the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework. If this Policy conflicts with the applicable DPF Principles, those Principles govern. Learn more and view our certification at dataprivacyframework.gov. Lazostar LLC is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.

8.3. Onward Transfers. Lazostar LLC remains liable under the DPF Principles for non-compliant processing by third-party Sub-Processors acting as agents unless we prove that we are not responsible for the event giving rise to the damage.

8.4. SCCs & UK Addendum. Where an adequacy decision or DPF certification does not fully apply, Lazostar LLC incorporates the European Commission Standard Contractual Clauses, Module Two: Controller-to-Processor, and UK International Data Transfer Addendum, Version B1.0, into our DPA.

Section 9: Disclosures, Sub-Processors & A2P/SMS safeguards

Lazostar LLC does not sell Personal Data for monetary compensation.

9.1. Service Providers. We disclose data to contractually bound infrastructure and cloud providers such as AWS and Google Cloud; payment gateways such as Stripe and PayPal; telecommunications, streaming, and email providers such as Twilio and SparkPost; support and CRM suites such as Intercom, Freshworks, and HubSpot; and professional legal, accounting, and security advisers.

9.2. Absolute A2P/SMS Opt-In Protection. No mobile phone numbers, text-message opt-in data, or SMS consent records collected for account alerts, two-factor authentication, or webinar reminders will be shared, sold, rented, leased, or disclosed to third parties, affiliates, or marketing networks for promotional marketing. Mobile details are transmitted only to verified telecommunications Sub-Processors to deliver requested transactional messages.

9.3. Corporate Transactions. Personal Data may transfer in a merger, acquisition, reorganization, asset sale, or bankruptcy, subject to confidentiality protections and notice requirements.

9.4. Compelled Disclosures. We may disclose Personal Data when required by law, regulation, judicial order, or lawful public-authority request, including national-security or law-enforcement requirements.

Section 10: GPC, DNT & advertising opt-outs

10.1. Global Privacy Control. WebinarGent marketing websites automatically detect and honor GPC opt-out signals, disabling non-essential targeting, tracking, and advertising cookies for that session and device.

10.2. Do Not Track. Because no universal standard exists for legacy DNT headers, our websites do not alter collection practices in response to DNT and instead rely on GPC detection and our Cookie Preferences widget.

10.3. Cross-Context Advertising. You may opt out of third-party cookie tracking and cross-context behavioral advertising through the Cookie Preferences footer link or our Individual Rights Portal.

Section 11: HIPAA, Protected Health Information & BAAs

11.1. Lazostar LLC is not inherently a Covered Entity under HIPAA, but enterprise Customers in healthcare or regulated industries may wish to use WebinarGent with Protected Health Information (“PHI”).

11.2. WebinarGent maintains safeguards addressing the HIPAA Security Rule, including encrypted storage, audit logging, workforce security training, and Sub-Processor controls.

11.3. Mandatory BAA. Customers subject to HIPAA must execute a mutually signed Business Associate Agreement before transmitting, storing, broadcasting, or processing PHI. Processing PHI without a BAA violates our Terms and may result in immediate suspension.

11.4. Customers operating under a BAA must prevent PHI from being transmitted to advertising networks, social pixels, or unapproved analytics integrations.

Section 12: Technical security controls & compliance

• AES-256 Encryption: Primary databases, media repositories, and backups are hosted in secure AWS data centers using AES-256 encryption at rest.
• Encryption in Transit: Web interfaces, checkouts, portals, and APIs enforce TLS 1.3 across public networks.
• Access Governance & MFA: MFA is enforced for internal administrative access, with least privilege and Role-Based Access Control.
• Infrastructure Resilience: Networks use web-application firewalls, DDoS mitigation, intrusion detection, and regular third-party vulnerability scans.
• Compliance Standards: Hosting-facility operations maintain SOC 2 Type II, ISO 27001, and PCI-DSS Level 1 certifications.

Section 13: Data retention & backup schedules

13.1. We retain Personal Data only as long as reasonably necessary for the purpose collected, contractual commitments, disputes, and accounting, tax, or regulatory obligations.

13.2. Data associated with an active Workspace is retained for the Subscription Term and a reasonable period thereafter for renewal or compliance review.

13.3. Automatic 24-Month Inactive Account Purge. Unless a shorter period appears in the Customer’s DPA or Technical and Organizational Measures, Customer Content, Registrant Data, recordings, chat logs, poll results, and analytics associated with a cancelled, terminated, or wholly inactive Workspace will be deleted, erased, or de-identified from active production databases no later than twenty-four months after termination or expiration.

13.4. Backup Overwrite Cycle. Encrypted disaster-recovery backups and archival logs are retained on a rolling sixty-day cycle and overwritten, scrubbed, or destroyed according to routine rotation schedules.

Section 14: Children’s privacy

14.1. WebinarGent is designed for adult business, professional, and commercial audiences. We do not direct the Services to or knowingly solicit Personal Data from children under sixteen, or under thirteen under U.S. COPPA standards.

14.2. You must be at least eighteen or the age of majority to purchase a Subscription, create a Workspace, or register an Account. Minors aged thirteen through seventeen may participate in webinars only under the direct supervision and consent of a parent, guardian, or educational institution.

14.3. If we discover data from a person under sixteen collected without verifiable parental consent, we will take immediate steps to delete it. Send notices to compliance@webinargent.com.

Section 15: Regional privacy rights

Depending on your residence, you may have statutory privacy rights. Lazostar LLC enforces applicable rights without discrimination.

Section 16: European Digital Services Act compliance

16.1. To the extent WebinarGent’s chat, Q&A, and user-generated pages make Lazostar LLC a hosting-service provider under Regulation (EU) 2022/2065, Lazostar LLC maintains applicable DSA compliance.

16.2. Notice & Action. EU users, authorities, and third parties may report allegedly illegal hosted content to abuse@webinargent.com. Notices must include a reasoned explanation, exact URL or electronic location, and the submitter’s name and email.

16.3. Reasons & Appeals. If we restrict or remove content or suspend a Workspace under our AUP or DSA obligations, we will provide a Statement of Reasons. Affected users may appeal through our complaint mechanism within six months.

Section 17: Automated decision-making & human oversight

17.1. Lazostar LLC does not subject Visitors, Hosts, or Registrants to solely automated decisions, including profiling, that produce legal or similarly significant effects without human intervention.

17.2. AI Studio, autonomous AI Closers, and automated funnel triggers operate within Customer-configured parameters. Under Section 5 of our Master Terms, Customers must maintain human oversight and review AI outputs, pricing offers, and scripted interactions before live deployment.

Section 18: Policy modifications & notification

18.1. Lazostar LLC may amend this Policy to reflect changes in data handling, features, Sub-Processors, or legal requirements.

18.2. For material changes, we will notify you through an administrative-dashboard banner, an updated “Last Updated” date, or email to the primary Workspace administrator.

18.3. Continued access after an updated Policy’s effective date constitutes acceptance of the revised terms.

Section 19: Contact, Data Protection Officer & escalation

For questions, unresolved complaints, or requests to exercise statutory rights, contact our Data Protection Officer and Privacy Team.