Privacy Policy

1.1 Account Information

When you create an account, we collect:

• Email address
• Name
• Password (stored securely using bcrypt hashing)
• Organization name and details

1.2 Customer Data You Upload

Through our platform, you may upload or sync customer data including:

• Customer names, email addresses, and phone numbers
• Transaction history and order details
• Product information and purchase amounts
• Custom fields and tags you define
• Subscription and billing information

1.3 Data from Connected Platforms

When you connect third-party platforms (WooCommerce, Shopify, OnPay, Shoppego, TheBoss, BCL, etc.), we receive:

• Webhook payloads containing order and customer data
• Transaction and subscription information
• Product catalog data

1.4 Usage and Technical Data

We automatically collect:

• IP addresses and approximate location
• Browser type and user agent
• Session information and login timestamps
• Actions performed within the platform (audit logs)
• AI query history and conversation context

2.1 Providing Our Services

• Managing your customer database and relationships
• Processing data imports and webhook synchronization
• Generating analytics, segments, and reports
• Powering AI-driven insights and analysis
• Sending email and WhatsApp broadcast campaigns on your behalf
• Running automations you configure

2.2 Security and Operations

• Authenticating users and preventing unauthorized access
• Monitoring for fraud and abuse
• Maintaining audit logs for compliance
• Troubleshooting and improving our services

2.3 Communications

• Sending service-related notifications
• Responding to support requests
• Providing product updates (with opt-out option)

3.1 Storage

Your data is stored in PostgreSQL databases. We implement appropriate technical and organizational measures to protect your information.

3.2 Encryption

• Passwords are hashed using bcrypt with salt
• Sensitive data (API keys, secrets) encrypted with AES-256-GCM
• All data transmitted over HTTPS/TLS
• Encryption keys support versioning for rotation

3.3 Access Controls

• Role-based access control (Admin, Manager, Analyst, Member, Viewer)
• JWT-based sessions with 8-hour expiry
• Automatic session invalidation on password change
• Email verification required for new accounts

4.1 AI Providers

For AI-powered analysis, we may send aggregated or anonymized data to AI providers (OpenAI, Anthropic, Google Gemini, or OpenRouter). We do not send raw personally identifiable information to AI providers.

4.2 Payment Processing

We use Stripe to process payments. Your payment information is handled directly by Stripe and is subject to their privacy policy.

4.3 Messaging Services

WhatsApp Business API is used for WhatsApp campaigns. Message content and recipient information are processed according to Meta's policies.

4.4 Connected E-commerce Platforms

Data from WooCommerce, Shopify, and other platforms you connect is subject to those platforms' respective privacy policies.