Privacy policy

Towards account users (our customers) we act as the data controller. Towards the content of conversations with our customer's own end customers we act as a processor — that processing is governed by the Data processing agreement.

For account users: name, email address, sign-in credentials and subscription details. For conversations: message content, contact identifiers in connected channels (for example the name and phone number on WhatsApp), message metadata and technical logs.

Accounts and subscriptions are processed to perform the contract. Conversations are processed to provide the service on our customer's instructions. Technical logs are kept on the basis of our legitimate interest in keeping the service secure.

Data is processed by our sub-processors: the hosting, database and storage provider, the AI gateway and model providers used to generate answers, translations and the search index, web reading services, the social messaging platform, Meta (WhatsApp Business), a payment provider and an e-mail delivery provider. By name: Lovable (application hosting, the Lovable AI Gateway, e-mail sending); Supabase (database, sign-in and file storage within Lovable Cloud); Cloudflare (server runtime and DNS resolution when checking website addresses); Google (Gemini language model via the AI gateway – answers and translations); OpenAI (text-embedding-3-small via the AI gateway – search index); Zernio (Facebook, Instagram and TikTok connection); Meta Platforms (WhatsApp Business Cloud API, Facebook, Instagram); Stripe (payments); Firecrawl and Jina AI (reading websites that cannot be read directly). The processing region and data processing agreements with the individual providers are not yet documented; we will add them to this list once documented. The current list is part of the Data processing agreement.

Conversations and the knowledge base are kept for the duration of the contract. The workspace owner can export the data and request irreversible deletion at any time (it starts after a 7-day cancellation period). Deletion after termination is scheduled manually by the platform administrator for 90 days after termination; the scheduled deletion is then carried out automatically by a background job. Cancelling the subscription alone does not trigger deletion. If you only want your data deleted, the workspace owner requests it in the workspace settings; deletion does not end the subscription or billing – cancel those separately. Database backups held by the hosting provider cannot be edited individually and expire according to its retention period, which is not yet documented. For copies held by third parties we disconnect the channels and ask the providers to delete the data where possible, and we inform you of the result. Hiding a conversation in the inbox does not delete it.

Data subjects have the right of access, rectification, erasure, restriction of processing, data portability and objection. Requests from end customers should be addressed to our customer (the controller); we give them tools to delete conversations and contacts.

For any privacy matter contact us at info@aicustomercare.app. We reply within 30 days. You also have the right to lodge a complaint with the supervisory authority in your country of residence.