Security & privacy
Your data. Well protected.
Customer conversations are confidential. That's why security is built in – not bolted on.
How we protect your data.
Data separated per business
Every business has its own space. Access only comes through membership of that business.
Encrypted credentials
Credentials for WhatsApp, Telegram and connected calendars are stored encrypted with AES-256-GCM – never in the browser.
Verified messages
Incoming messages from WhatsApp and Telegram, notifications from booking tools and payment events from Stripe are verified by signature or secret key.
Closed database
The database is sealed off; only our application accesses it.
Roles and permissions
Owners, managers and staff see only what they need for their work.
Abuse protection
Rate limiting, bot protection and server-side validation of every input.
Where your data lives.
These providers take part in the processing – most of them on our behalf. We state their role, location and safeguards openly.
Vercel Inc.
- Purpose
- Hosting of website and application
- Location
- Servers in London (United Kingdom), delivery through Vercel's global network
- Safeguard
- Based in the US: EU-US Data Privacy Framework and EU standard contractual clauses; EU adequacy decision for the United Kingdom
Supabase Inc.
- Purpose
- Database
- Location
- London (United Kingdom)
- Safeguard
- EU adequacy decision for the United Kingdom; EU standard contractual clauses for access from the US
Google Cloud EMEA Ltd. (Gemini über Vertex AI)
- Purpose
- AI replies, transcription of voice messages and speech output
- Location
- global endpoint: Google data centres worldwide, including the US
- Safeguard
- EU-US Data Privacy Framework and EU standard contractual clauses; data not used for training
Resend Inc.
- Purpose
- Email delivery
- Location
- United States
- Safeguard
- EU-US Data Privacy Framework and EU standard contractual clauses
Stripe Payments Europe Ltd.
- Purpose
- Payment processing (as an independent controller), subscriptions and invoices (on our behalf)
- Location
- Ireland / United States
- Safeguard
- EU-US Data Privacy Framework and EU standard contractual clauses
Meta Platforms Ireland Ltd.
- Purpose
- WhatsApp Business Platform – under the terms each business agrees with Meta itself
- Location
- Ireland / United States
- Safeguard
- EU-US Data Privacy Framework
What happens to messages sent to the AI.
For a reply we only send the necessary part of the conversation and your approved information to the AI service. The data is not used there to train models. Ask your customers not to send sensitive data such as health details via WhatsApp.
Your rights and documents.
Data processing
The data processing agreement (DPA) under Art. 28 GDPR is part of every contract, and you can read it online at any time.
Access and deletion
Request access, correction or deletion informally by email.
Honest claims
We don't advertise certifications we don't have.