Privacy Policy

[Your Company Name Ltd / B.V.] is responsible for the personal data described in this policy. We act as the data controller for personal data relating to your account, billing, support requests and our own operations. We act as a data processor for the personal data contained in the messages, contacts and conversations that you and your end users process through the service.

This policy applies to yourbrand.com, our application and our APIs. The Effective Date of this policy is 1 January 2026.

Information you give us directly

• Account information: name, email address, phone number, company name, role and billing details
• Profile data: time zone, language preferences and notification settings
• Workspace configuration: bot instructions, FAQ and knowledge-base content, and integration settings
• Communications with us: support tickets, chats and emails, including attachments you choose to share

Business data you process through the service

• Contacts you import or that arrive through inbound messages (name, phone, email, social identifiers and custom fields)
• Conversation content across the channels you connect (text, voice notes, images, video and documents your end users send)
• Knowledge resources you provide to train the AI

Payment information

When you subscribe to a paid plan, payment information is handled by our payment processor. We do not store full card numbers on our servers; we may store a token, the last four digits of your card, the card brand and your billing address.

Information we collect automatically

• Usage telemetry: pages visited, features used and errors encountered
• Device and connection data: IP address, browser, operating system and referrer URL
• Server logs and security events, including authentication attempts

• To provide, operate, maintain and improve the service
• To process AI conversations and media understanding (such as transcription and image analysis)
• To deliver and meter messages across the channels you connect
• To provide customer support and respond to your requests
• To process billing, manage your subscription and detect fraud
• To secure the service and prevent abuse and security incidents
• To send service emails and, with your separate consent, marketing emails
• To comply with legal obligations and respond to lawful requests

We do not sell personal data and we do not share personal data with third-party advertisers for cross-context behavioural advertising.

AI conversations and certain media-processing tasks (such as transcription and image or video understanding) are handled by our AI providers. You are the data controller for the end-user messages you process through the service; we act as your processor for that data and process it only on your documented instructions.

Where data-protection law (such as the EU/UK GDPR) requires a legal basis, we rely on the following:

• Contract performance: processing necessary to provide the service you signed up for
• Legitimate interests: security, fraud prevention, product improvement and defending legal claims, with an easy opt-out where applicable
• Consent: marketing emails, optional analytics or marketing cookies, and any processing that requires consent
• Legal obligation: tax, accounting and other regulatory requirements that apply to us

You can object to processing based on legitimate interests, or withdraw consent, at any time by contacting hello@yourbrand.com.

Where your data is hosted

The service and your data are hosted on secure dedicated servers and cloud infrastructure located in the European Union (Germany, and the EU region of our cloud provider). Data is encrypted in transit using TLS, and sensitive credentials and integration tokens are encrypted at rest.

Sub-processors

We and the underlying platform that powers the service rely on the following categories of sub-processor to handle personal data. We require each of them to process personal data only under appropriate data-protection terms. The specific providers may change over time; this list is current as of 1 January 2026.

We do not sell personal data. We may share data with professional advisors under confidentiality obligations, and in connection with a merger, acquisition or sale of assets subject to appropriate protections.

Our infrastructure is primarily located in the European Union. Where a sub-processor (such as an AI, messaging or payment provider) processes data outside the EU, we rely on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

Where personal data is transferred outside your or your end users’ region, we rely on appropriate safeguards such as the relevant standard contractual clauses, an applicable adequacy decision, or another lawful transfer mechanism.

• Active account data: retained for the life of your account
• Conversation and message data: Contacts and conversation content are retained for the life of your account and deleted from active systems within 90 days of account closure, unless a longer period is required by law.
• Financial records: retained for the period required by tax law in [your country]
• Backups: Encrypted backups are retained on a rolling basis for up to 30 days.
• Server logs and security events: Server logs and security events are retained for up to 90 days.

When you cancel, you can export your data for a reasonable period, after which we will delete Customer Data from active systems in the normal course.

Depending on where you live, you may have some or all of the following rights over your personal data:

• The right to access the personal data we hold about you
• The right to correct inaccurate personal data
• The right to delete your personal data, subject to legal limits
• The right to restrict or object to processing
• The right to data portability in a structured, machine-readable format
• The right to withdraw consent at any time, without affecting prior processing
• The right to lodge a complaint with your local data-protection authority

To exercise these rights, contact us at hello@yourbrand.com. We will respond within the timeframe required by applicable law and may need to verify your identity first.

The service is intended for business use and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, contact hello@yourbrand.com and we will delete it.

We use cookies and similar technologies for the following purposes:

• Essential cookies: authentication, session management and security — required for the service to function
• Functional cookies: remembering your preferences such as language and UI settings
• Analytics cookies: understanding how the service is used — set only with your consent where required
• Marketing cookies: measuring marketing campaigns on our public website — set only with your consent where required

You can change your cookie preferences at any time through your browser or any cookie controls we provide. [If you use a consent banner or specific analytics provider, describe it here.]

We use administrative, technical and organisational measures to protect personal data, including:

• Encryption of data in transit using TLS
• Encryption at rest for sensitive fields such as credentials and integration tokens
• Role-based access control with least-privilege principles
• Logging of administrative actions
• A documented incident-response process

No system can be completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify the relevant authority and affected users as required by applicable law.

We may update this policy from time to time. For material changes we will give reasonable advance notice by email or in-app notice before the changes take effect. For non-material changes we will post the updated policy here with a revised “Last updated” date.

For privacy questions or to exercise your rights, contact us. Please include enough information for us to verify your identity and act on your request.

• [Your Company Name Ltd / B.V.]
• [your country]
• Email: hello@yourbrand.com

[Add your full registered address and any company-registration or data-protection-officer details required in [your country]. If you process the personal data of individuals in other regions, add any representative or contact required there.]