Privacy Policy

There are two roles. For the account data of people who sign up (workspace owners and staff) we are the controller. For the messages, contacts, orders and other data a business brings into its workspace from its own customers, the business is the controller and we act as its processor.

If you are a customer of a business that uses AI Employee Cloud, please contact that business first about your data.

• Account data: name, email address, hashed password, role, language, company name and industry.
• Conversation data: the content of messages and voice calls between a business and its customers, transcripts, summaries and the AI employee's replies.
• Contact and order data a business stores: names, phone numbers, email addresses, delivery addresses, orders, invoices and payment status.
• Identifiers from connected channels: for example a Facebook or Instagram user id, a WhatsApp number, a Telegram chat id, and the display name the platform shares.
• Connection data: access tokens for the channels and services a business connects, stored encrypted.
• Technical data: IP address, browser type, device language, log entries and usage counters used to secure and run the Service.

When a business connects a Facebook Page, an Instagram professional account or a WhatsApp Business number, Meta sends us the messages people send to that business, the sender's platform identifier and display name, and delivery information.

We use this only so the business's AI employee and staff can read and answer those messages and so they appear in the business's inbox. We do not use it for advertising, we do not sell it, and we do not combine it with data from other businesses. A business can disconnect a channel at any time, which stops new data arriving.

Connecting a Telegram bot lets us receive the messages people send to that bot. Connecting a point-of-sale system (for example Square or Shopify) lets us read the locations, products, stock levels and sales the business already has there, to show them alongside the rest of its data.

We only read the data needed for the features the business turns on.

• To provide the Service: route messages and calls to AI employees and staff, keep history, send replies, and produce summaries and analytics.
• To secure the Service, prevent abuse and fix problems.
• To bill and support customers.
• To improve quality, for example by measuring whether answers were grounded in a business's own knowledge.
• To meet legal obligations.

We do not sell personal data.

To understand and answer messages, and to turn speech into text and text into speech, we send the necessary content to AI and speech-processing service providers. Content is sent to them only to produce the response or transcript requested. Businesses that bring their own provider keys are also subject to that provider's terms.

Answers are generated automatically and can be wrong. Businesses can review conversations and take over from an AI employee at any time.

Where GDPR or similar law applies we rely on: performance of a contract (providing the Service), legitimate interests (security and improving the Service), consent where required (for example when a business connects a channel), and legal obligation.

• Service providers that host our infrastructure, process AI and speech, send email and take payments, only as needed to run the Service.
• The channel or platform a business connects, for example when a reply is sent back through Meta or Telegram.
• Authorities, when required by law.
• A successor, in a merger or acquisition, with notice to you.

We do not sell personal data.

Our infrastructure and providers may be located outside your country. Where the law requires it, we use appropriate safeguards for such transfers.

We keep data while a workspace is active. A business can delete conversations, contacts and connections in the Service and can ask us to delete its whole workspace. After deletion we remove the data from live systems, and it disappears from backups as they are rotated. We may keep limited records where the law requires, for example invoices.

We use encryption in transit, encrypted storage of channel credentials, separation of each workspace's data, access controls and audit logs. No system is perfectly secure; please tell us at once if you suspect misuse.

Depending on where you live you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. To use these rights see the Data deletion page or contact us. If you are a customer of a business that uses the Service, contact that business; we will help it respond. You may also complain to your data-protection authority.

The Service is for businesses and is not directed at children under 16. We do not knowingly collect their data.

We will post changes on this page and update the date above.

Questions or requests about this policy: by opening a support request inside your workspace.