1. Two roles
For data about our customers (account holders and their team members) we are the controller. For data inside a customer's workspace, such as the visitors and customers who talk to a chatbot, the customer is the controller and we are a processor acting on their instructions under the Data Processing Addendum. If you are an end user talking to a business's chatbot, that business's privacy notice applies to your conversation.
2. What we collect about customers
- Account data: name, email, organisation name, country, password hash, role and login activity.
- Billing data: plan, invoices and payment status. Card details are entered on Stripe's pages and never reach our servers; we store a Stripe customer reference.
- Configuration: chatbots, knowledge files, channel credentials (encrypted at rest) and integration settings.
- Usage and technical data: IP address, browser, pages visited in the app, API requests and error logs, used for security, support and improving the Service.
- Correspondence: messages you send us through the contact form or support.
3. What we process on behalf of customers
Conversation messages, visitor identifiers (such as a browser-generated ID, phone number for WhatsApp, email address for email channels, caller number for voice), page URLs, and anything a visitor types or uploads. Customers decide what their chatbot asks for and how long it is kept.
4. Why we use it
- To provide, secure and bill the Service (performance of the contract).
- To generate chatbot answers, which requires sending the relevant conversation and knowledge excerpts to the AI provider configured for the platform.
- To deliver messages over the channels you connect (Meta/WhatsApp, email providers, Twilio, Slack, Telegram).
- To respond to support and sales enquiries.
- To comply with legal obligations and defend legal claims.
- With your consent, for optional analytics cookies (see the Cookie Policy).
5. Who we share it with
Service providers who process data for us under contract: our hosting provider, Stripe (payments), the AI model providers configured for the platform (for example OpenAI or Anthropic), speech providers for voice calls (Deepgram, ElevenLabs), the messaging and telephony networks you connect, and our email provider for transactional mail. We do not sell personal data. We disclose data to authorities only when legally required.
6. International transfers
Our providers may process data outside your country, including in the United States. Where the GDPR or UK GDPR applies we rely on adequacy decisions or the Standard Contractual Clauses with those providers.
7. Retention
Account data is kept while the account exists and for up to 30 days after deletion. Conversation data is kept according to the customer's settings and deleted when the workspace is deleted. Invoices are kept as long as tax law requires. Logs are kept for up to 90 days.
8. Security
Data is encrypted in transit (TLS) and channel credentials and API keys are encrypted at rest. Access to production systems is restricted to authorised staff and recorded in audit logs. No system is perfectly secure; report concerns to support@agentpro.chat.
9. Your rights
Depending on where you live you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to complain to a supervisory authority. Customers can edit most account data in the app and delete their workspace from settings. For anything else, or if you are an end user and the business cannot help, write to privacy@agentpro.chat. We answer within 30 days.
10. Children
The Service is for businesses and is not directed at children under 16. We do not knowingly collect their data as a controller.
11. Changes and contact
We will post changes here and, for material changes, notify account holders by email. Controller: AgentPro (operated by SIVRA), Address to be published on registration. Contact: privacy@agentpro.chat.