Winn.ai is an AI-powered platform that automates data analysis and insights generation, helping businesses make informed decisions by streamlining their data processing tasks.
Winn.ai is a real-time AI sales assistant that joins meetings to guide reps, enforce playbooks, automate note-taking, and update CRMs, enabling salespeople to focus entirely on customers and close more deals with less administrative burden.[1][4] Key features include real-time playbook tracking to ensure all topics are covered, automatic data capture of pain points, timelines, and competitors, seamless CRM integration with custom fields, AI-generated follow-up emails and summaries, live sales insights, and support for platforms like Zoom with expansions to Teams and Google Meet planned.[1][2][4]
It targets sales teams, account executives, and leaders in businesses seeking to improve call quality, accelerate onboarding, boost productivity, and enhance pipeline visibility through accurate forecasting and handoffs.[1][3] Winn.ai stands out with its advanced Natural Language Understanding for precise, real-time topic-to-CRM matching at a level of detail unmatched by competitors, Vibe Selling™ methodology, customizable playbooks based on frameworks like MEDDIC and BANT, and rapid deployment that reduces post-call work to minutes.[2][3][4]
The ToS states that Company uses 'machine learning and artificial intelligence systems' to process User Content and Usag
No training opt-out mechanism was identified in the legal documents.
Moderate risk. Suitable for internal data but avoid confidential information.
The ToS states that Company uses 'machine learning and artificial intelligence systems' to process User Content and Usage Data for 'AI Process' to 'improve algorithms,' but does not explicitly prohibit training on user data. The DPA states Company will only Process Personal Data 'on behalf of and in accordance with Licensee's documented instructions' and commits to 'refrain from Selling any Agreement Personal Data,' but does not explicitly state user data is NOT used for training. The language is vague regarding whether aggregated/anonymized data feeds the training pipeline.
“[ToS] 'Services embedded in the Platform may be implemented by the Company using machine learning and artificial intelligence systems...to improve algorithms in the course of processing User Content and Usage Data'; [DPA] 'Company shall only Process Agreement Personal Data on behalf of and in accordance with Licensee's documented instructions'”
The ToS grants Company 'a non-exclusive, irrevocable, limited, royalty free and worldwide license...to use, process and store the respective data and the User Content in order to perform the services.' The license is limited to service provision but is irrevocable and worldwide, and the ToS states 'Feedback shall be solely owned by Company' with no restrictions on Company's use. This is broader than strictly necessary for service delivery but not perpetually sublicensable to third parties.
“[ToS] 'you hereby grant Company...a non-exclusive, irrevocable, limited, royalty free and worldwide license...to use, process and store the respective data and the User Content'; [ToS] 'such Feedback shall be solely owned by Company, and shall not, under any circumstance constitute your confidential or proprietary information'”
The DPA lists 13 sub-processors (MongoDB Atlas, Google Cloud, OpenAI, Microsoft Azure, etc.) in Schedule 4.3 and requires 30-day notice before engaging new ones with opt-out rights. However, the ToS permits sharing with 'affiliates and partners' and the Privacy Policy (job candidate context) mentions sharing with 'service providers and vendors' and 'affiliated corporate group entities.' The DPA requires DPAs with sub-processors but does not explicitly prohibit sharing with advertising or analytics partners for non-personal data purposes.
“[DPA] Schedule 4.3 lists sub-processors including 'OpenAI User content analysis'; [DPA] 'Company shall ensure that the arrangement between Company and any Subcontractor is regulated by a written agreement...imposing on the Subcontractor undertakings that guarantee at least the same level of protection'; [ToS] 'Company may collect, create, process, transmit, store, use, and disclose aggregated and de-identified data...for the Company's business purposes'”
The DPA states that upon termination, Company 'shall, at the Licensee's option, promptly (i) delete all Agreement Personal Data...or (ii) return to Licensee...and delete all such Agreement Personal Data,' with written certification within 7 days. However, Company may retain data 'to the extent and for such period as required by such Applicable Laws' without specifying what those periods are. The ToS does not specify retention periods for User Content or Usage Data, only that Company 'may collect, create, process...aggregated and de-identified data' with 'sole ownership' and no deletion obligation.
“[DPA] 'upon...termination of the Services...the Company shall...promptly (i) delete all Agreement Personal Data...or (ii) return to Licensee...and delete all such Agreement Personal Data'; [DPA] 'Company shall...only retain such Agreement Personal Data to the extent and for such period as required by such Applicable Laws'; [ToS] 'Company shall have sole ownership, title and interest in and to the Aggregated Data'”
The ToS states 'User Content is and shall remain in your ownership' but also grants Company 'a non-exclusive, irrevocable, limited, royalty free and worldwide license...to use, process and store the respective data and the User Content.' The ToS explicitly states 'Feedback shall be solely owned by Company.' For outputs generated by the AI Process, ownership is ambiguous—the ToS does not clearly state whether generated outputs (e.g., call summaries, insights) are owned by the user or Company, creating shared/ambiguous ownership.
“[ToS] 'The User Content is and shall remain in your ownership'; [ToS] 'you hereby grant the Company...a non-exclusive, irrevocable, limited, royalty free and worldwide license...to use, process and store the respective data and the User Content'; [ToS] 'such Feedback shall be solely owned by Company'”
The DPA references ISO 27001 standards ('in line with ISO27001 or similar standards, an annual risk assessment') and GDPR compliance (Standard Contractual Clauses, GDPR references throughout). However, no explicit statement of SOC 2 Type II, ISO 27001 certification, HIPAA, or published security audit reports is provided. The DPA describes security measures but does not claim formal certifications. No dedicated trust page or security documentation URL is referenced.
“[DPA] Schedule 7.1 states 'conduct, in line with ISO27001 or similar standards, an annual risk assessment'; [DPA] 'The Parties hereby enter into the Controller to Processor Standard Contractual Clauses'; [DPA] 'Company has implemented and will apply the technical and organizational measures set forth in Schedule 7.1'”
Track and measure your AI tools with Olakai's observability platform.
Explore Olakai