Privacy & security

Your role and ours

You decide which customers to contact and why, so you are the data controller. We are your data processor: we handle personal data only on your instructions and only to provide the service.

• We don't sell personal data or use it for advertising
• We don't use your data to train our own AI models
• A data processing agreement (DPA) is available on request

What data we process

Only what the features you use need:

• Your business details, brand pack and price list
• Staff accounts: name, email and role
• Your customers' contact details: name, phone and email
• WhatsApp messages, email replies and lead form entries
• Call recordings, transcripts and summaries for calling plans
• Usage and billing records

Your customers' rights

Every request can be handled from the panel, without waiting for us:

• Access and portability: export a business's data as a ZIP of CSV files and media
• Erasure: delete one person's chats, calls, leads and emails after a confirmation step
• Objection: a deleted number stays on the do-not-call list and a deleted email stays unsubscribed, so they are never contacted again
• Correction: your staff can update details, or ask us to

Consent and opt-out

The agent only contacts people in ways they agreed to:

• WhatsApp opt-in records show how and when each person agreed
• Customers can reply STOP at any time; START opts back in
• Every email has a working one-click unsubscribe link
• Calls check consent and the do-not-call list first and respect quiet hours
• The agent says it is an AI whenever someone asks

How long we keep data

Old data is removed automatically:

• Chats, calls, leads and finished email sequences are deleted after 24 months by default
• The period can be set from 3 to 120 months for each business
• Do-not-call and unsubscribe records are kept so opt-outs keep working
• When you cancel, you can export your data first

Security

Protection is built into every layer:

• Strict separation between businesses in every query, tested on every release
• Encrypted HTTPS connections everywhere
• Passwords stored as salted hashes, never in plain text
• Connection keys stored encrypted; phone line passwords are passed to the call provider and never stored by us
• Owner, admin and staff roles, and an audit log of who changed what
• Nightly backups, each one restored and checked automatically
• Card payments handled by Stripe; we never see card numbers

Who else processes data

We use a small number of trusted providers, each only for its part of the service. Some of them process data outside your country, including in the United States.

If something goes wrong

If a security incident affects your data, we tell you without undue delay with what we know, so you can meet your own reporting duties, such as the 72-hour deadline under GDPR.